注册
登录
| 关键词： request ServerVariables get regex end toppath nbsp set Response 参数 |
使用方法如下： 1. 代码直接发出来，大家copy之后，保存为ykmaiz_safe.asp，然后放到站点根目录即可。 <%02 'Code by kna-tech.com03 On Error Resume Next04 if request.querystring<>"" then call stophacker(request.querystring,"'|b(alert|confirm|prompt)b|<[^>]*?>|^+/v(8|9)|bonmouse(over|move)=b|b(and|or)b.+?(>|<|=|binb|blikeb)|/*.+?*/|<s*scriptb|bEXECb|UNION.+?SELECT|UPDATE.+?SET|INSERTs+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)s+(TABLE|DATABASE)")05 if Request.ServerVariables("HTTP_REFERER")<>"" then call test(Request.ServerVariables("HTTP_REFERER"),"'|b(and|or)b.+?(>|<|=|binb|blikeb)|/*.+?*/|<s*scriptb|bEXECb|UNION.+?SELECT|UPDATE.+?SET|INSERTs+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)s+(TABLE|DATABASE)")06 if request.Cookies<>"" then call stophacker(request.Cookies,"b(and|or)b.{1,6}?(=|>|<|binb|blikeb)|/*.+?*/|<s*scriptb|bEXECb|UNION.+?SELECT|UPDATE.+?SET|INSERTs+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)s+(TABLE|DATABASE)")07 call stophacker(request.Form,"^+/v(8|9)|b(and|or)b.{1,6}?(=|>|<|binb|blikeb)|/*.+?*/|<s*scriptb|<s*imgb|bEXECb|UNION.+?SELECT|UPDATE.+?SET|INSERTs+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)s+(TABLE|DATABASE)")08 09 function test(values,re)10 dim regex11 set regex=new regexp12 regex.ignorecase = true13 regex.global = true14 regex.pattern = re15 if regex.test(values) then16 IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR")17 If IP = "" Then18 IP=Request.ServerVariables("REMOTE_ADDR")19 end if20 'slog("<br><br>操作IP: "&ip&"<br>操作时间: " & now() & "<br>操作页面："&Request.ServerVariables("URL")&"<br>提交方式: "&Request.ServerVariables("Request_Method")&"<br>提交参数: "&l_get&"<br>提交数据: "&l_get2)21 Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!<br><br></div>")22 Response.end23 end if24 set regex = nothing25 end function26 27 28 function stophacker(values,re)29 dim l_get, l_get2,n_get,regex,IP30 for each n_get in values31 for each l_get in values32 l_get2 = values(l_get)33 set regex = new regexp34 regex.ignorecase = true35 regex.global = true 36 regex.pattern = re37 if regex.test(l_get2) then38 IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR")39 If IP = "" Then40 IP=Request.ServerVariables("REMOTE_ADDR")41 end if42 'slog("<br><br>操作IP: "&ip&"<br>操作时间: " & now() & "<br>操作页面："&Request.ServerVariables("URL")&"<br>提交方式: "&Request.ServerVariables("Request_Method")&"<br>提交参数: "&l_get&"<br>提交数据: "&l_get2)43 Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!<br><br></div>")44 Response.end45 end if46 set regex = nothing47 next48 next49 end function50 51 sub slog(logs)52 dim toppath,fs,Ts53 toppath = Server.Mappath("/log.htm")54 Set fs = CreateObject("scripting.filesystemobject")55 If Not Fs.FILEEXISTS(toppath) Then56 Set Ts = fs.createtextfile(toppath, True)57 Ts.close58 end if59 Set Ts= Fs.OpenTextFile(toppath,8)60 Ts.writeline (logs)61 Ts.Close62 Set Ts=nothing63 Set fs=nothing64 end sub65 66 %> 2.在所需要防护的页面加入代码 <!--#include virtual="/ykmaiz_safe.asp"--> 就可以做到页面防注入、跨站。如果想整站防注，就在网站的一个公用文件中，如数据库链接文件conn.asp中！添加<!--#include virtual="/ykmaiz_safe.asp"-->来调用本代码 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
