An ASP Classic Security Tool

An ASP Classic Security Tool

By Strictly-Software

The following script is one I wrote a long time ago but one I found quite useful the other day when I was working on an ASP Classic site.

If you download the script from my main website testsecurity.txt and then re-name it to .asp and copy it to your websites folder. You can then run it as an ASP page from your website.

The form is pretty simple and just asks for your ADO connection string so it can connect to your database using your websites login or another if you so wish.

It runs a number of tests and flags any "potential" problems up in red.

These may or may not be issues but could be areas of concern. For example you may need your website to have access to system objects from the website or run certain extended stored procedures but in many cases you shouldn't or wouldn't.

The security holes the tool looks at are:

• The roles that the user is a member of such as data_reader, data_writer or ddl_admin etc.
• It runs some select statements to see if it can access system tables using old and new versions e.g INFORMATION_SCHEMA.TABLES or SYS.OBJECTS.
• Tests whether the user has direct write permission to your database. Obviously I use EXECUTE permission on all my CUD (Create,Update,Delete) statements which are held inside stored procedures but on older ASP systems you are likely to find people doing direct CUD operations (just like many PHP developers still do) from the client code to the database.
• I test whether I can directly UPDATE a table inside your DB. I try and find a table using the system objects, which in itself could be a security hole, and then update a column in a table to its existing value so I don't overwrite anything. However this tells me whether you potentially have a hole by allowing the website direct UPDATE permission. Imagine if your own sanitisation functions failed or an SQL Injection attack succeeded. This could potentially bring your whole system down!
• I test for the ability to run certain potentially dangerous extended stored procedures such as xp_cmdshell (can run anything a command prompt could), xp_fileexist which tells a user whether or not a file exists on the server and also xp_regwrite which allows you to write to the registry with SQL. Obviously the first and last functions could cause drastic problems if a hacker could use them against you!
• I also test whether this ASP page can itself write and delete files (a simple text file with nothing in it) inside the folder that the ASP file is located. Obviously this could be a security hole as most websites only allow certain folders to be able to be written to. Being able to write files wherever the code is located could be dangerous as a hacker could write a file to delete other files or run code. I also check to see if I can write files to other places on the network - again another security hole. Sites should only allow the writing of files in certain places that can be virus checked and are known to be safe due to the permissions on the folder.

You might find this security test file that I quickly knocked up one day useful if you are ever having to work with ASP Classic sites and want to quickly check a variety of potential security holes in the database, website and file system with one form submission.

You can download the file from my main site testsecurity.txt.

Just remember to change the file extension to .ASP before running it!

Using String Builders to speed up string concatenation

Using String Builders to speed up string concatenation

If you are using a modern proper language then a string builder object like the one in C# is a standard tool for adding strings without the overhead of concatenation which can be a performance killer.

The reason is simple.

When you do this

a = "hello I am Rob";

a = a + " and I would like to say thank you";

a = a + " and good night";

A lot of languages have to make a copy of the string built so far and store it in memory before creating the new string.

This means that the longer the string gets the more memory is used up as two copies have to be held at the same time before being joined together.

I have actually seen ASP classic sites crash with out of memory errors caused by people using string concatenation to build up large RSS feeds.

The reason I am mentioning this is because of a comment I was given about my popular HTML Encoder object that handles double encoding, numerical and entity encoding and decoding with partial and fully encoded strings.

I have updated the numEncode function after the comment from Alex Oss to use a simple string builder which in JavaScript is very simple.

You just have an empty array, push the new strings into it (at the end of the array) and then join it together at the end to get the full string out. You can see the new function below.

// Numerically encodes all unicode characters
numEncode : function(s){ 
 if(this.isEmpty(s)) return ""; 

 var a = [],
  l = s.length; 
 
 for (var i=0,len=l.length;i "~"){ 
   a.push("&#"); 
   a.push(c.charCodeAt()); //numeric value of code point 
   a.push(";"); 
  }else{ 
   a.push(c); 
  } 
 } 
 
 return a.join("");  
}, 

You can download the latest version of my HTML Encoder Script for JavaScript here.

However in old languages like ASP classic you are stuck with either string concatenation or making your own string builder class.

I have made one which can be downloaded from my main website ASP String Builder Class.

You will notice that it ReDim's the array in chunks of 128 (which can be changed) and once 128 elements have been used it then ReDim's by another large chunk.

A counter is kept so we know how many element we actually have added and once we want to return the whole string we can either just RTRIM it (if we are joining with a blank space) or ReDim it back down to the right array size before joining it together.

This is just an example of how a string builder class is used and you could make a similar one in JavaScript that lets you access specific elements, the previous or next slot, update specific slots and set the delimiter like this ASP version.

Most modern languages have a String Builder Class but if you are using old languages or scripting languages like PHP or ASP classic then adding strings to an array before joining them together is the way to go for performances sake.

Strictly Software - Online CV

Are you looking for an experienced Web Developer with 25 years experience?

If you are a company or individual that requires an experienced systems developer for bespoke development work on websites, databases, scripts, plugins, bots and security then you should consider contacting Strictly Software for a formal quote.

Over my 25 years of development experience I have managed to acquire a wide range of technical skills that are very relevant in today's fast moving Internet world. A search on google.com will return many examples of my work from my publicly available free online tools and popular blog articles, to a number of popular WordPress plugins.

