Vulnerability in Microsoft IIS Serving Classic ASP Pages
------------------------------------------------------------------------------------------

The Internet Storm Center has reported a vulnerability in Microsoft Internet Information Services (IIS)
6.0 and earlier. The vulnerability exists due to the way IIS processes filenames containing non-alphanumeric characters; specifically a semi-colon. Due to thisvulnerability, a file that is uploaded to an IIS 6.0 or earlier web serve as‘bad.asp;.jpg’ will be stored as‘bad.asp’. Depending upon the storage location of the file, it could potentially allow for execution by IIS. This vulnerability only affects classic ASP, not ASP.NET.Additionally, a web-based application that allows file uploads must exist for this vulnerability to be exploited.At this time,no patch is available from Microsoft.


Recommendation:
1.Never allow execute permissions in the directory where uploads are stored.
2.Disallow unusual characters,such as a semi-colon or colon, in filenames.
3.Ensure web applications run with less than SYSTEM privileges.
4.Require authentication for uploads.

References 

Internet Storm Center:

http://isc.sans.org/diary.html?storyid=7810

Soroush:

http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf

ASP Encode Decode Functions

ASP Encode/Decode Functions
-------------------------------------------------------------------------------------------------------

Server.URLEncode

Used for encoding data that will be passed via a querystring variable. A querystring variable is anything following the question mark (?) in the URL (location) field of your browser. You create querystring variables when you perform a redirect or build a hyperlink to another page on your site.

<a href="page2.asp?name=Joe+Schmoe">here</a>
<%
Response.Redirect "page2.asp?ID=3"
%>
In the example above, the hyperlink contains a variable named "name" which has a value of "Joe Schmoe" (the space is encoded as "+") In the Response.Redirect statement, we have a querystring variabled named "ID" with a value of 3. To perform a URL encode on a variable (for purposes of passing this variable to another page) use the following:

<a href="page2.asp?name=<%= Server.URLEncode(sName) %>">
here</a>
<%
Response.Redirect "page2.asp?ID=" &_
    Server.URLEncode(nID)
%>

URLDecode

For some reason, Microsoft did not include a URL decode function with Active Server Pages. Most likely, this was because the decoding of querystring variables is done automatically for you when you access the querystring object:

<%= Request.QueryString("name") %>

For those of you who are desperately in need of this function:

' -----------------------------------------
' URL decode to retrieve the original value

Function URLDecode(sConvert)
    Dim aSplit
    Dim sOutput
    Dim I
    If IsNull(sConvert) Then
       URLDecode = ""
       Exit Function
    End If

    ' convert all pluses to spaces
    sOutput = REPLACE(sConvert, "+", " ")

    ' next convert %hexdigits to the character
    aSplit = Split(sOutput, "%")

    If IsArray(aSplit) Then
      sOutput = aSplit(0)
      For I = 0 to UBound(aSplit) - 1
        sOutput = sOutput & _
          Chr("&H" & Left(aSplit(i + 1), 2)) &_
          Right(aSplit(i + 1), Len(aSplit(i + 1)) - 2)
      Next
    End If

    URLDecode = sOutput
End Function

Server.HTMLEncode

This useful built-in function is very useful for encoding text that should be displayed in a form input. By "form input" we mean a web form control such as a text input, select or textarea control.

You may have noticed that certain characters cause the HTML on your web form to be interpretted incorrectly. Specifically, the HTML tag characters "<" and ">" can have this effect as well as the quote character (") which is used to encapsulate values.

<input type="text" value="<%= Server.HTMLEncode(sValue) %>">

<textarea name="sample" width=38 height=10>
<%= Server.HTMLEncode(sValue) %>
</textarea>
This simple value shows you how easy it is to safely include any value within a web form control.

HTMLDecode

Just like with the URLDecode function described previously, Microsoft, in its infinite wisdom decided not to include an HTMLDecode function with their Server component. It is a relatively simple matter to decode this test data (although I haven't had a need to do this so far.) For completeness sake, here is an HTMLDecode function you may use:

Function HTMLDecode(sText)
    Dim I
    sText = Replace(sText, "&quot;", Chr(34))
    sText = Replace(sText, "&lt;"  , Chr(60))
    sText = Replace(sText, "&gt;"  , Chr(62))
    sText = Replace(sText, "&amp;" , Chr(38))
    sText = Replace(sText, "&nbsp;", Chr(32))
    For I = 1 to 255
        sText = Replace(sText, "&#" & I & ";", Chr(I))
    Next
    HTMLDecode = sText
End Function

Remove Leading and Trailing Spaces in SQL Server

Remove Leading and Trailing Spaces in SQL Server

-----------------------------------------------------------------


         



SQL Server has two built-in string trimming functions, LTRIM and RTRIM, these remove leading and trailing spaces
 respectively. There is no built-in function to remove arbitrary leading
 and/or trailing whitespace, including TABs, CR and/or LFs.

