开发者

Recently recieved about 15 attacks and wanted an expert to explain what each was trying to do

What I'm looking for is the following:

  1. What are the attacks below trying to do?
  2. Since an exception was thrown did the attack fail?
  3. Are there any possible attacks that could have been thrown similar to these that may have went through.
  4. Any links that lead to non-hacker friendly information so I can get up to speed on the evils of our world.

Answers will be given for partial answer since this is a long post. If I posted incorrectly or should have posted elsewhere let me know and I will correct. If you need more information please let me know also. Thanks in advance.

Site background ASP.NET 4.0, MVC 2.0, LLBLGEN DataAccess Layer, Ninject as you can tell below, MS SQL 2008.

  1. Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/)&&a.endsWith(

  2. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/);if(a.NumberGroupSeparator!==n)c=c.split(n).join(

  3. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name ',b=a.indexOf('. Request URL: http://www.domain.com/,b=a.indexOf(

  4. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.NotImplementedException

  5. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/,a),d=e.indexOf(

  6. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/,String.format(Sys.Res.enumInvalidValue,c.split(

  7. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ParameterCountException

  8. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com开发者_Go百科/,Sys.EventArgs);Type.registerNamespace(

  9. Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/);if(a&&a.tagName.toUpperCase()===

  10. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.InvalidOperationException

  11. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name 'Sys.ArgumentOutOfRangeException'. Request URL: http://www.domain.com/Sys.ArgumentOutOfRangeException

  12. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/action

  13. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.FormatException

  14. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/)a.value=

  15. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: class=true;Number._typeName=">http://www.domain.com/;Date._class=true;Number._typeName=

  16. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ArgumentNullException

  17. Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/&&a.display!==

  18. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/Sys.ArgumentTypeException

  19. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/;a.style.display=

  20. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/).join(

  21. Exception message: A potentially dangerous Request.Path value was detected from the client (&). Request URL: http://www.domain.com/&&(b.position===

  22. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: class=true;RegExp._typeName=">http://www.domain.com/;Number._class=true;RegExp._typeName=

  23. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/);a.append(b.getTime());a.append(

  24. Exception message: The IControllerFactory 'Ninject.Web.Mvc.NinjectControllerFactory' did not return a controller for the name Request URL: http://www.domain.com/hcp/html/mTag.js


What are the attacks below trying to do?

They're trying to execute some code on your server by giving a bad URL and hoping you'd fall for it.

Since an exception was thrown did the attack fail?

Yes.

Are there any possible attacks that could have been thrown similar to these that may have went through.

Yes. If they were successful you probably wouldn't have gotten an exception.

Any links that lead to non-hacker friendly information so I can get up to speed on the evils of our world.

Read up on injection in general. As a rule, don't trust strings from the user to be syntactically valid - the canonical example is inserting an input string into a SQL query without checking the input, which can be "; DROP TABLE users; I'm not familiar enough with ASP.Net to answer exactly, but it seems like somewhere the URL is executed? That doesn't make sense, so listen to somebody else on that front.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