Asp.net 網站防攻擊安全設置

針對已解密的_ViewStat參數漏洞整改建議:在<system.web>下添加

<machineKey validation="3DES"/>

禁用腳本調試
<compilation debug="true">

跨站點請求僞造,若是要避免 CSRF 攻擊，每一個請求都應該包含惟一標識，它是攻擊者所沒法猜想的參數。 
protected override void OnInit(EventArgs e)
 {
      base.OnInit(e);
      if (System.Web.HttpContext.Current.Session != null)
     {
            ViewStateUserKey = Session.SessionID;
      }
  }

防止僞造用戶身份

public partial class AdminLogin : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if(!Page.IsPostBack)
            Session.Clear();
    }

}

防SQL注入

 public static bool FilterChar(string oldstr)
        {
            bool flag = true;
            string[] filterstr = {"and ","exec ","insert ","select ","delete ","update ","count(","from ","drop ","asc(","char(","or ","chr(","mid("," master",
            "truncate ","declare ","sitename","net user","xp_cmdshell "," /add","exec master.dbo.xp_cmdshell","net localgroup administrators",
            "%",";","/'","/"","-","@",",","//","!","(",")","[","]","{","}","|"};
            for (int i = 0; i < filterstr.Length; i++)
            {
                if (oldstr.Contains(filterstr[i]))
                {
                    flag = false;
                    break;
                }
            }
            return flag;
        }