I've started learning ASP and I noticed you can't view the source code of those files for some reason(dynamic files or something). So I've made a simple user & password form out of 2 pages
login.html
- Code: Select all
<html>
<head></head>
<body>
<p>Login </p><br>
<form action="login.asp" method="get">
Username:<input type="text" name="name"/><br>
Password:<input type="password" name="pwd"/><br>
<input type="submit" value="Login"/>
</form>
</body>
</html>
login.asp
- Code: Select all
<body>
<%
if Request.QueryString("name") = "admin" and Request.QueryString("pwd") = "asdf" then
response.write("..........Welcome admin....<br>.........Secret info here lol")
else
response.write("<h1>Login error!<h1>")
end if
%>
</body>
It's a simple form if you enter user: admin , password: asdf
you'll get access to the admin info if not.. well error
Now here's the question: can a person from the outside somehow manage to hack in without knowing the actual password?
this form uses VBScript, is it vulnerable to injections?
Thanks in advance
