Securing ASP Pages After The Horse Has Bolted
I recently put together a site for a friend that needed a database to drive part of it. I tried and failed miserably at trying to learn ASP.NET & PHP so my friend sourced a web developer graduate who said he'd done a CMS for his final degree work. Great I thought, that takes care of the DB side of things.
On the back end, there are 4 web pages that deal with managing the database submissions:
1.) A login page
2.) A page to add a record to the database
3.) A page to delete a record from the database
4.) A page to update a record on the database
The login page has some sort of encryption within its ASP code but is not in protected directory so I guess it's probably subject to a brute force attack, but this I think my friend is prepared to live with as his site is so specialist and low-traffic. Code:
View Replies
ADVERTISEMENT
tell me a way to programmatically with script at the server, reset the current user's security context from the IUSR_ account to a different one? what we'd do is anyone who is already logged in as a customer through our ASP page login setting customer-specific session variables.
we'd programmatically impersonate them as a different windows account,switching them from the anonymous IIS account they start off as. Bottom line is that we don't want them to have to login a 2nd time to get to these new pages. We've got other non-asp files that I cannot simply put behind an ASP-based login, which is why we need to lock the directory down behind Windows security.
View Replies
View Related
How do I go about securing download files on my site so users can download those files only by clicking a link and not by typing the files address in the address bar. Is this even possible?...
View Replies
View Related
I am wriging a web application which cosists of a main directory with all the main code, and a subdirectory with the administration features. althogh the two locations will share configuration resources, I need to protect the admin folder from unauthorised access. I know that in apache their is some kind of authentication (I think it is used through an ".htaccess" command or someting) and I'm wanting to do a similar thing in ASP.
View Replies
View Related
Are there some easy to use (and free) web scanning tools that can check
for security vulnerabilities (SQL injection, cross site attacks) on classic
ASP apps and suggest ways to fix them?
View Replies
View Related
Developed a web application which adopts a custom security model which displays a login page and requests a username/password combination. The username works in a mixed-mode of usernames matched with the windows login name and some extra accounts (similar to SQL mixed-mode security). Web application is executed both in the corporate intranet and externally on the web.
Getting user complaints about having to login to the web application when they have already logged-on to windows. I have coded a challenge/response (response.status=401) to get a user's window login through the ServerVariables. This seems to work OK for the intranet access. If the user's windows account is not located in the application database then I redirect to the standard login page for the username/password combination. When the application is executed across the internet through a firewall, the user is prompted by IE to enter the windows domain, username, and password. There seems to be no mechanism to avoid this because of the challenge/response code. I wish that with external access from the internet that users are automatically directed to the application login screen and not faced with the IE windows authentication dialog.
Anyone care to offer a solution?
View Replies
View Related
I recently developed my first website and I hosted it on my pc.But when I try to access it from other computers, I am able to do that only when I turned the firewall off.Is there any possibility to access my website in internet on providing security to my system?
And one more problem is when ever I access any control on my webpage in internet, I am getting a dailogue box indicating that "connecting to mysite.dnsalias.com" and it is asking for userid and password.If any one knows please tell me why I'm getting the dailogue box and how to avoid getting it.
View Replies
View Related
I have a client who has a password protected page via session that lists a bunch of pdf's.They are a little worried that you are able to browse and see the pdf's via the url without being logged in.
I'm not sure if it's possible or not but is there a way after their username and passord is verified to automatically grant them permisson to view the contents of the pdf directory?
View Replies
View Related
How can I make my asp page secure so that I can sell it and not have people be able to view the code. I know one way to do this would be to make it a component, but I dont really know how to convert ASP into Visual Basic.
View Replies
View Related
I have a website setup which has MS-Access DB. The web pages are in ASP and uses ADO to connect to DB. The DB is located in the Folder "/Database". I have the Connection string setup in the Global.asa file.
