1、sql注入攻擊
使用引數方法錄入，過濾單引號。
2、已解密登入請求
AppScan要求密碼都要加密傳輸，最好是使用https。這個問題還可以使用ajax來觸發帳號驗證並登入，
function login() {
            if ($("#txtUser").val() != '' && $("#txtPassWord").val() != '') {
                $.ajax({
                    url: 'Login.ashx', //訪問路徑
                    data: 'username=' + $("#txtUser").val() + "&password=" + $("#txtPassWord").val() + "&cord=" + $("#txtVCode").val(), //需要驗證的引數
                    type: 'post', //傳值的方式
                    error: function() {//訪問失敗時呼叫的函式
                        alert("連結伺服器錯誤！");
                    },
                    success: function(msg) {//訪問成功時呼叫的函式,這裡的msg是Login.ashx返回的值
                        if (msg == "登入成功！") {

                            window.location.href = '<%=url %>';
                        }
                        else {
                            alert(msg);
                            if (msg == "驗證碼不對！") {
                                $("#checkcordImg").attr("src", "validatecode.aspx?time=" + new Date());
                                $("#txtVCode").focus();
                            }
                        }
                    }
                });
            }

<table width="300" border="0" align="left" cellpadding="0" cellspacing="0">
                                    <tr>
                                        <td height="35" style="width: 47px">
                                        </td>
                                        <td width="18%">
                                            使用者名稱：
                                        </td>
                                        <td width="67%" align="left">
                                            <input id="txtUser" type="text" maxlength="20" style=" width:135px" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td height="35" style="width: 47px">
                                        </td>
                                        <td>
                                            密&nbsp;&nbsp;碼：
                                        </td>
                                        <td align="left">
                                             <input id="txtPassWord" type="password" maxlength="50" style=" width:135px" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td height="54">
                                        </td>
                                        <td>
                                            驗證碼：
                                        </td>
                                        <td align="left">
                                            <table width="100%" border="0" cellspacing="0" cellpadding="0">
                                                <tr>
                                                    <td>
                                                        <asp:TextBox ID="txtVCode" runat="server" Width="80px"></asp:TextBox>
                                                    </td>
                                                    <td>
                                                        <img id="checkcordImg" src='validatecode.aspx' onclick="this.src='validatecode.aspx?abc='+Math.random()"
                                                            alt="圖片看不清？點選重新得到驗證碼" style="cursor: hand;" />
                                                        <asp:RequiredFieldValidator ID="RequiredFieldValidator6" runat="server" ErrorMessage="驗證碼不能為空！"
                                                            ControlToValidate="txtVCode">*
                                                        </asp:RequiredFieldValidator>
                                                    </td>
                                                </tr>
                                            </table>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td colspan="3">
                                            <asp:ValidationSummary ID="ValidationSummary1" runat="server" ShowMessageBox="True"
                                                ShowSummary="False" />
                                        </td>
                                    </tr>
                                    <tr>
                                        <td style="width: 47px">
                                        </td>
                                        <td colspan="2" valign="bottom" align="center">
                                           <img src="Img/imgLogin/btn_12.jpg" alt=""  onclick="javascript:login();" />
                                            &nbsp;&nbsp;<img src="Img/imgLogin/btn_14.jpg" alt="" width="59" height="25" onclick="reset();" />
                                        </td>
                                    </tr>
                                </table>
純指令碼提交登入
那個工具只會整個頁面post

所以改為純指令碼提交登入後它就無效了。

3、檢測到隱藏目錄

解決方法1：iis裡面設定預設錯誤頁面為我們指定的errpage.html頁面，不要使用系統預設的錯誤頁面。
解決方法2：在img資料夾裡面放個空的預設頁（比如空的index.aspx），這樣就不會有【找不到頁面或無權檢視】的錯誤了。