I wanna know everything about security - ASP

Server Config
1

Hey guys,

Well i always come to thinking that my website is not secured enough. I’m going to list below what am i checking for and what i wanna do next, and tell me if i need to add/edit anything, any advice is appreciated.

Gallery upload page

  • Not invloving the database
  • checking width (must be less than 1024px)
  • checking height (must be less than 768px)
  • checking size (must be less than 500kb)
  • checking ext (must be .jpg, .bmp, .png, .gif)

If all those requirements meet, then the file gets uploaded, is there anything else i should check for?

Login page

  • involving the database
  • database is password protected
  • checking for illegal words (“select”, “drop”, “;”, “–”, “insert”, “delete”, “xp_”, “#”, “%”, “&”, “'”, “(”, “)”, “/”, “\”, “:”, “;”, “<”, “>”, “=”, “[”, “]”, “?”, “`”, “|”, “declare”, “convert”)

is that all?

My next pages i’m thinking to work on are “Contact us” and “give ur opinion” pages, they are both similar to the login page, a few text fields where ppl can write stuff and send it, what other things i should check for ? (besides of the checks i make above in the login page)

Thanks for ur help

2

When uploading images, you need to also check for file type. File extension is too easily faked. We see many infectious files that are really PHP code, but they have a .jpg extension.

You have to make the folder that files are uploaded to, un-executable from the Internet. A typical sceanario for hackers is to upload a file then try and execute it from a browser. If you only allow write permissions and use a .htaccess file to prevent any PHP, Perl or javascript code to run, you’ve eliminated that possibility.

For your database, you should hash the password so it’s not stored in plain text. This makes the “Forgot your Password” function more complex, but it’s worth it. Also use a “salt” in your hash.

For your contact us page, use captcha. There are many examples online for all of this. I’m just trying to point you in the right direction.

3

thanks for the tips WeWatch,

When uploading images, you need to also check for file type. File extension is too easily faked. We see many infectious files that are really PHP code, but they have a .jpg extension.

Well i tried to change a .txt file to .jpg for example and tried to upload and upload fails, thats becuase, like i mentioned above, i got also checks for width / height, which a txt file (that has been changed to jpg) dont have, tell me if i’m wrong here.

For your database, you should hash the password so it’s not stored in plain text. This makes the “Forgot your Password” function more complex, but it’s worth it. Also use a “salt” in your hash.

i was searching around alot on how to encrypt the password field of my database but without success, do u have any link to show how to do that on a access DB?

thanks

4

The hashing and salting would be done in your program code before it’s inserted into your database.

I would still check for php tags or perl before allowing the upload. That’s just me.

5

Hey,

The hashing and salting would be done in your program code before it’s inserted into your database.

Well can u show me any guide/link to read about that? in ASP would be preffered

I would still check for php tags or perl before allowing the upload. That’s just me.

And thats all i need to have my website secured?

6

hash is a function in, as far as I know, every server side scripting. So I presume it is in ASP a well. Just google for it

7

A wise man once said, “Security is a journey, not a destination.”

Your site has to be checked for RFI, LFI, SQL injection, etc. in order to be considered secure.

8

RFI, LFI, SQL injection, etc

Besides of the SQL injection part (which the only things i know about it are the illegalwords part like i posted above and the double ‘’ check) i don’t know any of them, anymore explanation would be helpful :slight_smile:

hash is a function in, as far as I know, every server side scripting. So I presume it is in ASP a well. Just google for it

Will this do?

it seems to do the job for input a i get something like :
86f7e437faa5a7fce15d1ddcb9eaeaea377667b8

but should i put that (on my login page) after the check for the illegal words or…?

9

You have client side (javascript) check for the basic illegal characters and input length, etc. then as the form is actually submitted, it gets sent to the server side where the password is hashed with salt then stored in the database.

So the: 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8 would be stored in the database. What the user enters is the unhashed password.

RFI: Remote file inclusion
LFI: Local file inclusion

10

that’s right :slight_smile:

11

Thanks for the confirmation, but mine was an answer not a question.:slight_smile:

12

Well i’m aint after reading lots of infos regarding those RFI and LFI (specially when most of the explantions are pointed to PHP)

What are those related to? the gallery page? if yes then ill probably just take mine gallery page off, after a while of thinking a gallery page wouldn’t add anything meaningful to my website :wink:

if it is related to the admin’s login page (which has 2 text fields for acc/pass) then i’m going to need more of details about it or perheps some link with better clues on how to get this security issue done.

ps. i’ve got that script with hash/salt added succesfullly to my login/register/pass change pages :slight_smile: