Regarding the exploitation of Oracle padding, Microsoft posted the following recommended error page:
& Lt;% @ Page language = "C #" AutoEventWireUp = "True"%> & Lt;% @ Import Namespace = "System Security.Cryptography"% & gt; & Lt;% @ Import Namespace = "System Threading"% & gt; & Lt; Script runat = "server" & gt; Zero Page_load () {byte [] delay = new byte [1]; RandomNumberGenerator prng = new RNGCryptoServiceProvider (); Prng.GetBytes (late); Thread.Sleep ((int) delay [0]); IDisposable Disposable = IDisposable as Pricing; If (disposable! = Null) {disposals: show (;); }} & Lt; / Script & gt; & Lt ;; DOCTYPE HTML PUBLIC "- // W3C // DTT XHTML 1.0 Transcription // N" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> & Lt; Html xmlns = "http://www.w3.org/1999/xhtml" & gt; & Lt; Head runat = "server" & gt; & Lt; Title & gt; & Lt; / Title & gt; & Lt; / Head & gt; & Lt; Body & gt; & Lt; Div & gt; An error occurred while processing your request. & Lt; / Div & gt; & Lt; / Body & gt; & Lt; / Html & gt; Thread for some value between 0-255
What's with sleeping? I do not want my server threads tied up to a quarter of each.
The reason is that returning to change the time of the result takes a variable amount of time, you To determine the cause of the failure, error can not be used at the time of return, which is the approach used for attack
Comments
Post a Comment