【发布时间】：2020-08-20 22:42:02
【问题描述】：
为了应对臭名昭著的“xmlrpc.php”DOS 攻击，我为 404 和 500-100 类型的错误编写了自定义错误 ASP 页面，并且大部分工作正常。但是，我发现页面被执行了两次，原因不明。他们既发送电子邮件，也收集客户端的 IP，以自动添加到 Peerblock 自定义 IP 阻止列表文本文件。但是，由于双重执行，发送了两 (2) 封电子邮件，并将 IP 地址两次添加到 Peerblock 文本文件中。以下是 404 页面的代码 sn-p 列表：
' Grab the current URL and peform a number of tests (if we can--after the IIS server performs a redirection to a 404 handler, the URL is stripped of all parameters):
TheURL = Request.ServerVariables("SERVER_NAME") & Request.ServerVariables("SCRIPT_NAME")
If Request.ServerVariables("QUERY_STRING") <> "" Then
TheURL = TheURL & "?" & Request.ServerVariables("QUERY_STRING")
End If
strServer = Request.ServerVariables("SERVER_NAME")
strUrl = Request.QueryString
strPage = Mid(strUrl, InStr(strUrl, strServer) + Len(strServer) + 1)
ClientIPAddress = Request.ServerVariables("LOCAL_ADDR")
HTTPReferer = Request.ServerVariables("HTTP_REFERER")
If HTTPReferer = "" Then
If InStr(1, ClientIPAddress, "10.1.252.250", 0) > 0 Then
HTTPReferer = "www.edenusa.com"
WithinSite = True
Else
HTTPReferer = "UNKNOWN URL"
WithinSite = False
End If
End If
' Grab the IP address of the client coming into site (used later in email and HTML text):
RemoteIPAddress = Request.ServerVariables("REMOTE_ADDR")
' Don't notify via email when the URL is the following (happens too often):
HTTPRefererStatus = InStr(HTTPReferer, "edenusa.com/") OR InStr(HTTPReferer, "www.edenusa.com/") OR InStr(HTTPReferer, "edenusa.com/favicon.ico") OR InStr(HTTPReferer, "edenusa.com/favicon.gif") OR InStr(HTTPReferer, "edenusa.com/robots.txt") OR InStr(HTTPReferer, "xmlrpc.php")
TheURLStatus = InStr(TheURL, "xmlrpc.php")
If HTTPRefererStatus > 0 Or TheURLStatus > 0 Then
NoEmail = True ' Do not send an email in this case
If TheURLStatus > 0 Then ' Write the IP address to our own local Peer Block list:
' The format of the file is as follows: #[name]:[IpRangeStart]-[IpRangeEnd]
Dim objFS
Dim objFile
Dim IPBlockFileName: IPBlockFileName = "badiplist-edenusa.txt"
Set objFS = Server.CreateObject ("Scripting.FileSystemObject")
sIPBlockListPath = Server.Mappath ("/common/errorhandling/badiplists/" & IPBlockFileName)
Set objFile = objFS.OpenTextFile (sIPBlockListPath, 8)
' Write the IP address out to the IP Block List file:
objFile.WriteLine "#Test: " & RemoteIPAddress & "-" & RemoteIPAddress
objFile.Close
Set objFS = Nothing
Set objFile = Nothing
End If
End If
' Using Persits ASPEmail component, send an error report email to the support team.
sAlertBody = "At " & Now() & " a 404 error was encountered when a user attempted to visit the following link: " & HTTPReferer & vbCrLf
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The local IP address is: " & ClientIPAddress
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The remote IP address is: " & RemoteIPAddress
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The value of TheURL is: " & TheURL
sAlertBody = sAlertBody & vbCrLf & vbCrLf
'Send email for evaluation:
'Function IsSuccessfulEmail(sFromAddress, sSenderName, sRecipient, sReplyTo, sSubject, sBody, sCarbonCopyAddress, sFileAttachmentLocation)
If NoEmail = False Then
' Call the emailing function (contained in the /INCLUDEFILES/EMAILOPERATIONS/EMAILFUNCTIONS.ASP file):
' Call the AdministrativeAlertEmail() function:
AlertEmailResult = AdministrativeAlertEmail(sAlertRecipient, sAlertSubject, sAlertBody, sAlertHost)
If Debug_404ErrorPage = True Then
Response.Write("LINE-178: This is the value of the AlertEmailResult variable: ") & AlertEmailResult & "<br>"
Response.End
End If
Else ' Do not send an email, and reset the variable back to TRUE:
NoEmail = True
End If
【问题讨论】：
-
只是想知道
if NoEmail-statement 的逻辑。它检查它是否为假，然后将其设置为真。但那一点已经是真的，因为它没有通过声明。那你要去那里做什么？ -
你好丹尼尔。感谢您的评论。我自己也想知道。我相信最初的程序员正试图防止重复电子邮件的发生。我添加的部分是创建 IP 阻止列表文件供 Peerblock 使用。正如您在代码中看到的那样，这样做是为了阻止黑客多次尝试使用 XMLRPC DOC 攻击来攻击他们认为是 Wordpress 站点的内容。但是，抛开“NoEmail”代码的逻辑不谈，每次网站上出现 404 错误时，页面都会执行两次。这是最初发布的问题，任何自定义页面都会出现这种情况。
-
我一直在 Google 上搜索解决此问题的方法，并试图弄清楚如何与 Microsoft 联系以解决此问题，但找不到关于这两个主题的任何信息。
-
你可以尝试使用 fiddler 工具来检查请求是否被发送了两次。另一件事是尝试在 Visual Studio 中附加工作进程并调试您的代码。 stackoverflow.com/questions/9484235/…
-
@Lankymart-确实，自定义错误页面机制是罪魁祸首。我按照您的建议删除了 500-100 自定义页面，现在自定义 404 页面只执行一次。因此，现在的问题是如何正确修复 Server.GetLastError() 问题，这似乎是真正的问题（我遵循了我在网上找到的一篇关于“修复”此问题的文章的建议）。我将把它作为一个新问题发布。感谢大家的大力帮助。
标签： vbscript asp-classic iis-10