102上W04工作記錄

20130917處理網站弱點
網站偵測完畢之後
發現某個ASP網頁 有XSS弱點

參考下列網站
加入XSS filter function
暫時堵住XSS漏洞

function xss_filter(input)

dim newString
newString=input  
newString    = replace(newString,"--","")
newString    = replace(newString,";","")          
  newString    = replace(newString,chr(34),"'") 
  newString    = replace(newString,"'","") 
  newString    = replace(newString,"=","=") 
  newString    = replace(newString,"(","[") 
  newString    = replace(newString,")","]")
  newString = replace(newString,"'","''")
  newString = replace(newString,"<","[")
  newString = replace(newString,">","]")  
  newString = replace(newString,"/*","/") 
  newString = replace(newString,"*/","/")
  xss_filter = newString

end function

參考資料：

網路攻防戰

Filtering Encoded XSS in Classic ASP