如何安全检测Java Web应用网站漏洞（How to safely detect vulnerabilities in Java Web application sites）.docVIP

如何安全检测Java Web应用网站漏洞（How to safely detect vulnerabilities in Java Web application sites） This article discusses only bugs on the web program, and other vulnerabilities that are relatively independent. This statement seems nonsense, but in fact shows the often overlooked factors, namely: many people think that as long as I develop web program without loopholes, the web server is safe, in fact, is not the case. A qualified web program developer should always be aware of the circumstances in which the program he developed will be used, and what consequences it will eventually cause if a program has some kind of vulnerability. Simply speaking, the web program is installed in one or more (distributed) web server, once the installation is successful, is to provide service for the vast number of users at the same time, to the intruder opened an idea or a new N. If the server administrator is not aware of the security configuration (in fact, the majority of administrators in the country), then we have to keep our program to the last hurdle, the last line of defense. Read the title of this article, there must be some people will think, is not to speak of JSP loophole , need to be wrapped in such a thick package? To answer this question, lets look at the difference between the development of JSP and ASP. In the era of ASP (ASP, PHP and other languages), pain system to develop a system more often than modify others have already written more, because they put all of the code (including links to the database code, execute the SQL statement, control code page display code) all in %...% , we often... You will see the following code block: - code from a ASP SHELL Function GetFileSize (size) Dim FileSize FileSize=size / 1024 FileSize=FormatNumber (FileSize, 2) If FileSize 1024 and FileSize 1 then GetFileSize= font color=red FileSize /fontnbsp, KB ElseIf FileSize 1024 then GetFileSize= font color=red FormatNumber (FileSize / 1024,2) /fontnbsp; MB Else GetFileSize= font color=re