asp.net oracle 3134,asp.net应用程序易受填充Oracle攻击的示例?

旧版本的ASP.NET易受Padding Oracle攻击。仍然可以通过一些调整来强制执行“旧”行为。我在

blog

样本代码打开了

GitHub

.

我们将攻击VIEWSTATE区域。首先,需要禁用ViewState签名。为此,请确保web.config文件中有以下设置:

以及一个易受Padding Oracle攻击的示例.ashx文件:

using System;

using System.Linq;

using System.Reflection;

using System.Web;

using System.Web.Security;

using System.Text;

public class EncryptionHandler : IHttpHandler

{

static readonly byte[] secret = Encoding.UTF8.GetBytes("Some text to break.");

public void ProcessRequest(HttpContext context)

{

var viewState = context.Request.Form["VIEWSTATE"];

if (viewState == null) {

viewState = MachineKey.Encode(secret, MachineKeyProtection.Encryption);

context.Response.ContentType = "text/html";

context.Response.Write("

" +

"" +

"

");

return;

}

var v = MachineKey.Decode(viewState, MachineKeyProtection.Encryption);

context.Response.ContentType = "text/plain";

if (v.SequenceEqual(secret)) {

context.Response.Write("I know the secret");

} else {

context.Response.Write("Something is wrong with my secret.");

}

}

public bool IsReusable {

get {

return false;

}

}

}

现在,基于HTTP代码(密码无效时为HTTP 500),您可以尝试攻击该站点(如前所述

here