The built-in functions return the datatype of their input, whereas 
the UDFs below return explicit datatypes. I've put together a few 
variations of my trim whitespace function, one for non-unicode text, and
 a basic and advanced one for unicode text. For the sake of performance 
and convenience I've treated all control characters (0 - 31) as 
whitespace.

Note that from a performance point of view these UDFs will be 
considerably slower than the built-in functions so don't use them inside
 a large loop or when returning a large rowset unless you're sure you'll
 have non-space whitespace.

These functions are suitable for SQL Server 2005 and 2008 as well as 
SQL Server 2000 (just remove the RETURNS NULL ON NULL INPUT function 
option and convert the (max) types to a suitable fixed length type).





--------------------------------------------------------------------

create function dbo.udf_NTrimWhitespace(@text nvarchar(max)) returns nvarchar(max) with returns null on null input
/*
** Return the input with leading and trailing whitespace removed.
*/
as
begin

   declare @i int; set @i = 1;
   declare @j int; set @j = len(@text); -- remember that len doesn't include trailing spaces.
   declare @u int;

   while (@i < @j)
   begin
      set @u = unicode(substring(@text, @i, 1));
      if (@u > 0x0020 and @u not in ( 0x0085, -- NEL (control character next line)
                                      0x00A0, -- NBSP (NO-BREAK SPACE)
                                      0x1680, -- OGHAM SPACE MARK
                                      0x180E, -- MONGOLIAN VOWEL SEPARATOR
                                      0x2000, -- EN QUAD
                                      0x2001, -- EM QUAD
                                      0x2002, -- EN SPACE
                                      0x2003, -- EM SPACE
                                      0x2004, -- THREE-PER-EM SPACE
                                      0x2005, -- FOUR-PER-EM SPACE
                                      0x2006, -- SIX-PER-EM SPACE
                                      0x2007, -- FIGURE SPACE
                                      0x2008, -- PUNCTUATION SPACE
                                      0x2009, -- THIN SPACE
                                      0x200A, -- HAIR SPACE
                                      0x200B, -- ZERO WIDTH SPACE
                                      0x2028, -- LS (LINE SEPARATOR)
                                      0x2029, -- PS (PARAGRAPH SEPARATOR)
                                      0x202F, -- NNBSP (NARROW NO-BREAK SPACE)
                                      0x205F, -- MMSP (MEDIUM MATHEMATICAL SPACE)
                                      0x3000, -- IDEOGRAPHIC SPACE
                                      0xFEFF  -- ZERO WIDTH NO-BREAK SPACE
                                    )
         )
         break;
      set @i = @i + 1;
   end

   while (@j >= @i)
   begin
      set @u = unicode(substring(@text, @j, 1));
      if (@u > 0x0020 and @u not in (0x0085,0x00A0,0x1680,0x180E,0x2000,0x2001,0x2002,0x2003,0x2004,0x2005,0x2006,0x2007,0x2008,0x2009,0x200A,0x200B,0x2028,0x2029,0x202F,0x205F,0x3000,0xFEFF))
         break;
      set @j = @j - 1;
   end

   return substring(@text, @i, @j - @i + 1);

end
go

-------------------------------------------------------------------

create function dbo.udf_NTrimWhitespace(@text nvarchar(max)) returns nvarchar(max) with returns null on null input 
as
/*
** Return the input with leading and trailing whitespace removed.
*/
begin

   declare @i int; set @i = 1
   declare @j int; set @j = len(@text) -- remember that len doesn't include trailing spaces.

