asp.net里面用appscan扫描部分漏洞与解决方法（一）

1、sql注入攻击
使用参数方法录入，过滤单引号。
2、已解密登录请求
AppScan要求密码都要加密传输，最好是使用https。这个问题还可以使用ajax来触发帐号验证并登录，
function login() {
            if ($("#txtUser").val() != '' && $("#txtPassWord").val() != '') {
                $.ajax({
                    url: 'Login.ashx', //访问路径
                    data: 'username=' + $("#txtUser").val() + "&password=" + $("#txtPassWord").val() + "&cord=" + $("#txtVCode").val(), //需要验证的参数
                    type: 'post', //传值的方式
                    error: function() {//访问失败时调用的函数
                        alert("链接服务器错误！");
                    },
                    success: function(msg) {//访问成功时调用的函数,这里的msg是Login.ashx返回的值
                        if (msg == "登录成功！") {

                            window.location.href = '<%=url %>';
                        }
                        else {
                            alert(msg);
                            if (msg == "验证码不对！") {
                                $("#checkcordImg").attr("src", "validatecode.aspx?time=" + new Date());
                                $("#txtVCode").focus();
                            }
                        }
                    }
                });
            }

<table width="300" border="0" align="left" cellpadding="0" cellspacing="0">
                                    <tr>
                                        <td height="35" style="width: 47px">
                                        </td>
                                        <td width="18%">
                                            用户名：
                                        </td>
                                        <td width="67%" align="left">
                                            <input id="txtUser" type="text" maxlength="20" style=" width:135px" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td height="35" style="width: 47px">
                                        </td>
                                        <td>
                                            密&nbsp;&nbsp;码：
                                        </td>
                                        <td align="left">
                                             <input id="txtPassWord" type="password" maxlength="50" style=" width:135px" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td height="54">
                                        </td>
                                        <td>
                                            验证码：
                                        </td>
                                        <td align="left">
                                            <table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                <tr>
                                                    <td>
                                                        <asp:TextBox ID="txtVCode" runat="server" Width="80px"></asp:TextBox>
                                                    </td>
                                                    <td>
                                                        <img id="checkcordImg" src='validatecode.aspx' οnclick="this.src='validatecode.aspx?abc='+Math.random()"
                                                            alt="图片看不清？点击重新得到验证码" style="cursor: hand;" />
                                                        <asp:RequiredFieldValidator ID="RequiredFieldValidator6" runat="server" ErrorMessage="验证码不能为空！"
                                                            ControlToValidate="txtVCode">*
                                                        </asp:RequiredFieldValidator>
                                                    </td>
                                                </tr>
                                            </table>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td colspan="3">
                                            <asp:ValidationSummary ID="ValidationSummary1" runat="server" ShowMessageBox="True"
                                                ShowSummary="False" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td style="width: 47px">
                                        </td>
                                        <td colspan="2" valign="bottom" align="center">
                                           <img src="Img/imgLogin/btn_12.jpg" alt=""  οnclick="javascript:login();" />
                                            &nbsp;&nbsp;<img src="Img/imgLogin/btn_14.jpg" alt="" width="59" height="25" οnclick="reset();" />
                                        </td>
                                    </tr>
                                </table>
纯脚本提交登录
那个工具只会整个页面post

所以改为纯脚本提交登录后它就无效了。

3、检测到隐藏目录

解决方法1：iis里面设置默认错误页面为我们指定的errpage.html页面，不要使用系统默认的错误页面。
解决方法2：在img文件夹里面放个空的默认页（比如空的index.aspx），这样就不会有【找不到页面或无权查看】的错误了。