如何用ASP来获取客户端网卡物理地址？
这里大家机器上都装有VB吧，我机器上装VB装不上，麻烦大家帮我做一个dll压成zip发帖到附件里让我用，谢谢啦。要做个投票程序，需要用到IP地址和网卡物理地址双重判断。
现在IP地址的做完了，就差加上网卡物理地址了。
在网上找了一个，不太会用，请大家帮我看看。谢谢。
fun.asp
'获取网卡物理地址
<%
Function GetMACAddress(strIP)
Set net = Server.CreateObject(")
Set sh = Server.CreateObject("wscript.shell")
sh.run "%comspec% /c nbtstat -A " & strIP & " > c:" & strIP & ".txt",0,true
Set sh = nothing
Set fso = createobject("scripting.filesystemobject")
Set ts = fso.opentextfile("c:" & strIP & ".txt")
macaddress = null
Do While Not ts.AtEndOfStream
data = ucase(trim(ts.readline))
If instr(data,"MAC ADDRESS") Then
macaddress = trim(split(data,"=")(1))
Exit Do
End If
loop
ts.close
Set ts = nothing
fso.deletefile "c:" & strIP & ".txt"
Set fso = nothing
GetMACAddress = macaddress
End Function
%>
<%
Dim userip
If Request.ServerVariables("HTTP_X_FORWARDED_FOR") = Empty Then '如果代理ip为空
userip = Request.ServerVariables("REMOTE_ADDR")'获取客户端真实ip
Else
userip = Request.ServerVariables("HTTP_X_FORWARDED_FOR")'获取代理ip
End If
%>
<%call GetMACAddress("")%> '调用显示某IP的物理网卡地址过程
<%mac=GetMACAddress("userip")%> '将结果赋值给mac
<%response.Write (mac)%> '显示结果
'**************************************
' for :MAC address
'**************************************
'**************************************
' Name: MAC address
' Description:Get the clients MAC(Media
' Access Control)
address, a hardware address that uniquely
identifies Each node of a network. Works great on
LAN's. Firewalls and Proxy's will be an issue
depending what side of them you're coding for.
' By: Jerry Aguilar
'
'**************************************
<%@ LANGUAGE="VBSCRIPT"%>
<%
strIP = Request.ServerVariables("REMOTE_ADDR")
strMac = GetMACAddress(strIP)
strHost = Request.ServerVariables("REMOTE_HOST")
Function GetMACAddress(strIP)
Set net = Server.CreateObject(")
Set sh = Server.CreateObject("wscript.shell")
sh.run "%comspec% /c nbtstat -A " & strIP & " > c:\" & strIP & ".txt",0,true
Set sh = nothing
Set fso = createobject("scripting.filesystemobject")
Set ts = fso.opentextfile("c:\" & strIP & ".txt")
macaddress = null
Do While Not ts.AtEndOfStream
data = ucase(trim(ts.readline))
If instr(data,"MAC ADDRESS") Then
macaddress = trim(split(data,"=")(1))
Exit Do
End If
loop
ts.close
Set ts = nothing
fso.deletefile "c:\" & strIP & ".txt"
Set fso = nothing
GetMACAddress = macaddress
End Function
%>
<HTML>
<HEAD>
<TITLE>Say Hello To the MAC MAN</TITLE>
</HEAD>
<BODY>
<%Response.Write("Your IP is : " & strIP & "<BR>" & vbcrlf)%>
<%Response.Write("Your MAC is : " & strMac & vbcrlf)%>
</BODY>
</HTML>
以上代码也是网络找到，直接保存asp文件运行，出现下列错误信息
错误类型：
Server 对象, ASP 0177 (0x800401F3)
无效的类别字符串
/F/wwwroot/index/ip.asp, 第 24 行
第24行错误就是这句话
Set net = Server.CreateObject(")
而在我的服务器win2003上面显示的却是无权限。
然后我把C盘的IIS来宾帐户打开了，然后给的全部控制权限，还是不行。
另外Set fso = createobject("scripting.xscsystemobject") 这个是什么东东？
可以替换掉Set fso = createobject("scripting.filesystemobject")嘛？
大家谁机器上装有VB的，帮帮忙好撒，生成后打成压缩包发帖到附件里，谢谢了。
用VB创建一个ActiveX DLL工程，将下面的代码帖到ClassModule中.
生成一个Dll文件.
在ASP页面中调用
<%
dim getMAC
getMAC=server.createobject("ProjectName.ClassName")
response.write getMAC.GetMACAddress("192.168.0.1")
%>
即可
Option Explicit
Private Const NCBASTAT = &H33
Private Const NCBNAMSZ = 16
Private Const HEAP_ZERO_MEMORY = &H8
Private Const HEAP_GENERATE_EXCEPTIONS = &H4
Private Const NCBRESET = &H32
Private Type NCB
ncb_command As Byte 'Integer
ncb_retcode As Byte 'Integer
ncb_lsn As Byte 'Integer
ncb_num As Byte ' Integer
ncb_buffer As Long 'String
ncb_length As Integer
ncb_callname As String * NCBNAMSZ
ncb_name As String * NCBNAMSZ
ncb_rto As Byte 'Integer
ncb_sto As Byte ' Integer
ncb_post As Long
ncb_lana_num As Byte 'Integer
ncb_cmd_cplt As Byte 'Integer
ncb_reserve(9) As Byte ' Reserved, must be 0
ncb_event As Long
End Type
Private Type ADAPTER_STATUS
adapter_address(5) As Byte 'As String * 6
rev_major As Byte 'Integer
reserved0 As Byte 'Integer
adapter_type As Byte 'Integer
rev_minor As Byte 'Integer
duration As Integer
frmr_recv As Integer
frmr_xmit As Integer
iframe_recv_err As Integer
xmit_aborts As Integer
xmit_success As Long
recv_success As Long
iframe_xmit_err As Integer
recv_buff_unavail As Integer
t1_timeouts As Integer
ti_timeouts As Integer
Reserved1 As Long
free_ncbs As Integer
max_cfg_ncbs As Integer
max_ncbs As Integer
xmit_buf_unavail As Integer
max_dgram_size As Integer
pending_sess As Integer
max_cfg_sess As Integer
max_sess As Integer
max_sess_pkt_size As Integer
name_count As Integer
End Type
Private Type NAME_BUFFER
name As String * NCBNAMSZ
name_num As Integer
name_flags As Integer
End Type
Private Type ASTAT
adapt As ADAPTER_STATUS
NameBuff(30) As NAME_BUFFER
End Type
Private Declare Function Netbios Lib "netapi32.dll" _
(pncb As NCB) As Byte
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" ( _
hpvDest As Any, ByVal hpvSource As Long, ByVal cbCopy As Long)
Private Declare Function GetProcessHeap Lib "kernel32" () As Long
Private Declare Function HeapAlloc Lib "kernel32" _
(ByVal hHeap As Long, ByVal dwFlags As Long, _
ByVal dwBytes As Long) As Long
Private Declare Function HeapFree Lib "kernel32" (ByVal hHeap As Long, _
ByVal dwFlags As Long, lpMem As Any) As Long
Public Function GetMACAddress(sIP As String) As String
Dim sRtn As String
Dim myNcb As NCB
Dim bRet As Byte
Dim aIP() As String
Dim X As Long
Dim nIP As String
If InStr(sIP, ".") = 0 Then
GetMACAddress = "Invaild IP Address."
Exit Function
End If
aIP = Split(sIP, ".", -1, vbTextCompare)
If UBound(aIP()) <> 3 Then
GetMACAddress = "Invaild IP Address."
Exit Function
End If
For X = 0 To UBound(aIP())
If Len(aIP(X)) > 3 Then
GetMACAddress = "Invaild IP Address"
Exit Function
End If
If IsNumeric(aIP(X)) = False Then
GetMACAddress = "Invaild IP Address"
Exit Function
End If
If InStr(aIP(X), ",") <> 0 Then
GetMACAddress = "Invaild IP Address"
Exit Function
End If
If CLng(aIP(X)) > 255 Then
GetMACAddress = "Invaild IP Address"
Exit Function
End If
If nIP = "" Then
nIP = String(3 - Len(aIP(X)), "0") & aIP(X)
Else
nIP = nIP & "." & String(3 - Len(aIP(X)), "0") & aIP(X)
End If
Next
sRtn = ""
myNcb.ncb_command = NCBRESET
bRet = Netbios(myNcb)
myNcb.ncb_command = NCBASTAT
myNcb.ncb_lana_num = 0
myNcb.ncb_callname = nIP & Chr(0)
Dim myASTAT As ASTAT, tempASTAT As ASTAT
Dim pASTAT As Long
myNcb.ncb_length = Len(myASTAT)
pASTAT = HeapAlloc(GetProcessHeap(), HEAP_GENERATE_EXCEPTIONS Or HEAP_ZERO_MEMORY, myNcb.ncb_length)
If pASTAT = 0 Then
GetMACAddress = "memory allcoation failed!"
Exit Function
End If
myNcb.ncb_buffer = pASTAT
bRet = Netbios(myNcb)
If bRet <> 0 Then
GetMACAddress = "Can not get the MAC Address from IP Address: " & sIP
Exit Function
End If
CopyMemory myASTAT, myNcb.ncb_buffer, Len(myASTAT)
Dim sTemp As String
Dim I As Long
For I = 0 To 5
sTemp = Hex(myASTAT.adapt.adapter_address(I))
If I = 0 Then
sRtn = IIf(Len(sTemp) < 2, "0" & sTemp, sTemp)
Else
sRtn = sRtn & Space(1) & IIf(Len(sTemp) < 2, "0" & sTemp, sTemp)
End If
Next
HeapFree GetProcessHeap(), 0, pASTAT
GetMACAddress = sRtn
End FunctionTop
<%
'用ASP读取网卡MAC地址
Dim RemoteAddr
If Request.ServerVariables("HTTP_X_FORWARDED_FOR") = Empty Then
RemoteAddr = Request.ServerVariables("REMOTE_ADDR")
Else
RemoteAddr = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
End If
Response.Write(GetMac(RemoteAddr))
'由于读取某IP的网卡MAC地址
'程序调用arp命令通过查询本机arp表读取特定IP的MAC地址
'本程序需要“WSCRIPT.SHELL”和“Scripting.FileSystemObject”两个组件，
'请确保您的服务器可以正常使用这两个组件
'本程序需要调用Cmd.exe程序,临时文件保存结果，请确保IIS来宾帐号对程序有访问权限,
'临时目录有写‘’‘’权‘’‘’限。
Function GetMac(IP)
On Error Resume Next
Dim oScript
Dim oFileSys, oFile
Dim All, szTempFile,ipc,phyc,typec
Dim TempPath
Set oScript = Server.CreateObject("WSCRIPT.SHELL")
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
TempPath="c:\temp\" '临时目录
szTempFile = TempPath & oFileSys.GetTempName()'获取临时文件名
Call oScript.Run ("cmd.exe /c ping -n 2 " & IP, 0, True) 'Arp表中须有此IP
Call oScript.Run ("cmd.exe /c arp -a " & IP & " > " & szTempFile,0, True)
Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False,0)
All=oFile.ReadAll()
oFile.Close
If (IsObject(oFile)) Then
Call oFileSys.DeleteFile(szTempFile, True)
End If
arr = Split(All, vbCrLf)
If UBound(arr) = 4 Then
Ipc= InStr(1, arr(2), "Internet Address")
phyc = InStr(1, arr(2), "Physical Address")
typec = InStr(1, arr(2), "Type")
If typec > phyc And phyc > Ipc And ipc > 0 Then
GetMac=Ucase(Trim(CStr(Mid(arr(3), phyc, typec - phyc))))
End If
End If
End Function
%>
在WEB开发中.我们可能都习惯使用下面的代码来获取客户端的IP地址:
-----------------C#代码----------------------------------------------------------------------
//优先取得代理IP
string IP = Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
if (string.IsNullOrEmpty(IP)) {
//没有代理IP则直接取连接客户端IP
IP = Request.ServerVariables["REMOTE_ADDR"];
}
-----------------------------------------------------------------------------------------------
上面代码看来起是正常的.可惜这里却隐藏了一个隐患!!因为"HTTP_X_FORWARDED_FOR"这个值是通过获取HTTP头的"X_FORWARDED_FOR"属性取得.所以这里就提供给恶意破坏者一个办法:可以伪造IP地址!!
下面是测试代码:
--------------C#代码---------------------------------------------------------------------------
HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create("http://localhost/ip.aspx");
request.Headers.Add("X_FORWARDED_FOR", "0.0.0.0");
HttpWebResponse response = (HttpWebResponse)request.GetResponse();
StreamReader stream = new StreamReader(response.GetResponseStream());
string IP = stream.ReadToEnd();
stream.Close();
response.Close();
request = null;
-----------------------------------------------------------------------------------------------
"ip.aspx"文件代码:
------------C#代码-----------------------------------------------------------------------------
Response.Clear();
//优先取得代理IP
string IP = Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
if (string.IsNullOrEmpty(IP))
{
//没有代理IP则直接取客户端IP
IP = Request.ServerVariables["REMOTE_ADDR"];
}
Response.Write(IP);
Response.End();
------------------------------------------------------------------------------------------------
这样.当测试代码中去访问ip.aspx文件时."string IP = stream.ReadToEnd();"这段代码取到的IP数据就是"0.0.0.0"!!!!(呵.在真实情况下.这样的IP地址肯定不是我们想要的结果.而在有些投票系统中限制一个IP只能投1次票时,如果也是用类似的代码取得对方IP然后再判断的话.呵呵.限制就失效咯)...
或者如果你用上面代码获取IP地址后后面又不再进行数据判断的话也许还能更进一步进行数据破坏!!
比如你用类似上面的代码中获取IP地址就直接有这样的SQL语句:
string sql = "INSERT INTO (IP) VALUE ('" + IP + "')";
那么也许破坏者还可以进行SQL注入进行数据破坏!!
这样看来利用"HTTP_X_FORWARDED_FOR"这个属性获取客户端IP的方法就不再可取了.-_-# 但如果不用这种方法.那么那些真正使用了代理服务器的人.我们又不能再获取到他们的真实IP地址(因为某些代理服务器会在"X_FORWARDED_FOR"这个HTTP头里加上访问用户真正的IP地址).呵.现实就是这样,某种东西都有有得必有失...
最后,我的建议是不要再使用上面的方法去获取客户端IP.即是不要再理会代理情况.你的建议又是怎样呢???
呵呵，我用这个骗了不少论坛，搞了不少恶作剧，网上搜一下白宫有哪些IP，然后以此就利用工具（也可以只是浏览器插件FF下比IE容易实现）伪装成从白宫访问，哈哈哈。。。。
回到正题，个人认为还是只支持REMOTE_ADDR比较好。
至于你说的利用伪造HTTP_X_FORWARDED_FOR来实现sql注入，这个貌似02年就被爆出，某个著名的php论坛程序有此漏洞。现在多数论坛程序在处理ip地址的时候都有格式检查，即便没有，在拼接sql语句的时候肯定会过滤不安全字符的（这是最应该做的了）。
