Asp.netÒ³ÃæÖ®¼ä´«µÝ²ÎÊýµÄ¼¸ÖÖ·½·¨
Asp.netÒ³ÃæÖ®¼ä´«µÝ²ÎÊýµÄ¼¸ÖÖ·½·¨
µÚÒ»ÖÖ·½·¨£ºITPUB¸öÈË¿Õ¼äR:s`4eP
ͨ¹ýURLÁ´½ÓµØÖ·´«µÝRequest.QueryStringITPUB¸öÈË¿Õ¼ä/G3Z;zZs'| `
send.aspx:ITPUB¸öÈË¿Õ¼ä@ V.X@k7P ^L'B
protected void Button1_Click(object sender, EventArgs e)
Zv!cSZ]6hB ?0 {
q g1bT&o1K G d*v2X0 Request.Redirect("Default2.aspx?username=honge");
&H(u%{/y)@$m4fm0 }ITPUB¸öÈË¿Õ¼ä|bI?-V"]
r\SuxP:K0receive.aspx:
0u$w'L6e#[kP0string username = Request.QueryString["username"];ÕâÑù¿ÉÒԵõ½²ÎÊýÖµ¡£
µÚ¶þÖÖ·½·¨£º
&Gs6Y;|Vd$f:_D0ͨ¹ýpost·½Ê½Request¡£
-{2D]:WN&[H*G |8R0send.aspxITPUB¸öÈË¿Õ¼ä-s4p!q)V-iG5K
<form. id="form1" runat="server" action="receive.aspx" method=post>ITPUB¸öÈË¿Õ¼ä SCS tZ~g
<div>
H*?.Yw$x0 <asp:TextBox ID="username" runat="server"></asp:TextBox>
nTm&|*]\2F#o]G0 //<input type="text" name="username" />ITPUB¸öÈË¿Õ¼ä}&F3_cUZ
<asp:Button ID="Button1" runat="server" nClick="Button1_Click" Text="Button" />ITPUB¸öÈË¿Õ¼ä&b Srv"G*iQ+|
</div>
)x([T0D@0</form>
~(v ^ U6V6G{0
]:`$c2o(Q1F%{e0receive.aspx
(kl)@"ha!@0string username = Ruquest.Form["receive"];//string username = Ruquest["username"];
µÚÈýÖÖ·½·¨£ºITPUB¸öÈË¿Õ¼äQ v{*pZ_w(A@x
ͨ¹ýsession
-a0?Q)R K@lzR,}D0send.aspx:
5w:Q,Lk5H?W L3n0 protected void Button1_Click(object sender, EventArgs e)
LjK4A N5DN7p;L|0 {
0vr:YkZ4S]8Y0 Session["username"] = "honge";
9S.VxU&DvRF0 Request.Redirect("Default2.aspx");
$F9p(I1rq;k0 }
"VVLAU0 ITPUB¸öÈË¿Õ¼ä1f7tRu;c,v~xr"H
receive.aspx:
+n+l
Ïà¹ØÎĵµ£º
¹úÄÚCMS£º
1.SiteServer CMS
SiteServer CMS ÍøÕ¾ÄÚÈݹÜÀíϵͳ£¨Öø×÷ȨµÇ¼ÇºÅ2008SR15710£©ÊǶ¨Î»ÓÚÖи߶ËÊг¡µÄCMSÄÚÈݹÜÀíϵͳ£¬Äܹ»ÒÔ×îµÍµÄ³É
±¾¡¢×îÉÙµÄÈËÁ¦Í¶ÈëÔÚ×î¶ÌµÄʱ¼äÄÚ¼ÜÉèÒ»¸ö¹¦ÄÜÆëÈ«¡¢ÐÔÄÜÓÅÒì¡¢¹æÄ£ÅÓ´óµÄÍøվƽ̨¡£
¡¡¡¡ SiteServer CMS ÊÇ»ùÓÚ΢Èí.NET ƽ̨¿ª·¢µÄÍøÕ¾ÄÚÈݹÜÀíϵͳ£¬Ëü¼¯³ÉÁËÄÚÈÝ·¢² ......
×î½üµÄÏîÄ¿ÀïÓõ½AjaxControlToolkit 3.5,ÏîÄ¿Íê³ÉÒÔºóÔÚ±¾µØ²âÊÔûÎÊÌ⣬·Åµ½·þÎñÆ÷ÉÏÈ¥ÔÚIE6¾Í³öÏÖAjax ¿Í»§¶Ë¿ò¼ÜδÄܼÓÔصÄÎÊÌ⣬ÔÚFF£¬IE7£¬Opera£¬SafariµÈä¯ÀÀÆ÷¶¼Ã»ÎÊÌ⣬ÕæÊǸ㲻¶®MSÔõô¸ãµÃ£¬ÏÖÔÚ ¾ÍÏëÅ×ÆúIE6£¬ÕҵĺÃÐÁ¿à°¡£¬ÍøÉÏ˵µÄ½â¾ö·½°¸¶¼ÊÔ¹ýÁË£¬¶¼Ã»Óã¬×îºóÕÒµ½µÄ´ð°¸ÊÇ£ºÓ¦ÓóÌÐòµÄ±àÂëÎÊ Ì⣬ֻҪÔÚ ......
»Ø³µµã»÷°´Å¥
Ö»ÐèÔÚ.aspxÒ³Ãæ´úÂëÖмÓÈëÒ»¶ÎJavaScript¼´¿É£º
<script type="text/javascript" language="javascript">
document.onkeydown = Check;
function Check(){ &n ......
Trustwave's SpiderLabs Security Advisory TWSL2010-001:
Multiplatform View State Tampering Vulnerabilities
Published: 2010-02-08 Version: 1.1
SpiderLabs has documented view state tampering
vulnerabilities in three products from separate vendors.
View states are used by some web application frame ......
WebÒ³ÃæÊÇÎÞ״̬µÄ£¬ ·þÎñÆ÷¶Ôÿһ´ÎÇëÇó¶¼ÈÏΪÀ´×Ô²»Í¬Óû§£¬Òò´Ë£¬±äÁ¿µÄ״̬ÔÚÁ¬Ðø¶ÔͬһҳÃæµÄ¶à´ÎÇëÇóÖ®¼ä»òÔÚÒ³ÃæÌøתʱ²»»á±»±£Áô¡£ÔÚÓÃASP.NET Éè¼Æ¿ª·¢Ò»¸öWebϵͳʱ£¬ Óöµ½Ò»¸öÖØÒªµÄÎÊÌâÊÇÈçºÎ±£Ö¤Êý¾ÝÔÚÒ³Ãæ¼ä½øÐÐÕýÈ·¡¢°²È«ºÍ¸ßЧµØ´«ËÍ£¬Asp.net ÌṩÁË״̬¹ÜÀíµÈ¶àÖÖ¼¼ÊõÀ´½â¾ö±£´æºÍ´« ......