All geek questions in one place

Potentially dangerous form value (Asp.net attack using a crash page)

I have a health monitor on my ASP.NET site, I saw several attacks on my site using

http://SiteName/Page.aspx/Comment.asp?Id=76 (each request the ID is changing)

The Comment.asp page is not part of my site, it is used by an attacker, not sure what he is doing. If I open my site by adding comment.asp comment (http://sitename/page.aspx/comment.asp?id=1) , then this is my aspx page, which is strange to me. on my page.aspx pageload event I'm trying to catch request.URL where comment.asp does not appear in this case.

Request exception information:

Should I worry about attacks like this, how can I prevent them. I have already given IP restrictions, but every time a request comes from different IP addresses. However, I did not see any consequences of this attack on my site. according to IP, all bad requests come from China (according to IP search).

 at ASP.xxxxxxxx_aspx.ProcessRequest(HttpContext context)

which line is higher in the stack trace? thats my aspx page, an asp.net engine process like this? did not see it. Every day I get this attack with a notification about the detection of a dangerous form through the healthmonitor.

+4
source share
1 answer

First of all, does Page.aspx / Comment.asp matter? Id = 76 for your application? If not, it’s possible the requests you see come from a botnet that is trying to find explicit exploit or insecure content in the wild. This happens from time to time at your URL and you will find an entry in your journal as shown. I had such things on my website daily

+2
source

Source: https://habr.com/ru/post/1492193/

More articles:


All Articles