: IIS7

1
??????????? IIS7

• ? ????? ?????? ????????????

2
?????????

• ????? IIS7
• ????????????? ????? IIS7
• ????? ????? ????????????
• IIS7 ???????
• ???????? ??????
• ????
• ???????? ? ??????????? ?????? ??????

3

• ????? IIS7

4
????????????? ????? IIS7

• ????????? ???????????
• ????? ?????????????? ????????????
• ????? ??????? ?????????????????
• ?????????? ??????? ???????????
• ?????????? ??????? ?????????? HTTP-????????
• ???????? ?? ???????????? ????????? ?????????
  ????????????? ? ???????? ????????

5

• ????? ????? ????????????

6
????????? ???????????

• ??????????????? 30 ????????? ???????
• ????????? ?????? ?? ??????
• ??????????? ????????? ? ??????????? ?????? ??????
• ?????? ????? ???? ???????? ??? ?? C ??? ? ?? C
• ?????? ?????????? ? ASP.NET

7
????? ?????????????? ????????????

• ?? ???????? ? config-??????
• applicationHost.config ??????? (??????????
  ???????????????? ????)
• web.config ????? ?????????? ? ????? ??????????
  web-????????
• web.config ????? ??????????/??????????????
  ?????????, ????????? ??????? ????????? ? ???????
  ???????????????? ?????
• ???????? ??????? ???-?????????? ? ????? ?????? ??
  ??????

8
????? ??????? ?????????????????

• ???????-?? ????? ???????????????? ?????????
• ?????????????? ?????????????????
  ???-???????????? ? ????????? ???-???????? ?????
  ???? ???????? ???????????????? ?????????
• ????? ???????? ????????????????? ? ?????????
  ??????

9
?????????? ??????? ???????????

• IIS7 ????? ?????????? ??????? ??????????? ?
  ???????????, ??? ??????????? ???????? ???????
  ?????????? ? ??????? ????? ????????
• ???????? ??????????? ?????? ??? ????????
  ??????????? ?????????? ?? ???????

10
??????? ?????????? HTTP-????????

• URLScan ???? ?????? IIS7 (requestFiltering)
• requestFiltering ??????? ?? ?????????
• ????? ?????? ??? ?????? ????????? ??????????
  ASP.NET

11
????????????? ? ???????? ????????

• ???????? ISAPI ? ASP-??????????
• ????????? ??????? ???????????????? ????????
• aboComp.dll ??????????? ????? ????????????????
  ????????? ? ?????? ? ????????

12

• IIS7 ??????? ???????? ??????

13
???????????? ??????

• ????? applicationHost.config
• ltsystem.webServergt/ltglobalModulesgt
• ltsystem.webServergt/ltmodulesgt
• ltsystem.webServergt/lthandlersgt

14
???????????? ??????

• ?????? "globalModules" ???????? ?????? ???????
  ??????????? ? ?????? w3wp.exe.
• ??? ?????? ???? ??????
• ltglobalModulesgt
• ltadd name"DefaultDocumentModule"
  image"...\inetsrv\defdoc.dll" /gt
• ltadd name"DirectoryListingModule"
  image"...\inetsrv\dirlist.dll" /gt
• ltadd name"HttpRedirectionModule"
  image"...\inetsrv\redirect.dll" /gt
• ltadd name"StaticFileModule"
  image"...\inetsrv\static.dll" /gt
• ltadd name"AnonymousAuthenticationModu
  le" image\authanon.dll" /gt
• ltadd name"IpRestrictionModule"
  image\inetsrv\iprestr.dll" /gt
• ltadd name"RequestFilteringModule"
  image\inetsrv\modrqflt.dll" /gt
• lt/globalModulesgt

15
???????????? ??????

• ??????????? ??????????? ?????????? ?????
  ????????? ??????? ?????? ?? globalModules ?????
  ??????? ???????????? ? ??? ??????????. ??? ?????
  ?????? ?????? "modules". ????????
• ltmodulesgt
• ltadd name"StaticFileModule" /gt
• ltadd name"AnonymousAuthenticationModule" /gt
• ltadd name"IpRestrictionModule" /gt
• ltadd name"RequestFilteringModule" /gt
• lt/modulesgt

16
?????? "handlers" (???????????)

• ??????????? ??? ???? ??????, ?? ??? ??????????
  ?????? ??? ???????????? URL. ??????
• lthandlers accessPolicy"Script, Read"gt
• ltadd name"ASPClassic" path".asp"
  verb"GET,HEAD,POST" modules"IsapiModule"
  scriptProcessor"...\asp.dll" resourceType"File"
  /gt
• ltadd name"ISAPI-dll" path".dll" verb""
  modules"IsapiModule" resourceType"File"
  requireAccess"Execute" allowPathInfo"true" /gt
• ltadd name"StaticFile" path"" verb""
  modules"StaticFileModule,DefaultDocumentModule"
  resourceType"Either" requireAccess"Read" /gt
• lt/handlersgt

17

• ?????? ?????? ?????? ??????????????
  RegisterModule ???????
• RegisterModule ?????????? ????? IIS ? ??????
  ????????? ??? ??????
• ??????? "???????" ??????? ??????? ????????????
  ????? ???????????? IIS ??? ???????? ????????
  ?????? (????? ?????? ?????? ???? ????????
  CHttpModule)
• ??????????? ?? ??????? ???????????? ?? ?????
  ??????????? ????????

