Question

asp 求修复方法 XSS跨站脚本漏洞

<%
Function FindName(S)
Set Res=Server.CreateObject("Adodb.Recordset")
Sql="Select * From [User] Where UserName='" & s & "'"
Res.open sql,conn,1,3
if res.recordcount>0 then
FindName=true
else
FindName=false
end if
res.close
set res=nothing
End Function
UName=Replace(trim(Request.Form("UserName")),"'","")
PW=Replace(trim(Request.Form("Password")),"'","")
Sex=Replace(trim(Request.Form("Sex")),"'","")
QQ=Replace(trim(Request.Form("QQ")),"'","")
Age=Replace(trim(Request.Form("Age")),"'","")
AH=Replace(trim(Request.Form("AH")),"'","")
SF=Replace(trim(Request.Form("SF")),"'","")
if request("action")="submit" then
if UName="" then
response.Write("<script language='javascript'>alert('请输入用户名');history.back();</script>")
response.End()
end if
if PW="" then
response.Write("<script language='javascript'>alert('请输入密码');history.back();</script>")
response.End()
end if
if QQ="" then
response.Write("<script language='javascript'>alert('请输入QQ号');history.back();</script>")
response.End()
end if
if Age="" then
response.Write("<script language='javascript'>alert('请输入年龄');history.back();</script>")
response.End()
end if
if FindName(UName)=False then
Set rs=Server.CreateObject("Adodb.Recordset")
sql="Select * From [User]"
rs.open sql,conn,1,3
rs.addnew
rs("UserName")=UName
rs("Password")=PW
rs("Sex")=Sex
rs("QQ")=QQ
rs("Age")=Age
rs("AH")=AH
rs("SF")=SF
rs("RegDate")=now
rs.update
rs.close
set rs=nothing
'InSql="insert into UserTab(UserName,Password,Sex,QQ,Age,AH,SF) values('" & UName & "','" & PW & "','" & Sex & "','" & QQ & "','" & Age & "','" & AH & "','" & SF & "')"
'Response.write insql
'Conn.Execute InSql
response.Write("<script language='javascript'>alert('注册成功！系统自动跳转到登录界面....');window.location='index.asp?U=" & UName & "&P=" & PW & "';</script>")
else
response.Write("<script language='javascript'>alert('该用户名已经存在，请用其他用户名注册！');</script>")
end if
end if
%>

Answer 1

UName=Replace(trim(Request.Form("UserName")),"'","")
PW=Replace(trim(Request.Form("Password")),"'","")
Sex=Replace(trim(Request.Form("Sex")),"'","")
QQ=Replace(trim(Request.Form("QQ")),"'","")
Age=Replace(trim(Request.Form("Age")),"'","")
AH=Replace(trim(Request.Form("AH")),"'","")
SF=Replace(trim(Request.Form("SF")),"'","")

这里
我只举一个例子,以下全部效仿
UName=Replace(trim(Request.Form("UserName")),"'","")
改为
UName=Replace(Replace(Replace(Replace(trim(Request.Form("UserName")),"'",""),Chr(34),""),":",""),"%","")
把' " %等危险字符过滤掉就行了

Answer 2

可以在腾讯智慧安全页面申请使用腾讯御点
然后使用这个软件上面的修复漏洞功能
直接对电脑的漏洞进行检测和修复就可以了

Answer 3

我们主要看代码里对用户输入的地方和变量有没有做长度和对”<”,”>”,”;”,”'”等字符是否做过滤。还有要注意的是对于标签的闭合。输出的时候吧<和>转义成 < 和 >，这样HTML标签就不起作用了。尝试过滤参数，对用户输出进行转义或者过滤。一般<>/\^"'这些如果不需要都过滤一遍，其对应的转义也记得过滤一下，安全性就会提高。
漏洞代码示例：
<%
Dim param
Set param=Request.QueryString(“dd”)
response.write param
%>
修复范例：
<%
Dim param
Set param=Request.QueryString(“dd”)
response.write Server.HTMLEnCode(param)
%>

Answer 4

跨站脚本漏洞，通常是在提交的参数中带有特殊符号的，否则一般无法进行漏洞利用。
所以解决方法就是，对每个提交的参数进行判断，尤其要判断有没有小于号、大于号、单引号、双引号、括号。
最好还是采用例规性判断，比如xx.asp?id=1，就应该判断id参数的值是否为数字。而不仅仅判断它有没有特殊符号。

对于写入数据库的内容，在输出的时候可以进行特殊符号替换。比如把<替换成< 显示效果不变，但不会被用于嵌入<script>标签来执行恶意代码。

Answer 5

UName=Replace(trim(Request.Form("UserName")),"'","")
PW=Replace(trim(Request.Form("Password")),"'","")
Sex=Replace(trim(Request.Form("Sex")),"'","")
QQ=Replace(trim(Request.Form("QQ")),"'","")
Age=Replace(trim(Request.Form("Age")),"'","")
AH=Replace(trim(Request.Form("AH")),"'","")
SF=Replace(trim(Request.Form("SF")),"'","")

过滤不严，可以另写一个函数来过滤！

Function CheckBad(Str)
If IsNull(Str) Then
CheckBad= vbNullString
Exit Function
End If
str = Replace(str, Chr(0), vbNullString) : str = Replace(str, Chr(34), vbNullString)
str = Replace(str, Chr(9), vbNullString) ': str = Replace(str, Chr(255), vbNullString)''在某些系统存在问题
str = Replace(str, "+", "＋") : str = Replace(str, ")", "）")
str = Replace(str, "(", "（") : str = Replace(str, "%", "％")
str = Replace(str, "$", "＄") : str = Replace(str, "'", "''")
str = Replace(str, ";", "；") : str = Replace(str, "*", "＊")
str = Replace(str, "<", "＜") : str = Replace(str, ">", "＞")
str = Replace(str, "--", "－－")
CheckBad = Trim(str)
End Function

引用只要
UName=CheckBad(trim(Request.Form("UserName")))

每个都是这个格式就可以！