用于asp.net的漏洞扫描程序标记跨站点脚本 [英] Vulnerability scanner for asp.net flags cross site scripting

问题描述

我正在运行netspark漏洞测试，它会在URL之后进行标记

I am running netspark vulnerability test and it flags following url

http://localhost:54923/search/'ns ='netsparker(0x005AAD)

http://localhost:54923/search/'ns='netsparker(0x005AAD)

我无法理解这是什么'ns ='netsparker(0x005AAD)或如何解决此问题，因此我正在清理输入/search/searchkeyword 使用户也对输入进行编码

I am not able to understand what 'ns='netsparker(0x005AAD) is this part or how to fix this issue i am sanitizing input /search/searchkeyword to make user ENcoding the input also

用户在搜索输入框中输入关键字，然后使用搜索关键字 http://localhost:54923/search/apple

User enter the keyword in search input box and then page is redirected with search page with the search keyword http://localhost:54923/search/apple

1>它不包含JS脚本

1> it doesn't contain and JS script

 if (filterInput.Contains("onmouseover") || filterInput.Contains("script") || filterInput.Contains("</style>") || filterInput.Contains("</script>") || filterInput.Contains("<") || filterInput.Contains("%3c") || filterInput.Contains("?") || filterInput.Contains("%3f") || filterInput.Contains("alert") )
            {
                search = System.Web.HttpUtility.HtmlEncode(filterInput);
                Response.Write("Invalid Search");
                Response.End();
            }

2>我将以下行添加到web.config中以使其更加安全

2> I am adding below line to web.config to make it bit more secure

<httpRuntime targetFramework="4.5" requestValidationMode="2.0" enable="true"  encoderType="System.Web.Security.AntiXss.AntiXssEncoder,System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>

基于此，我有几个问题

1. URL中的'ns ='netsparker(0x005AAD)是什么，它表示js吗?
2. 我该如何预防
3. 我采取的措施很好，或者我需要做更多的事情.

添加一些安全步骤后，netsparket仍将其标记为xss.我该如何解决这个问题，使其不被标记

After adding few security steps, netsparket still flags it as xss. How can i fix this so that its not flagged

推荐答案

基本上，当前的代码清理基于黑名单，这是一种不好的做法.

Basically the current code sanitization is based on a blacklist which is a bad practice.

在这种情况下，您无需清理，而对输入的内容进行编码.

In this specific case you don't need to sanitize but rather Encode the incoming input.

ASP.Net输入验证也基于也不是安全的黑名单.

The ASP.Net Input validation in also based on blacklist which is also not secure.

这篇关于用于asp.net的漏洞扫描程序标记跨站点脚本的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！