Solved

Problems with page

Posted on 2014-02-19
1
409 Views
Last Modified: 2014-02-19
I have a page that filters a recordset, creates a session variable then redirects.

I ran a scan and found the following vulnerabilities:

---

Server responded 200 to unnecessarily large random request body(over 64 KB) for URL https://www.domain... etc ... , significantly increasing attacker's chances to prolong slow HTTP POST attack.

It has been detected by exploiting the parameter ASPSESSIONIDSUTBABRD
The payloads section will display a list of tests that show how the param could have been exploited to collect the information
Authentication:
In order to detect this content, no authentication has been required.
Access Path:
Here is the path followed by the scanner to reach the exploitable URL:

How can I secure this page to prevent this errors from happening ?
code.txt
0
Comment
Question by:amucinobluedot
1 Comment
 
LVL 52

Accepted Solution

by:
Scott Fell,  EE MVE earned 500 total points
ID: 39870962
For sure you need to turn off parent paths.  It was common prior to iis7 to have them on. Then iis7 turned this off by default and many asp dev's turned it on so their scripts would not break.   The parent path thing can allow people to get outside of your web root.

http://www.iis.net/learn/application-frameworks/running-classic-asp-applications-on-iis-7-and-iis-8/classic-asp-parent-paths-are-disabled-by-default

The only thing you will need to change in your scripts for the most part are your include files.

This
<!--#include file="Connections.asp" -->
Would convert to
<!--#include virtual="/Connections.asp" -->
Or if it is in your connections folder
<!--#include virtual="/connections/Connections.asp" -->

Basically, links starting with ../ will need to be converted.


Why are you using client side to go to the next page?
<script language="javascript">
window.location.href="forgotpasswordsent.asp";
</script>

Open in new window

response.redirect will do it on the server before the page renders.
<%
response.redirect("forgotpasswordsent.asp")
%>

Open in new window

0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
PCI Scan on IIS Remediation not working 1 40
innerHTML 7 34
Help in good tutorials for PHP, HTML and CSS 6 40
Filktering Alphabetically 8 29
Get to know the ins and outs of building a web-based ERP system for your enterprise. Development timeline, technology, and costs outlined.
Today, the web development industry is booming, and many people consider it to be their vocation. The question you may be asking yourself is – how do I become a web developer?
This video teaches users how to migrate an existing Wordpress website to a new domain.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question