As my virtual Directory is "/" and all files and folders including the "Database" folder are with in the folder so any one who knows the Database
folder name and database name can directly download the database from the
website.
The physical Directory for the virtual directory is: -
d:mywebsite
d:mywebsitedatabase
d:mywebsiteDLLs
d:mywebsiteimages
d:mywebsiteinclude
d:mywebsitestylesheet
d:mywebsite emplate
How Can I restrict the database to be access directly from web? Please suggest all alternatives that I can opt for.
View Replies
View Related
I am using Dreamweaver with ASP VBSCRIPT and want to secure a password that the user puts in and sends to my sql server 2000 database. Can anyone give me any guidance how I could do this?
View Replies
View Related
I haven't started programming with databases yet, but instead have been saving data in asp files. The files would look something like this.... Code:
View Replies
View Related
My client has purchased 'software' - it really is just a series of html documents. I need to ensure that these pages are protected and only those who log in can view them.
I am building an asp/db based login front end to ensure that users have paid for the system. I just do not know how to protect the files from there because they are html. Converting them to asp is not an option.
View Replies
View Related
How can I protect from SQL-injection in this instance?Code:
sql = "
SELECT dbo.admin.id, dbo.admin.email
FROM dbo.admin
WHERE dbo.admin.username = '"&Request.Form("user")&"'"
View Replies
View Related
I've learned how to basically access the database. Set ADOConn = Server.CreateObject ("ADODB.Connection")ADOConn.Open "myDataSource", "sa", "ItsASecret" But putting that code in each asp pages or putting it in the global.asa will be insecure. Since if the hacker gets the asp files or the global.asa files they will know the user id and password for the database. In this case, it's "sa" and "ItsASecret".
How can I do it so that they will never see this? I know of a way by using the Metabase.
if I'm not running my own IIS server to do that and that I'm just gonna rent a webspace what are their options? Will they let me change or add this in their metabase? If not, what's the term for securing it? How should I go about securing my database id and password?
View Replies
View Related
all my ASP sites use an Access database. Most are parts of our company intranet and i want to protect the databases from being opened but have it so that i can open the tables and make adjustments if needed.
I've tried adding a password to the database but of course that prevents it from being accessed via ASP. Just wondered if anyone had come across this problem and found a viable solution.
View Replies
View Related
I intend to send word documents thru mail to my clients. I don't want my clients to save the word document to there system and i don't want them to print the word documents. How can i achieve both the tasks ?
View Replies
View Related
Looking for a way to secure string. Have connect.asp page as an include file, but want to still use dsn-less connection and not have this in an asp page. Though about putting this in the global.asa file. Don't want to create a DSN and give IUSR_ rights to SQL DB.
View Replies
View Related
Firstly, apologies if this is the wrong section!
Ive created a site using ASP and an Access database. At the moment the database is unprotected, and I haven't used any usernames or passwords to access the database.
Now that development of the core site is almost complete, i want to secure the database.
View Replies
View Related
I have a client who has a password protected page (via session) that lists a bunch of pdf's. They are a little worried that you are able to browse and see the pdf's via the url without being logged in.
I'm not sure if it's possible or not but is there a way after their username and passord is verified to automatically grant them permisson to view the contents of the pdf directory?
View Replies
View Related
Using IIS 5.0 and sometime some asp pages (absolutely
randomly) showing as blank white pages. So far only one
way of fixing it - restart whole server. Restarting IIS,
or specific web server not helping, only whole server.
I enable server side and client side debugging, but no
errors showing up...
In view source pages always look like this:
-----------------------
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0
Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html;
charset=windows-1251"></HEAD>
<BODY></BODY></HTML>
-----------------------
Any idea why it can happened and how to fix?
View Replies
View Related
I am always getting cached pages even contents of the page changed on the server but I am getting old page (data).How to solve this.
View Replies
View Related
is it possible to create pages using other pages. Here is an example... Can I make a page that has a menu on it, but the menu is actually a seperate page that I call with ASP?
