Asp with hidden paths to achieve defense Daolian

23 May 2007

If we know that a static document the actual path as : http : //www.chinahtml.com/download/mybook.pdf, if the server did not make any special restrictions set up, we can not painless download it! When mybook.pdf download website, how can we allow access to those who download the actual path? This paper on how to use Asp documents to conceal the actual download path.

We in the management of a web document, can be extended from the same paper on the same directory, compared with a particular name, such as Fang pdf file directory the_pdf_file_s. Save the following code put to down.asp, his path to http://www.chinahtml.com/down.asp online, we can use http://www. chinahtml . com/down.asp?FileName=mybook.pdf to download the file , but those who download the file can not see the actual download path! In down.asp, we can also set up the need to download landing Download the source to judge whether the pages for external website, which can be done to prevent the documents Daolian.

Example code :

<%
From_url = Cstr (Request.ServerVariables ( “H TTP_REFERER “))
Serv_url = Cstr (Request.ServerVariables ( “S ERVER_NAME “))
If mid (From_url,8. len (Serv_url)) then Serv_url “”
Response.write “illegal link! ” ‘Prevent Daolian
Response.end
End if

If Request.Cookies ( “Logined”) = “” then
Response.redirect “/login.asp” ‘needs landing!
End if
Function GetFileName (longname) ‘/folder1/f older2/file.asp=>file.asp
While instr (longname, “/”)
Longname = right (longname, len (longname) -1)
Wend
GetFileName = longname
End Function
Dim Stream
Dim Contents
Dim’”>
Dim TrueFileName
Dim FileExt
Const adTypeBinary = 1
‘”> = Request.QueryString ( “‘”>”)
If’”> = “” Then
Response.Write “invalid document name! ”
Response.End
End if
FileExt = Mid (’”>, InStrRev (’”>. . ” “) + 1)
Select Case UCase (FileExt)
Case “ASP”, “ASA”, “ASPX”, “ASAX”, “MDB”
Response.Write “illegal operation! ”
Response.End
End select
Response.Clear
If lcase (right (’”>. 3)) = “gif” or lcase (right (’”>. 3)) = “jpg” or lcase (right (’”>. 3)) = “png” then
Response.ContentType = “image/*” ‘right image files not emerge under contains dialog
Else
Response.ContentType = “application/ms-dow nload ”
End if
Response.AddHeader “content” “attachment; filename = “& GetFileName (Request.QueryStri Vi ( “‘”>”))
Set Stream = server.createObject ( “ADODB.Str eam “)
Stream.Type = adTypeBinary
Stream.Open
If lcase (right (’”>. 3)) = “pdf” then ’set pdf file types Contents
TrueFileName = “/the_pdf_file_s/” &FileName
End if
If lcase (right (’”>. 3)) = “doc” then ‘type set DOC directory
TrueFileName = “/my_D_O_C_file/” &FileName
End if
If lcase (right (’”>. 3)) = “gif” or lcase (right (’”>. 3)) = “jpg” or lcase (right (’”>. 3)) = “png” then
TrueFileName = “/all_images_/” &FileName ’set Image File Contents
End if
Stream.LoadFromFile Server.MapPath (TrueFi leName)
While Not Stream.EOS
Response.BinaryWrite Stream.Read (1024 * 64)
Wend
Stream.Close
Set Stream = Nothing
Response.Flush
Response.End
%>

web Admin first Step

Asp with hidden paths to achieve defense Daolian

Comment Form

About this blog

Photostream

Categories

Archives