易受 Padding Oracle 攻击的 ASP.NET 应用程序示例？

发布于 2024-09-28 02:52:37 字数 70 浏览 5 评论 0 原文

有谁可以给我一个非常基本的 ASP.NET Web 应用程序示例，该应用程序容易受到 padding oracle 攻击。

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

梦途 2024-10-05 02:52:37

请尝试以下两个站点中的步骤来测试您的站点。

http://blog.dotsmart.net/2010/ 09/22/asp-net-padding-oracle-detector/

http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html

希望有帮助

回复收藏 0 原文

栀梦 2024-10-05 02:52:37

我知道这是一个很晚的答案，但也许有人会寻找此信息。

旧版本的 ASP.NET 容易受到 Padding Oracle 攻击。仍然可以通过一些调整来强制执行“旧”行为。我在我的博客，示例代码位于 GitHub。

我们将攻击 VIEWSTATE 字段。首先，您需要禁用 ViewState 签名。为此，请确保 web.config 文件中有以下设置：

<appSettings>
  <add key="aspnet:UseLegacyMachineKeyEncryption" value="true" />
</appSettings>

以及易受 Padding Oracle 攻击的示例 .ashx 文件：

<%@ WebHandler Language="C#" Class="EncryptionHandler" %>

using System;
using System.Linq;
using System.Reflection;
using System.Web;
using System.Web.Security;
using System.Text;

public class EncryptionHandler : IHttpHandler
{
    static readonly byte[] secret = Encoding.UTF8.GetBytes("Some text to break.");

    public void ProcessRequest(HttpContext context)
    {
        var viewState = context.Request.Form["VIEWSTATE"];

        if (viewState == null) {
            viewState = MachineKey.Encode(secret, MachineKeyProtection.Encryption);
            context.Response.ContentType = "text/html";
            context.Response.Write("<!doctype html><html><form action=\"/EncryptionHandler.ashx\" method=\"POST\">" +
                "<input type=\"hidden\" name=\"VIEWSTATE\" value=\"" + viewState + "\" />" +
                "<input type=\"submit\" value=\"Test\" /></form></html>");
            return;
        }

        var v = MachineKey.Decode(viewState, MachineKeyProtection.Encryption);
        context.Response.ContentType = "text/plain";
        if (v.SequenceEqual(secret)) {
            context.Response.Write("I know the secret");
        } else {
            context.Response.Write("Something is wrong with my secret.");
        }
    }

    public bool IsReusable {
        get {
            return false;
        }
    }
}

现在，根据 HTTP 代码（当密码无效时为 HTTP 500），您可以尝试攻击网站（如此处所述）。

I know it's a very late answer, but maybe someone will be looking for this info.

Old versions of ASP.NET were vulnerable to the Padding Oracle Attack. It is still possible to enforce the "old" behavior through some tweaks. I described them in detail on my blog and the sample code is on GitHub.

We will be attacking the VIEWSTATE field. First, you need to disable ViewState signing. To do that, make sure you have the following setting in the web.config file:

<appSettings>
  <add key="aspnet:UseLegacyMachineKeyEncryption" value="true" />
</appSettings>

And a sample .ashx file vulnerable to the Padding Oracle Attack:

<%@ WebHandler Language="C#" Class="EncryptionHandler" %>

using System;
using System.Linq;
using System.Reflection;
using System.Web;
using System.Web.Security;
using System.Text;

public class EncryptionHandler : IHttpHandler
{
    static readonly byte[] secret = Encoding.UTF8.GetBytes("Some text to break.");

    public void ProcessRequest(HttpContext context)
    {
        var viewState = context.Request.Form["VIEWSTATE"];

        if (viewState == null) {
            viewState = MachineKey.Encode(secret, MachineKeyProtection.Encryption);
            context.Response.ContentType = "text/html";
            context.Response.Write("<!doctype html><html><form action=\"/EncryptionHandler.ashx\" method=\"POST\">" +
                "<input type=\"hidden\" name=\"VIEWSTATE\" value=\"" + viewState + "\" />" +
                "<input type=\"submit\" value=\"Test\" /></form></html>");
            return;
        }

        var v = MachineKey.Decode(viewState, MachineKeyProtection.Encryption);
        context.Response.ContentType = "text/plain";
        if (v.SequenceEqual(secret)) {
            context.Response.Write("I know the secret");
        } else {
            context.Response.Write("Something is wrong with my secret.");
        }
    }

    public bool IsReusable {
        get {
            return false;
        }
    }
}

Now, based on the HTTP code (HTTP 500 when the cipher is invalid) you may try attacking the site (as described here).

回复收藏 0 原文

~没有更多了~