eWebEditor v3.8 列目录_ASP教程

推荐：ASP无组件分页实现思路及代码
无组件分页不可思议吧，看一看本文的效果就知道了，下面与大家分享下具体的实现，感兴趣的朋友可以参考下哈

 　　标题：asp eWebEditor v3.8 列目录漏洞(其他版本为测试)

　　漏洞文件：asp/browse.asp

　　漏洞产生：

　Sub InitParam()

        sType = UCase(Trim(Request.QueryString("type")))         sStyleName = Trim(Request.QueryString("style"))         sCusDir = Trim(Request.QueryString("cusdir"))         Dim i, aStyleConfig, bValidStyle         bValidStyle = False         For i = 1 To Ubound(aStyle)                 aStyleConfig = Split(aStyle(i), "|||")                 If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then                         bValidStyle = True                         Exit For                 End If         Next         If bValidStyle = False Then                 OutScript("alert('Invalid Style.')")         End If         sBaseUrl = aStyleConfig(19)         nAllowBrowse = CLng(aStyleConfig(43))         nCusDirFlag = Clng(aStyleConfig(61))         If nAllowBrowse <> 1 Then                 OutScript("alert('Do not allow browse!')")         End If         If nCusDirFlag <> 1 Then                 sCusDir = ""         Else                 sCusDir = Replace(sCusDir, "\", "/")                 If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then                         sCusDir = ""                 Else                         If Right(sCusDir, 1) <> "/" Then                                 sCusDir = sCusDir & "/"                         End If                 End If         End If         sUploadDir = aStyleConfig(3)         If Left(sUploadDir, 1) <> "/" Then                 sUploadDir = "../" & sUploadDir         End If         Select Case sBaseUrl         Case "0"                 sContentPath = aStyleConfig(23)         Case "1"                 sContentPath = RelativePath2RootPath(sUploadDir)         Case "2"                 sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir))         End Select     sUploadDir = sUploadDir & sCusDir         sContentPath = sContentPath & sCusDir         Select Case sType         Case "FILE"                 sAllowExt = ""         Case "MEDIA"                 sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov"         Case "FLASH"                 sAllowExt = "swf"         Case Else                 sAllowExt = "bmp|jpg|jpeg|png|gif"         End Select         sCurrDir = sUploadDir         sDir = Trim(Request("dir")) '1.假设dir= ../ '2.假设dir=...// '3.假设dir=.....///         sDir = Replace(sDir, "\", "/")  '过滤1         sDir = Replace(sDir, "../", "") '过滤2 '1.到这里就被过滤了         sDir = Replace(sDir, "./", "") '过滤3 '2到这里也被功率了 '3到这里就成../了。比较有趣的饶过！好象不少cms这样过滤过。[/color]         If sDir <> "" Then                 If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then                         sCurrDir = sUploadDir & sDir & "/"                 Else                         sDir = ""                 End If         End If End Sub

分享：ASP如何获取真实IP地址
在 ASP 中使用 Request.ServerVariables(REMOTE_ADDR) 来取得客户端的 IP 地址，但如果客户端是使用代理服务器来访问，那取到的就是代理服务器的 IP 地址，而不是真正的客户端 IP 地址。要想透过代理服务器取得客户端的真实IP 地址，就要使用Request.ServerVariables(H