ASP网站被扫描有注入点，该怎么办？如何解决！ASP网站被扫描有注入点，该怎么办？如何解决！  0 Y/ N4 O7 Y, ]' ^
试试这三种方法:
/ j8 I8 `/ n' |3 a第一种：
5 x0 t  B6 F7 g% ksquery=lcase(Request.ServerVariables("QUERY_STRING")) # ]( q: V# @! g5 `
sURL=lcase(Request.ServerVariables("HTTP_HOST"))
& \& U" D% ~* {' [+ J: M( Z7 N; [7 }/ K. t" a
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
/ P4 Z2 y9 r3 D! D) ^6 K
: \; C. i" \, x4 n1 ]8 ~5 i* SSQL_inj = split(SQL_Injdata,"|") + Z( _2 T8 y5 J

  `, o  p6 j- v+ w6 oFor SQL_Data=0 To Ubound(SQL_inj) - q2 c3 Q# _0 M) P
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then ; T$ P3 _) q& }$ F& ^
Response.Write "SQL通用防注入系统"
9 I" T+ h9 t( w+ K+ nResponse.end
. M) {# Z' G5 Z% Jend if
* {! V3 v: o! Snext . x: ~; {1 h8 Y! u# C3 i( ^3 R+ Y

$ d8 ]2 k5 t9 A/ z* p6 u/ e# q1 [/ m' N, m+ d
" j4 R8 i  N' O; G7 g  W
第二种： 9 E1 }: d  M4 M+ Z( _
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
  t% Y2 U9 S  B+ d7 r; _7 G, A  y  f9 A7 D
SQL_inj = split(SQL_Injdata,"|")
* O5 ]6 e6 Y' D7 w; F
) `' m6 p! x6 |, L5 [If Request.QueryString<>"" Then
. Q; L% r0 }! L; S5 y7 i$ pFor Each SQL_Get In Request.QueryString . j( J5 k7 x5 }& [/ H' ]" q
For SQL_Data=0 To Ubound(SQL_inj) 5 e2 x4 _0 B% j9 L
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then , _  x4 S0 b1 K% o
Response.Write "SQL通用防注入系统" 7 I  }/ J4 G6 q: ^6 o( ?
Response.end % i$ B4 B3 e! L  J7 e
end if
) k3 T( K& P# \5 y: Z* vnext
6 \1 @3 `# p$ J# M0 q6 lNext
* C) s( y, c5 s7 V. UEnd If 6 H1 z1 }8 N8 t  s) b

: a+ r! j/ T& `0 Y5 xIf Request.Form<>"" Then
/ R( K- o( \6 h8 }' ^+ OFor Each Sql_Post In Request.Form - ]$ I# w& g+ \5 M4 z
For SQL_Data=0 To Ubound(SQL_inj) 4 m6 q, k3 D2 ?) J' P5 S5 w9 g% W
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then " L0 Q( K+ ^9 T$ }7 @7 _1 \
Response.Write "SQL通用防注入系统" : B+ f. y& C% s$ B! d0 Q# i: s* a. L3 Q
Response.end
. N" h1 b( y2 jend if
( |& K- Z( N6 n( e- f* i) lnext
* M% k# U9 q( `# z, h+ K. F0 Lnext
' q: _  B( B$ c/ |/ U6 D7 g. xend if 2 M% O; F( L; y1 W& y
- r3 S' \* {2 G" h0 @; x
第三种 6 t: U; c7 Q0 U2 {+ L
<%
7 n, W; r4 v2 z. @$ z: s, I4 ?, Q; u'--------定义部份------------------
3 c0 s6 s2 `- [/ Q/ A# UDim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr % l  L2 o- m3 ?( W
'自定义需要过滤的字串,用 "■"分离 $ v- R( m/ ^2 z, q* T6 R7 m9 ~
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" 1 X3 N, U- o% V' F$ W. i3 b2 U7 N
'----------------------------------
9 y  z3 y2 W! O9 ~" j/ n+ I8 r) M%>
3 @0 d' h' {& O% Q9 X
+ s5 M  {( l) a" p& W<%
$ y: j8 C: x2 R9 O9 H" B5 iStr_Inf = split(Str_In,"■") * c/ c; x0 R8 t( f( D8 P2 ~
'--------POST部份------------------ , U7 n7 D7 l: ]
If Request.Form<>"" Then ) A* `0 T% s" ~  Z
For Each Str_Post In Request.Form 5 S: _3 ?3 q9 V

