Recently recieved about 15 attacks and wanted an expert to explain what each was trying to do
What I'm looking for is the following:
- What are the attacks below trying to do?
- Since an exception was thrown did the attack fail?
- Are there any possible attacks that could have been thrown similar to these that may have went through.
- Any links that lead to non-hacker friendly information so I can get up to speed on the evils of our world.
Answers will be given for partial answer since this is a long post. If I posted incorrectly or should have posted elsewhere let me know and I will correct. If you need more information please let me know also. Thanks in advance.
Site background ASP.NET 4.0, MVC 2.0, LLBLGEN DataAccess Layer, Ninject as you can tell below, MS SQL 2008.
Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/)&&a.endsWith(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/);if(a.NumberGroupSeparator!==n)c=c.split(n).join(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name ',b=a.indexOf('. Request URL: http://www.domain.com/,b=a.indexOf(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.NotImplementedException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/,a),d=e.indexOf(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/,String.format(Sys.Res.enumInvalidValue,c.split(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ParameterCountException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com开发者_Go百科/,Sys.EventArgs);Type.registerNamespace(
Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/);if(a&&a.tagName.toUpperCase()===
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.InvalidOperationException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name 'Sys.ArgumentOutOfRangeException'. Request URL: http://www.domain.com/Sys.ArgumentOutOfRangeException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/action
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.FormatException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/)a.value=
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: class=true;Number._typeName=">http://www.domain.com/;Date._class=true;Number._typeName=
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ArgumentNullException
Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/&&a.display!==
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ArgumentTypeException
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/;a.style.display=
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/).join(
Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/&&(b.position===
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: class=true;RegExp._typeName=">http://www.domain.com/;Number._class=true;RegExp._typeName=
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/);a.append(b.getTime());a.append(
Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/hcp/html/mTag.js
What are the attacks below trying to do?
They're trying to execute some code on your server by giving a bad URL and hoping you'd fall for it.
Since an exception was thrown did the attack fail?
Yes.
Are there any possible attacks that could have been thrown similar to these that may have went through.
Yes. If they were successful you probably wouldn't have gotten an exception.
Any links that lead to non-hacker friendly information so I can get up to speed on the evils of our world.
Read up on injection in general. As a rule, don't trust strings from the user to be syntactically valid - the canonical example is inserting an input string into a SQL query without checking the input, which can be "; DROP TABLE users;
I'm not familiar enough with ASP.Net to answer exactly, but it seems like somewhere the URL is executed? That doesn't make sense, so listen to somebody else on that front.
精彩评论