asp.net 仿SQL注入

xylw
浏览: 60245 次
性别:
来自: 南宁
最近访客更多访客>>

killeryuan3
fly_chao
dbsuperman
lyjjy
博主相关

博客
微博
相册
留言
关于我
文章分类

全部博客 (61)
社区版块

存档分类

using System;   
using System.Data;   
using System.Configuration;   
using System.Web;   
using System.Web.Security;   
using System.Web.UI;   
using System.Web.UI.WebControls;   
using System.Web.UI.WebControls.WebParts;   
using System.Web.UI.HtmlControls;   
using System.Data.SqlClient;   
/// <summary>   
/// SqlCheck 的摘要说明   
/// </summary>   
///    
namespace cofcms   
{   
    public class SqlCheck   
    {   
         
        public void CheckSql()   
        {   
             
            string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--";   
            string[] jk_sql = jk1986_sql.Split('↓');   
            foreach (string jk in jk_sql)   
            {   
                // -----------------------防 Post 注入-----------------------   
                if (System.Web.HttpContext.Current.Request.Form != null)   
                {   
                    for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)   
                    {   
                        string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];   
                        string getip;   
                        if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)   
                        {   
                            System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");   
                            System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + "<br>");   
                            if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)   
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];   
                            }   
                            else  
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];   
                            }   
                            System.Web.HttpContext.Current.Response.Write("操 作 I  P ：" + getip + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 时 间：" + DateTime.Now.ToString() + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 页 面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 方 式：P O S T " + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 参 数：" + jk + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 数 据：" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + "<br>");   
                            System.Web.HttpContext.Current.Response.End();   
                        }   
                    }   
                }   
                // -----------------------防 GET 注入-----------------------   
                if (System.Web.HttpContext.Current.Request.QueryString != null)   
                {   
                    for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)   
                    {   
                        string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];   
                        string getip;   
                        if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)   
                        {   
                            System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");   
                            System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + "<br>");   
                            if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)   
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];   
                            }   
                            else  
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];   
                            }   
                            System.Web.HttpContext.Current.Response.Write("操 作 I  P ：" + getip + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 时 间：" + DateTime.Now.ToString() + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 页 面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 方 式：G E T " + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 参 数：" + jk + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 数 据：" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + "<br>");   
                            System.Web.HttpContext.Current.Response.End();   
                        }   
                    }   
                }   
                // -----------------------防 Cookies 注入-----------------------   
                if (System.Web.HttpContext.Current.Request.Cookies != null)   
                {   
                    for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)   
                    {   
                        string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];   
                        string getip;   
                        if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)   
                        {   
                            System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");   
                            System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + "<br>");   
                            if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)   
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];   
                            }   
                            else  
                            {   
                                getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];   
                            }   
                            System.Web.HttpContext.Current.Response.Write("操 作 I  P ：" + getip + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 时 间：" + DateTime.Now.ToString() + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("操 作 页 面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 方 式： Cookies " + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 参 数：" + jk + "<br>");   
                            System.Web.HttpContext.Current.Response.Write("提 交 数 据：" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + "<br>");   
                            System.Web.HttpContext.Current.Response.End();   
                        }   
                    }   
                }   
            }   
        }   
    }   
}
分享到：