ASP.NET开发篇&DLL反编译&动态调试&EXE逆向&鉴权逻辑&脆弱验证

Ethan医生6天前代码审计20

#DLL反编译工具：

dnSpy = ILSpy => Reflector

https://github.com/dnSpy/dnSpy

https://github.com/icsharpcode/ILSpy

https://www.xitongzhijia.net/soft/44725.html

开发角度：未授权访问安全问题

1、找鉴权看引用-未引用鉴权逻辑

2、找鉴权看脆弱-脆弱的鉴权逻辑

3、找鉴权看逻辑-不严谨鉴权逻辑

未引用鉴权逻辑：MasterPageFile="/purchase/purchase.Master"

Default.aspx->purchase.Master->Purchase.Purchase.pur->UserHelper.GetUserId

脆弱的鉴权逻辑：userinfo=userid=1

Default.aspx->purchase.Master->Purchase.Purchase.pur->UserHelper.GetUserId->Request.Cookies["userinfo"]

不严谨鉴权逻辑：类似过滤器监听器功能

App_global.asax->App_Web_global.asax.cs.cdcab7d2->Ufida.T.Web.Http.Global.Application_PreRequestHandlerExecute->?preload=1

App_global.asax->App_Web_global.asax.cs.cdcab7d2->Ufida.T.Web.Http.Global.Application_PreRequestHandlerExecute->IsBaseRquest

#动态调试

同PHP,JAVA等相似，如何动态调试分析代码运行逻辑

参考：https://blog.csdn.net/qq_37213281/article/details/120058386

#程序逆向

案例：WEB应用授权逆向&EXE程序数据修改

.NET平台开发的应用均可以修改逻辑代码后保存达到逆向绕过等

标签: ASP.NET DLL

返回列表

ASPX文件->CS ASPX.CS DLL反编译后寻找看核心代码分析漏洞CS ASPX.CS DLL反编译文件->ASPX文件寻找确定漏洞进行调试测试代码审计时要把这个反编译文件提取...

#DLL反编译工具：dnSpy = ILSpy => Reflectorhttps://github.com/dnSpy/dnSpyhttps://github.com/icsharpcode/...

EthanDoctor