尝试利用？
我看到我的 nopCommerce 网站有一个记录的搜索：
ADw-script AD4-alert(202) ADw-/script AD4-
我有点好奇他们想要完成什么。我搜索了一下，发现 ADw-script AD4- 以 UTF7 编码为
他们只是检查漏洞吗？
记录了更多的黑客尝试，我在这里提出了一个关于它们的新问题：黑客尝试，他们试图做什么以及我如何检查他们是否成功？
I saw that my nopCommerce site had a logged search for:
ADw-script AD4-alert(202) ADw-/script AD4-
I'm a bit curious though what they were trying to accomplish. I searched a bit for it and appearently the ADw-script AD4- encodes in UTF7 to <script>. But why the alert(202)?
Were they just checking for vulnerabilities?
More hacking attemps was logged and I made a new question about them here: Hacking attempt, what were they trying to do and how can I check if they succeeded?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
有人正在检查您是否有 UTF-7 注入漏洞，以便稍后利用它。 UTF-7 仅使用通常被认为无害的字符。您是否总是在 HTML 中使用元字符集？
始终在 HTML 中使用尽可能高的元字符集，如下所示：
并且您不必担心基于 UTF-7 的 XSS 攻击。
Someone is checking if you have a UTF-7 injection vulnerability to exploit it later. UTF-7 uses only characters that are usually not considered harmful. Do you always use meta charset in your HTML?
Always use meta charset as high as possible in your HTML, like this:
and you won't have to worry about UTF-7 based XSS attacks.
是的，他们只是检查您的网站是否容易受到 XSS 攻击。
阅读 http://www.cgisecurity.com/xss-faq.html
和 Rsnakes XSS备忘单
http://ha.ckers.org/xss.html
了解更多信息
Yup , they were just checking if your site is vulnerable for XSS.
Read http://www.cgisecurity.com/xss-faq.html
and Rsnakes XSS cheat-sheet
http://ha.ckers.org/xss.html
for more info
据推测，看到
alert(202)执行将使攻击者决定将 JS 注入到您的页面是否可行。换句话说，是的，你可能正在被调查。Presumably seeing the
alert(202)execute would allow the attacker to decide whether it was feasible to inject JS onto your page. In other words, yes, you were probably being probed.如果您想避免这些类型的注入，则必须指定 Content-Type。
如果可能的话，尝试将 Content-Type 放入标头而不是元标记中。如果您想在 php 中执行此操作，您可以
在 php 应用程序的顶部执行此操作。如果由于某些原因你不能这样做，你可以将它放在你的元标签中：
If you want to be safe from these types of Injections, you must specify a Content-Type.
Try to put the Content-Type in headers instead of meta tags if possible. If you want to do it in php, you can do
at the top of your php application. If for some reasons you can't do it, you can put it in your meta tags: