0

最近我们将系统从 .net 1.1 升级到了 .net 2.0。自从这样做以来，我们的事件日志中大约每分钟都会出现以下错误。这很奇怪，但所有客户端 ip 或用户主机地址似乎都指向东欧国家，如俄罗斯或白俄罗斯。是日志记录问题还是有人合法地试图破解或其他什么？-

Information 8/2/2011 15:02  ASP.NET 2.0.50727.0 1316    Web Event   Event code: 4009 
Event message: Viewstate verification failed. Reason: Viewstate was invalid.                    
Event time: 8/2/2011 3:02:36 PM                     
Event time (UTC): 8/2/2011 7:02:36 PM                   
Event ID: e25e0918f9e34bda98abcafadc61a0b6                  
Event sequence: 144401                  
Event occurrence: 5595                  
Event detail code: 50204                    

Application information:                    
    Application domain: OMMITED-OMMITED             
    Trust level: Full                   
    Application Virtual Path: /DirID                    
    Application Path: W:\SITE\DirID\                    
    Machine name: OMMITED-OMMITED                       

Process information: 
    Process ID: 1740 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\SYSTEM 

Request information: 
    Request URL: http://www.mysite.com/DirID/Default.aspx 
    Request path: /DirID/Default.aspx 
    User host address: 176.14.136.181 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: NT AUTHORITY\SYSTEM 

ViewStateException information: 
    Exception message: Invalid viewstate.                   
    Client IP: 176.14.136.181                   
    Port: 63815                     
    User-Agent: TrackChecker                    
    PersistedState: [KEY1]                  
    Referer: http://www.mysite.com/DirID/Default.aspx                   
    Path: /DirID/Default.aspx                   
-------------------------
Information 8/2/2011 14:57  ASP.NET 2.0.50727.0 1316    Web Event   Event code: 4009 
Event message: Viewstate verification failed. Reason: Viewstate was invalid.                    
Event time: 8/2/2011 2:57:11 PM                     
Event time (UTC): 8/2/2011 6:57:11 PM                   
Event ID: 4d814be560f64258b2c926814fdb10c6                  
Event sequence: 142726                  
Event occurrence: 5536                  
Event detail code: 50204                    

Application information:                    
    Application domain: OMMITED-OMMITED                     
    Trust level: Full                   
    Application Virtual Path: /DirID                    
    Application Path: W:\SITE\DirID\                    
    Machine name: OMMITED-OMMITED    

Process information: 
    Process ID: 1740 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\SYSTEM 

Request information: 
    Request URL: http://www.mysite.com/DirID/Default.aspx 
    Request path: /DirID/Default.aspx 
    User host address: 213.87.131.86 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: NT AUTHORITY\SYSTEM 

ViewStateException information:                     
    Exception message: Invalid viewstate.                   
    Client IP: 213.87.131.86                    
    Port: 21441                     
    User-Agent:                     
    PersistedState: [KEY1]                  
    Referer: http://www.mysite.com/DirID/Default.aspx                   
    Path: /DirID/Default.aspx                   
-----------
Information 8/2/2011 14:56  ASP.NET 2.0.50727.0 1316    Web Event   Event code: 4009 
Event message: Viewstate verification failed. Reason: The viewstate supplied failed integrity check.                    
Event time: 8/2/2011 2:56:10 PM                     
Event time (UTC): 8/2/2011 6:56:10 PM                   
Event ID: e20e446446374000bf9ad9c6863192e8 
Event sequence: 142476 
Event occurrence: 5534 
Event detail code: 50203 

Application information: 
    Application domain: OMMITED-OMMITED 
    Trust level: Full 
    Application Virtual Path: /DirID 
    Application Path: W:\SITE\DirID\ 
    Machine name: OMMITED-OMMITED   

Process information: 
    Process ID: 1740 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\SYSTEM 

Request information: 
    Request URL: http://www.mysite.com/DirID/Default.aspx 
    Request path: /DirID/Default.aspx 
    User host address: 85.174.246.134 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: NT AUTHORITY\SYSTEM 

ViewStateException information: 
    Exception message: Invalid viewstate. 
    Client IP: 85.174.246.134 
    Port: 3957 
    User-Agent: TrackChecker 
    PersistedState: dDwxNTA2NDg4MjAzO3Q8O2w8aTwzPjs+O2w8dDw7bDxpPDE+O2k8OT47aTwxMT47aTwxMz47aTwxNT47aTwxNz47aTwxOT47aTwyMT47aTwyMz47aTwyND47aTwyNT47aTwyNj47aTwzMj47aTwzND47PjtsPHQ8O2w8aTwzPjtpPDE5PjtpPDQxPjs+O2w8dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPHA8bDxOYXZpZ2F0ZVVybDtGb250X0JvbGQ7XyFTQjs+O2w8XGU7bzx0PjtpPDIwNDg+Oz4+Oz47Oz47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47Pj47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PHA8O3A8bDxvbmNsaWNrOz47bDxTaG93SGlkZVNlY3Rpb24oJ1VQU01JX1Byb2Nlc3NfTG9uZycpXDs7Pj4+Ozs+O3Q8cDw7cDxsPG9uY2xpY2s7PjtsPFNob3dIaWRlU2VjdGlvbignVVBTTUlfUHJvY2Vzc19Mb25nJylcOzs+Pj47Oz47Pj47Pj47bDxidG5UcmFjazs+PgqCqg5dK4H3lAraES3/cf/YlkUD 
    Referer: http://www.mysite.com/DirID/Default.aspx                   
    Path: /DirID/Default.aspx
4

2 回答 2

2

由于以下原因，前 2 个请求导致了视图状态验证/验证问题： PersistedState: [KEY1] - 这是一个验证错误。

另外 - 你说你已经从 .Net 1.1 升级到 2.0 但是第三个请求中提供的视图状态以“dDw”开头 - 这是一个 .Net 1.1 视图状态（对于 .Net 2.0，它以“/wE”开头）

在用户代理中看到“TrackChecker”告诉我某种机器人/爬虫保存了您的页面的旧版本（当它们由 .Net 1.1 生成时 - 包括视图状态），现在它正在重新检查您的内容并提交无效的视图状态（由于显而易见的原因，.Net 1.1 视图状态将无法在 .Net 2.0 上验证）

于 2012-07-23T13:07:15.240 回答
0

我在我的一个网站上收到了很多这样的 Viewstate 错误，它通常是一个试图发布恶意内容的机器人。

我怀疑这里也一样——除非你有很多来自白俄罗斯的用户？

如果您修改日志以捕获查询字符串和其他请求参数，则可以为您提供一些线索，了解（所谓的）攻击者 - 或不幸的用户 - 试图实现的目标。

于 2011-08-03T13:55:43.997 回答