网站ASP漏洞小总结 ASP website loopholes small summary

1. iis3/pws的漏洞 1. Iis3/pws vulnerability
Win95+pws上运行ASP程序，只需在浏览器地址栏内多加一个小数点ASP程序就会被下载下来。 Win95 + pws run the ASP program, just in the browser address bar to add a decimal point ASP program will be downloaded.

2. iis4的漏洞 2. Iis4 loopholes
iis4一个广为人知的漏洞是:$DATA，就是ASP的URL后多加这几个字符后，代码也可以被看到，使用IE的view source就能看到ASP代码。 iis4 a well-known loophole: $ DATA, is the URL of ASP more these characters, the code can also be seen, the use of IE's view source will be able to see the ASP code. Win98+PWS4没有这个问题。 Win98 + PWS4 not have this problem.

解决这个问题的办法有几种：一是将目录设置为不可读（ASP仍能执行），这样html文件就不能放在这个目录下，否则html不能浏览；二是安装微软提供的补丁程序；三是在服务器上安装ie4.01sp1。 Solve this problem there are several: First, the directory is set as unreadable (ASP can still perform), so that html file can not be placed in this directory, or can not view html; second is to install the patch provided by Microsoft; three is installed on the server ie4.01sp1.

3. 支持ASP的免费主页面临的问题 3 free home support ASP problems
ASP1.0的例子里有一个文件用来查看ASP源代码，/ASPSamp/Samples/code.asp。 ASP1.0 example there is a file to view the ASP source code, / ASPSamp / Samples / code.asp. 如果有人把这个程序上传到网站上去了，他就可以查看别人的程序了。 If this program was uploaded to the site up, he can see someone else's program.

既然ASP程序可以被人得到，别人就能轻而易举地知道你的数据库放在何处，网站的ACCESS数据库可能被人下载。 Since the ASP program can be obtained, people can easily know where to put your database, the site of the ACCESS database could be downloaded.

4.来自filesystemobject的威胁 4 threat from filesystemobject
iis4的ASP的文件操作可以通过file system iis4 the ASP file operations by file system
object实现，包括文本文件的读写、目录操作、文件的拷贝改名删除等。 object to achieve, including reading and writing text files, directory operations, file rename or delete the copy. 利用filesystemobjet可以篡改下载FAT分区上的任何文件，即使是ntfs，如果权限没有设定好的话，同样也能破坏。 Can tampering using filesystemobjet download any files on FAT partitions, even ntfs, if permission is not predetermined, the same can also be destroyed. 网络管理员应该将web目录建在ntfs分区上，非web目录不要使用完全控制，而应该是网络管理员才可以完全控制。 Web directory network administrator should be built in ntfs partition, do not use non-web directory full control, but should the network administrator can completely control.