黑客攻擊iis的主要發(fā)式演示及安全防范措施-wenkub
2022-08-29 14:46:32 本頁面
【正文】 oit Windows 2022 是一個安全的平臺嗎？ ? 是的！ YES! ? Security is builtin ? Winner of eWeek OpenHack challenge ? Customers who survived Code Red and Nimda ? Current on service packs and security patches ? “Locked down” systems so that vulnerabilities were not exposed ? Withstand attacks even without applying patches ? Did both for “defense in depth” ? Microsoft’s mitment ? Security Response Center ? STPP ? Windows174。 % 。 mov byte ptr [ebp13h],39。 mov byte ptr [ebp11h],39。 mov byte ptr [ebp0Fh],39。 mov byte ptr [ebp0Dh],39。 … demo Buffer Overflow 解決方法 ? strcpy ? strcat ? memcpy ? sprintf ? memcpy ? memset ? gets ? sscanf ? read ? strstr ? strrev ? … ? Validate all inputs ? See “Writing Secure Code” by Michael Howard and David LeBlanc ? Doublecheck or don’t use unsafe functions SQL Injection And again: All input is bad! if (isPasswordOK((name),(pwd))) { (Authenticated!)。 var strConnection=Data Source=c:\\auth\\。 + and pwd=39。 fAllowLogon = (oRS(0).Value 0) ? true : false。 delete oConn。139。139。 or 39。 and pwd=39。=39。mikey39。 demo SQL Injection 解決方法 ? Tell the attacker nothing! ? Determine what is valid input ? Beware of quotes ? Check SQL return values ? Disable parent paths in ASP ? En
環(huán)評公示相關(guān)推薦
鄂ICP備17016276號-1