View Replies
View Related
We run a website with pages that are created using ASP. The website is
used by different people from different networks. For some people, the
pages are stuck. It looks like the were able to open the page, but it
is not displayed on their browser. We think that it might be something
to do with their proxy. Does anybody know how to solve this problem?
View Replies
View Related
I had a 404 page set up in IIS 5.0 that would the the URL of the requested page from the query string. i recently upgraded to IIS 6.0 but it doesn't seem to put the requested URL in the query string as it did in IIS 5.0 and 3.0. Does anyone know how i can get the requested url property in IIS 6?
View Replies
View Related
I have a bout 5 different pages of which each will contain a form requiring users to complete. These forms are all related as one project. It is necessary that if the user was to only complete the first form they could theoretically quit, come back later (time not dependant) and complete the remaining pages. Therefore I think the best way to do this is to write the values to the database upon each click of the next button. The only other issue with this is that the user will also be receiving a pdf file at the end of the full form submission with all their information inserted into this pdf and finalized. Now. I am aware of pdflib in which I need php but my choice was to do this in asp. What are my options here? Should I combine them, should I draw all the info from the db at the very end with php and then create the pdf, should I use sessions during the entire process
View Replies
View Related
When asp.net pages are made in vs.net, loading on the
local host displays the labels all in the top left corner
of the screen. Also, all textboxes and image buttons are
not even displayed at all. If pages are made on a remote
server, they load perfetly fine, it is just the local host
displaying them incorrectly. Is this a common problem?? I
have iis 5.0 installed with windows 2000. i use the full
version of vs.net to make asp.net pages.
View Replies
View Related
I have a web site I've recently moved to a new provider.It has
worked for years.On the new provider's servers ( Win2k Server .NET 1.1 )
my asp 3.0 pages often don't completely execute.
Here is what happens: Most of the page starts displaying in the browser,
then you see some HTML, then nothing.
If you refresh a few times, the page finally completely loads. There is
never an error reported during any of this.
View Replies
View Related
I have installed IIS 5 on Windows 2000 Server and have applied all the neccessary updates and patches. I am unable to run any ASP pages on the local server. I am able to view the HTML pages though. I have checked everything but cannot seem to figure it out. I end up getting HTTP 500 for all the web pages.
View Replies
View Related
I am trying to setup a demo server for an asp.net web site that is working on my real website. The demo is Win2K and I have installed .net framework and IIS, both successfully,I think.
The problem is that when I try to access the demo site, the pages are not being served correctly - only lables are displayed, and not as configured. HTML pages display correclty. I tried to run aspnet_regiss, but get an unkown function error.
View Replies
View Related
i can make a database, add entries to database, delete from database, but the only thing i want is "How to divide entries in Pages" like we can see in the guest-book etc Scripts.
This is an Example: Quote:
Entries: 500 Pages: 1|2|3|4|5
how to divide the entries in pages, like 10 entries per page..?
View Replies
View Related
I've got a site that's been up and running for a couple of years.I've added some new stuff and it looks fine on my computer. However other people are seeing the old stuff.
I've tried a manual refresh of both my browser and theirs but nothing, the URL's are identical . This is a real problem as i'm away for a month as of Friday and the site is needed for a project.
View Replies
View Related
Our website is in html format. I want to change it to asp. I have already created my index page and have it on the server as index.asp. When I load the website it brings it up with no problem. On this index page I have links to all the pages on the website which are basically articles of varying lengths.
I want to use the query string (i.e. page.asp?pageid= or authorid=) ect. to load that article. Do I need to develop a database to store these articles in? If so can I include the formating code in the database field for the article itself. My fields in the database (ms access) would have for example article_id, author_id, article_txt, ect. How much can I place in a particular field (txt wise)?
I understand that the information passed in the query string after the ? searches the database for a match. Once it finds a match how do I display the article and have my formatting included, ect.? I hope this makes some sense.
View Replies
View Related