   while (unicode(substring(@text, @i, 1)) < 33 and @i < @j) set @i = @i + 1
   while (unicode(substring(@text, @j, 1)) < 33 and @j >= @i) set @j = @j - 1

   return substring(@text, @i, @j - @i + 1)

end
go

------------------------------------------------------------------

create function dbo.udf_TrimWhitespace(@text varchar(max)) returns varchar(max) with returns null on null input 
as
/*
** Return the input with leading and trailing whitespace removed.
*/
begin

   declare @i int; set @i = 1
   declare @j int; set @j = len(@text)

   while (ascii(substring(@text, @i, 1)) < 33 and @i < @j) set @i = @i + 1
   while (ascii(substring(@text, @j, 1)) < 33 and @j >= @i) set @j = @j - 1

   return substring(@text, @i, @j - @i + 1)

end
go

--------------------------------------------------------------------

Source:http://www.rmjcs.com/SQLServer/TSQLFunctions/TrimWhitespace/tabid/829/Default.aspx

Email Sending in asp using Cdosys component in windows 2008 Server and IIS7

Email Sending in asp using Cdosys component in windows 2008 Server and IIS7
-------------------------------------------------------------------------------------------------------------------------

Generally Every developer uses the following code

dim oMail, oMailConfig
Set oMail = Server.CreateObject("CDO.Message")
Set oMailConfig = Server.CreateObject ("CDO.Configuration")
oMailConfig.Fields("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "localhost"
oMailConfig.Fields("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
oMailConfig.Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
oMailConfig.Fields("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = 60
oMailConfig.Fields.Update
Set oMail.Configuration = oMailConfig
oMail.From = "youremailid"
oMail.To = "toemailid"
oMail.Subject = "testing subject"
oMail.HTMLBody = "testing html body"
oMail.Send
set oMail=nothing

What is SMTP Server name
1) localhost
2) computername
3) smtp.servername.com

What is SMTP Server Port
1) 25

What is send using
1) 1=email sending using pickup directory
2) 2=email sending over the network

What is SMTP Use SSL
1)smtpusessl=true
2)smtpusessl=false

What is SMTP Authentication
1)If no value is set for this field, anonymous (no authentication) is assumed.
2) Authentication=1 (Then Authentication is required)

Kill remote desktop connections

Kill Remote Desktop connections (or) View Active Remote Desktop Connections with Controlpanel

----------------------------------------------------------------------------------------------------------------------

Start -> Programs -> Adminstrative Tools -> Terminal Services Manager

Right-click on the session and select logoff or reset.
----------------------------------------------------------------------------------------------------------------------

images and file upload in asp free

Upload images and Files in ASP Free

----------------------------------------------------------------------------------------------------------------------

Please click the below link

http://www.freeaspupload.net/freeaspupload/download.asp

http://www.freeaspupload.net/ 

http://www.codeproject.com/Articles/93181/Classic-ASP-Multi-upload-Image-Gallery

http://www.motobit.com/help/scptutl/pure-asp-upload.htm

http://aspuploader.com/demo.html

Image Resizing

http://www.imageresizing.quickersite.com/
http://www.motobit.com/util/upload/upload-resize.ASP
http://forums.aspfree.com/code-bank-54/shadowresizer-image-resize-fly-classic-asp-99191.html
http://www.dmxzone.com/go/483/dynamically-resize-an-image/
http://www.sitepoint.com/forums/showthread.php?746814-image-resize
http://www.aspjpeg.com/

Browser detection in asp

Browser detection in asp

----------------------------------------------------------------------------------------------------------------------

<%=response.write(request.servervariables("HTTP_USER_AGENT"))%>

(or) use try the following code
<%
Set browserdetect = Server.CreateObject("MSWC.BrowserType")
' find some properties of the browser being used to view this page
browser=browserdetect.Browser
version=browserdetect.Version
majorver=browserdetect.Majorver
minorver=browserdetect.Minorver
platform=browserdetect.Platform
frames=browserdetect.Frames
tables=browserdetect.Tables
cookies=browserdetect.Cookies
javascript=browserdetect.JavaScript
' send some output to the web browser
response.write ("Browser: " & browser & "<BR>")
response.write ("Version: " & version & "<BR>")
response.write ("Majorver: " & majorver & "<BR>")
response.write ("Minorver: " & minorver & "<BR>")
response.write ("Platform: " & platform & "<BR>")
response.write ("Supports frames: " & frames & "<BR>")
response.write ("Supports tables: " & tables & "<BR>")
response.write ("Supports cookies: " & cookies & "<BR>")
response.write ("Supports JavaScript: " & javascript & "<BR>")
%>