?
Solved

Problems with page

Posted on 2014-02-19
1
Medium Priority
?
425 Views
Last Modified: 2014-02-19
I have a page that filters a recordset, creates a session variable then redirects.

I ran a scan and found the following vulnerabilities:

---

Server responded 200 to unnecessarily large random request body(over 64 KB) for URL https://www.domain... etc ... , significantly increasing attacker's chances to prolong slow HTTP POST attack.

It has been detected by exploiting the parameter ASPSESSIONIDSUTBABRD
The payloads section will display a list of tests that show how the param could have been exploited to collect the information
Authentication:
In order to detect this content, no authentication has been required.
Access Path:
Here is the path followed by the scanner to reach the exploitable URL:

How can I secure this page to prevent this errors from happening ?
code.txt
0
Comment
Question by:amucinobluedot
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 53

Accepted Solution

by:
Scott Fell,  EE MVE earned 2000 total points
ID: 39870962
For sure you need to turn off parent paths.  It was common prior to iis7 to have them on. Then iis7 turned this off by default and many asp dev's turned it on so their scripts would not break.   The parent path thing can allow people to get outside of your web root.

http://www.iis.net/learn/application-frameworks/running-classic-asp-applications-on-iis-7-and-iis-8/classic-asp-parent-paths-are-disabled-by-default

The only thing you will need to change in your scripts for the most part are your include files.

This
<!--#include file="Connections.asp" -->
Would convert to
<!--#include virtual="/Connections.asp" -->
Or if it is in your connections folder
<!--#include virtual="/connections/Connections.asp" -->

Basically, links starting with ../ will need to be converted.


Why are you using client side to go to the next page?
<script language="javascript">
window.location.href="forgotpasswordsent.asp";
</script>

Open in new window

response.redirect will do it on the server before the page renders.
<%
response.redirect("forgotpasswordsent.asp")
%>

Open in new window

0

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to write a Context Sensitive Help (an online help that is obtained from a specific point in state of software to provide help with that state) ,  first we need to make the file that contains all topics, which are given exclusive IDs. …
Does your audience prefer people in photos or no people? How can you best highlight what you’re selling? What are your competitors doing, and what can you do that is different and unique from them?  Continue reading to learn how to make your images …
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
This tutorial demonstrates how to identify and create boundary or building outlines in Google Maps. In this example, I outline the boundaries of an enclosed skatepark within a community park.  Login to your Google Account, then  Google for "Google M…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question