# ^% s+ l# Y' @' oFor Str_Xh=0 To Ubound(Str_Inf)
9 ]) u! D4 P; @& s  \$ i6 S, n) rIf Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then ' ^! m  ^& o  R- ]% O/ W3 q
'--------写入数据库----------头-----
# B6 P- H! H  [5 T! iStr_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
) K6 Z1 K( H. `- oSet Str_db=Server.CreateObject("ADODB.CONNECTION") : e% k0 K4 F( u7 i
Str_db.open Str_dbstr
5 Y; o& \$ N& GStr_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") : T6 u  X. r( k- a
Str_db.close
1 f& G) x+ |5 s( ^! ~  FSet Str_db = Nothing
0 @1 B/ `* s- N# H0 F'--------写入数据库----------尾----- 3 x. h! }$ N8 q, W0 d/ r9 Q% T
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>"
: ^5 ?; W$ n+ M  [! m2 H6 AResponse.Write "非法操作！系统做了如下记录:<br>" 5 @: [7 d' b: i2 L6 q9 E
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ' {4 T2 z* e. l2 ^2 g" _
Response.Write "操作时间："&Now&"<br>" $ C4 n* E  l0 l- Q
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
$ S. h/ m, z1 r5 D, D4 Y2 A% uResponse.Write "提交方式：POST<br>" - P0 F9 U* c2 Y' K$ T, ^
Response.Write "提交参数："&Str_Post&"<br>"
' E. g: O1 w/ J- OResponse.Write "提交数据："&Request.Form(Str_Post)
; X2 ~: u. x) U5 V) X' B/ q3 JResponse.End
1 \; R4 e# X: c8 z- X! REnd If - J  z  E7 b0 `# G, F( m
Next
! F) ~4 p1 D) a0 X3 c
/ S/ w- t9 Y7 d6 Q4 d+ mNext
/ i2 I- c/ ~' S9 yEnd If 1 w9 K# }2 i9 X
'---------------------------------- $ P$ f2 r* ?# @

" U1 Q" T! H; X1 }/ P; T; j) w'--------GET部份------------------- 0 C7 m! F; x5 ]0 N
If Request.QueryString<>"" Then
2 G' J" M1 u8 `( w% Y/ rFor Each Str_Get In Request.QueryString 0 o& X0 N: W2 W; n  f: X& z* M
& o3 }* h3 M" o
For Str_Xh=0 To Ubound(Str_Inf)
& g# w  ^; r7 j' Y* S* wIf Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then & ?' G# x+ Z# @8 r; |
'--------写入数据库----------头-----
5 B0 M  S- b9 i. T$ A0 ^  u4 uStr_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
7 y6 l7 O* W: [* y7 H6 A* E7 t7 ySet Str_db=Server.CreateObject("ADODB.CONNECTION")
  D* c* H$ w% g9 L0 L7 bStr_db.open Str_dbstr 5 C6 h0 S4 g' v% R6 i! X- M. `
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") 5 q$ R' ~( _& h+ }9 z) G
Str_db.close
: ?% _' s  V- c+ Q: {Set Str_db = Nothing 9 x% @- p8 ]( n
'--------写入数据库----------尾-----
6 _0 n, l7 a' B+ c8 `8 F1 g
+ Z# v" f3 i" ^/ V. bResponse.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>"
& s8 P. D- f/ x% e; r$ oResponse.Write "非法操作！系统做了如下记录:<br>"
; j1 c: e2 r: G3 Z) |+ F5 h3 sResponse.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" * A( B- T# _- H! Z1 v5 V
Response.Write "操作时间："&Now&"<br>" ; j$ O# u) r) Q& p$ E& N
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
+ u0 t, p9 S" [% K7 w7 [" qResponse.Write "提交方式：GET<br>"
& H9 r5 m# [! LResponse.Write "提交参数："&Str_Get&"<br>"
7 M" U, [6 m, M3 [Response.Write "提交数据："&Request.QueryString(Str_Get) ) k! S) y2 `( }3 S. S  z- e, p
Response.End + @, q" T; I5 S! i- Q+ a
End If . }$ Q" Z3 c5 `# H1 `
Next
* g4 S3 p4 q8 v2 `2 zNext ) G; A! s6 Z( P$ p$ @- B" G. j
End If
; A6 q9 }' m  W6 [, Y) [%> , \( E9 c3 a4 F
第3中方法需要你自己建个数据库表
7 W; h- a& B  O9 M, h
: F' @+ _8 Q) T, ?) {1 x[font=仿宋_GB2312][size=5][color=red]中国数据 专业域名注册 虚拟主机 客服8093 qq：356054959[/color][/size][/font]

:200: :200: 不懂

:202: AD