18
???????? ???? ??????? ? ?????????

• request is beginning
  RQ_BEGIN_REQUEST
• request is being authenticated
  RQ_AUTHENTICATE_REQUEST
• request is being authorized
  RQ_AUTHORIZE_REQUEST
• satisfy request from cache
  RQ_RESOLVE_REQUEST_CACHE
• map handler for request
  RQ_MAP_REQUEST_HANDLER
• acquire request state
  RQ_ACQUIRE_REQUEST_STATE
• pre-execute handler
  RQ_PRE_EXECUTE_REQUEST_HANDLER
• execute handler
  RQ_EXECUTE_REQUEST_HANDLER
• release request state
  RQ_RELEASE_REQUEST_STATE

19

• ???? ?????? ???????? ?? ???????, ?? ??????
  ?????????? ?????????????? ??????-??????????,
  ??????? ????? ????????? ?????????
• REQUEST_NOTIFICATION_STATUSOnEvent(IN
  IHttpContext pHttpContext,IN OUT
  IHttpEventProvider pProvider)
• ???????? ?????????? ??????? RQ_BEGIN_REQUEST
  ??????? ???
• REQUEST_NOTIFICATION_STATUS
• CMyHttpModuleOnBeginRequest(
• IN IHttpContext
  pHttpContext,
• IN IHttpEventProvider
  pProvider
• )

20

• ???????????? ???????????? ???????? ?????? ????
  ???? ?? ???? ????????
• RQ_NOTIFICATION_CONTINUE RQ_NOTIFICATION_PENDI
  NG RQ_NOTIFICATION_FINISH_REQUEST

21

• ???????? ? ??????????? ?????? ??????

22

• ?? ???????? ??????, ??????? ????? ????????????
  ???????? ?? QueryString ? ???? ??? ?????????????
  ???????????? ?????????, ?? ????? ?????????
  ????????? ??????? ? ?????????? ?????? 404
• ? ???????? ????????? ?? ????? ????????????
  Regular Expressions
• ???? ?????? ????? ???? ??????????? ??? ?????? ??
  SQL-injection ????

23

• ??? ???????? ?????? ??????????
• ?????????? Visual Studio ? C
• ?????????? ? ???????????????? Platform SDK
  ?????????? ??????????? ???????????? ?????
• ???????? ???????????? ?????
• httpserv.h ? nativerd.h

24

• ???????????? ????????? ??????

25

• ????????? ??????
• ???????? ?????? ? ltglobalModulesgt ? ltmodulesgt
  ?????? applicationHost.config
• ????? ??????? ??? ?????? ????????? ???????
• appcmd.exe install module /nameDemoModule
  /imageD\Demo\DemoModule.dll

26

• ? ?????????? ??? ?????? applicationHost.config
  ????? ????????? ????????? ???????
• ltglobalModulesgt
• ...
• ltadd name"DemoModule"
  image"...\DemoModule.dll" /gt
• lt/globalModulesgt
• ltmodulesgt
• ...
• ltadd name"DemoModule" /gt
• lt/modulesgt

27

• ? ?????????? windir\system32\inetsrv\config\sche
  ma ??????? ???? Demo_schema.xml, ??????????
• ltconfigSchemagt
• ltsectionSchema name"WebDevConDemo"gt
• ltattribute name"enabled" type"bool"
  defaultValue"false" /gt
• ltcollection addElement"add"
• clearElement"clear"
  removeElement"remove" gt
• ltattribute nameexpression"
  type"string" required"true"
• isUniqueKey"true"
  validationType"nonEmptyString" /gt
• lt/collectiongt
• lt/sectionSchemagt
• lt/configSchemagt

28

• ltsection name"WebDevConDemo" type"section" /gt
• ltWebDevConDemo enabled"true"
• ltadd expression"20or\0.\1\0--" /gt
• ltadd expression"20or\0select\0" /gt
• ltadd expression"20or\0drop\0" /gt
• lt/WebDevConDemogt

29

• ??????
• ????? IIS ?????? http//www.iis.net
• IIS7 http//www.iis.net/default.aspx?tabid7
• IIS7 SDK
• http//msdn.microsoft.com/library/default.asp?url
  /library/en-us/IIS_70_WebExtSDK/html/6c07a4d0-1bf0
  -45d3-8178-25df76e6740c.asp