渗透测试盲 SQL 注入和视图状态错误
我有一个 ASP.NET Web 应用程序，正在接受内部 IT 人员的笔测试。他们使用 IBM AppScan 对 Web 应用程序运行扫描。不断出现的错误之一是与视图状态输入字段相关的错误。该工具修改视图状态并将其发送回服务器。服务器抛出错误，然后捕获并重定向用户通用错误处理屏幕。 AppScan 将其标记为盲 SQL 注入。
我正在向 IT 安全人员解释这一点。我告诉他们，我能做的最好的事情就是捕获错误并向用户返回错误屏幕。他们坚称存在某种 SQL 注入。
对于这种情况，您推荐什么其他方式或方法？ 其他人如何处理这个问题？如果用户故意更改视图状态，错误屏幕不是最好的回复吗？
I have an asp.net web app that's going through a pen test by internal IT. They are using IBM AppScan to run scans against the web app. One of the errors that keeps coming up is viewstate input field related. The tool modifies the viewstate and sends it back to the server. The server throws an error then catch and redirect the user generic error handling screen. AppScan marks this as a blind SQL injection.
I'm explaining this to the IT security guys. I tell them that the best thing I can do is catch the error and return an error screen to the user. They are insisting that there's some kind of SQL injection going on.
What other way or method do you recomend for this kind of situation?
How do others handle this? If a user deliberately changes the viewstate isn't an error screen the best reply?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果短语：
不起作用，那么...我不知道，也许不使用视图状态？这会阻止他们...
另一个选择是：在内部记录故障，然后将它们注销。
If the phrase:
doesnt work, then... I dunno, maybe don't use viewstate? That'll stop 'em...
Another option would just be: log the fault internally, and just log them out.
继续和他们交谈。关闭他们记录的缺陷，将其标记为无效。
如果一切都失败了，请在测试中记录缺陷并继续。生命太短暂了。
Continue to talk with them. Close the defect they've logged, marking it as invalid.
If all else fails, log a defect on their tests and move on. Life is too short.