java – 禁止在URL中使用/的IIS 403

Top Level IIs:
Checked:  
  Allow unlisted file name extensions
  Allow unlisted verbs
  Allow high-bit characters
Unchecked:
  Allow double escaping

Request Limits:
Maximum allowed content length (Bytes):  30000000 Maximum URL length (Bytes):
4096 Maximum query string (Bytes):  2048

Sites
mySite123:
  Checked:  
    Allow unlisted verbs
    Allow high-bit characters
  Unchecked:
    Allow unlisted file name extensions
    Allow double escaping

  Request Limits:
    Maximum allowed content length (Bytes):  2147483647
    Maximum URL length (Bytes):  4096
    Maximum query string (Bytes):  2048

  Deny URL
    /CFIDE/Administrator
    /CFIDE/adminapi

我很确定您将获得403 Forbidden响应作为IIS的安全功能.这是一种已知的攻击向量.字符序列/只是/(正斜杠)字符的URL编码表示.显然,这对浏览器和互联网具有特殊意义.它用于目录遍历.在URL中编码特殊字符是绕过一些基本安全措施的黑客技巧.见OWASP的 Path Traversal.从 Full text of “The Web Application Hacker Handbook”开始(大约在该页面的一半)：

Chapter 10 Attacking Back-End Components 575

HACK STEPS

1. Always try path traversal sequences using both forward slashes and back
   slashes. Many input filters check for only one of these,when the filesystem may support both.

2. Try simple URL-encoded representations of traversal sequences using the
   following encodings. Be sure to encode every single slash and dot within
   your input:

   Dot — %2e
   Forward slash — %2f
   Backslash — %5c

3. Try using 1 6-bit Unicode encoding:

   Dot — %u002e
   Forward slash — %u22l5
   Backslash — %u22l6

4. Try double URL encoding:

   Dot-%252e
   Forward slash — %252f
   Backslash — %255c

5. Try overlong UTF-8 Unicode encoding:

   Dot — %c0%2e,%e0%40%ae,%c0ae,and so on
   Forward slash — %cO%af,%e0%80%af,%c0%2f,and so on
   Backslash — %c0%5c,%c0%80%5c,and so on

   …

(大胆是我的重点)

你可能想出一个方法来允许这个,但你为什么要这样做？我不推荐它.您想打开服务器以进行潜在的攻击吗？我认为最好一起避免这个URL序列. URL查询字符串中是否真的需要正斜杠字符？也许您可以使用不那么危险并且不会暴露您的服务器的不同方法,而不是在查询字符串中找到允许此字符的方法.对于该特定URL变量,您可以查找此不同的字符,并将其替换为服务器端所需的字符.就像是：

代替

http://example.com/index.cfm?x=a%2Fblah

使用

http://example.com/index.cfm?x=a-blah

然后在服务器上,你知道期望x变量中的 – (破折号)字符,所以你用服务器上的/(正斜杠)字符替换它.或者需要什么角色.

在ColdFusion中

<cfset x = Replace(URL.x,"-","/","ALL") />

请务必使用该字符串中不存在的某些唯一字符.始终记得清理服务器上所有用户提供的输入.

以下是我发现的一些关于URL中易受攻击的/字符序列的引用：

Component titles containing ‘/’ (forward slash) characters

IIS URL Decoding Vulnerability

Receive an HTTP 400 error if %2F is part of the GET URL in JBOSS

URL-encoded slash in URL

Generic Google search about the topic

请注意,上述某些引用与IIS以外的Web服务器有关,但它们表明存在漏洞.

你可能尝试的其他东西是双重逃避序列.所以代替/你有％2F(％是百分号).但是您需要在IIS中进行更改以支持此功能.参考 – if I name an image with a %2F,I cannot access it and when navigating to it,I get a 404.我认为这将是最后的手段. Double Encoding