My skill-set covers everything from large scale database design, development and performance tuning to website development, auto-blogging, user tracking and black or white hat SEO techniques. A non-inclusive list of my skill-set is listed below.

• Database development and administration using MS SQL 6.5 - 2012 and MySQL.
• Performance tuning including index optimisation, query plan analysis and caching.
• Development of relational database systems, real time systems, EAV hybrids and systems built partially with automated code.
• A good knowledge of system views which I have used to create a multitude of scripts to help locate, update and port data and clean up systems that have been hacked with SQL injections.
• Automated reporting, analysis, diagnosis and correction scripts.
• Front end development in C#, ASP.NET, PHP, Java, VB, VBA, ASP Classic and Server and Client Side JavaScript on a number of commercial and personal sites as well as a number of intranets.
• Cross browser script development and the use of unobtrusive and progressive enhancement scripting techniques.
• XML, HTML, XHTML, RSS and OPML parsing.
• Web 2.0 development skills including RPC, RESTful methods and good knowledge of the issues surrounding internationalisation and multi byte character sets.
• AJAX, JSON and using Object Orientated JavaScript.
• Intermediate CSS skills and good DOM manipulation skills.
• Good knowledge of writing bots, crawlers and screen scrapers.
• Experience of hooking into popular API's such as Twitter, Google or Betfair.

Not only have I developed a number of useful PHP plugins for Wordpress including:

• Strictly AutoTags, an automatic tagging tool that uses keyword density and HTML tag analysis to find appropriate words to be used as tags for articles.

• Strictly Tweetbot, an automated content analysis plugin that uses OAuth to send tweets to multiple Twitter accounts.

• Strictly System Check, a report plugin that checks for site uptime and runs a number of automatic fixes depending on identifiable problems.

• Strictly Google Sitemap, a sitemap plugin for large high performing WordPress blogs.

I have also created a number of web tools using PHP which included:

• Super Search - An anonymising search engine that allowed you to search the top 3 search engines in when one of my proxies was stopped however it was a test to prove it could be done and I used my own language that I had created called SCRAPE.

• MyIP - A browser connection analysis tool.

• WebScan - A tool to scan a webpage and find out key info such as malware, trackers, outbound links, spam ratings, DNS checks and much more.

As well as purchasing these PRO Twitter plugins I have numerous free to use plugins and scripts, tools, and online programs that let you do all sorts of things like HTML Encode JavaScript and De-Compress multiple times packed code using Dean Edwards packing code mechanism.

I have also worked on a number of client side tools based on JavaScript and AJAX including my Getme.js example framework which I use alongside Sizzle for DOM manipulation.

I have personally identified a number of major problems with the common frameworks such as JQuery and Prototype which is why I do not use other peoples code unless I am required to and I have wrote a number of articles about these problems which can be found here:

http://www.strictly-software.com/CSSStyleObject

http://blog.strictly-software.com/2009/10/correctly-measuring-element-dimensions.html

I also specialise in writing tools for automatic HTTP parsing and screen scraping and have build a number of objects in C#, PHP and Javascript to enable me to scrape and reformat articles on the fly. I used to actually have a fully automated business which randomised data to create seemingly specific emails, and I created a brilliant looking website that hooked into Betfairs API to show recent results, upcoming races and market price. I also showed Racing information and news articles obtained from various sites using my own SCRAPE BOT and had fully automated daily optimisation and maintenance as well as SEO optimisation and automatic advertising when new articles were imported, optimised before Tweets and Facebook/LinkedIn/Tumblr and other social medsia posts were automatically sent out to bring in traffic.

As someone who has to maintain a system that has millions of page hits a day I am constantly engaged in a battle between malicious bots and users who are trying to either hack my system or steal content. Therefore I have built up quite a large amount of knowledge on the best practices when it comes to identifying and preventing bad users and this information also comes in use when I have to make automated requests myself.

I have also written a number of articles on the topic of bad bots and scraping as well as how a bot should go about crawling a site so that it doesn't get banned including writing an example C# object to parse a Robots.txt file.

I also run a number of personal sites that have increased my own personal knowledge of successful SEO strategies and I have authored a number of articles about tips and tricks I have come across that help in this regard:

http://blog.strictly-software.com/2009/12/setting-up-new-site-for-seo.html

http://blog.strictly-software.com/2009/08/implementing-seo-strategy-too-late-in.html

http://blog.strictly-software.com/2009/05/seo-search-engine-optimization.html

As well writing over 100 technical articles for this blog I have developed a number of popular and useful tools such as:

• Twitter Translator - One of the first sites to offer translation of Twitter messages on the fly in all the languages Google Translate offered. This had to be shut down due to Twitter changing their open API to a closed OAuth system.

• HTML Encoder and Decoder - This very popular tool is based on a free object I have created that allows users to HTML encode and Decode in Javascript. Unlike similar scripts my tool handles double encoding which is a big issue when you are handling content taken from multiple sources that may or may not have been merged with other content or already encoded.

• Javascript Unpacker and Beautifier - This popular tool is used by myself and many others to reformat compressed or packed JavaScript code and to reformat it into a readable format.

I used to have an APACHE server which I don't have anymore unfortunately as is had a a number of great tools and other sites including my own URL Shortener, a Spam Checker and a Pirate Bay Proxy checker script which used to be easily accessed on my www.strictly-software.com site which due to unfortunate circumstances, was moved to a French hosting company, OVH, who have blocked the owner from accessing it.

Due to crazy circumstances my site was hosted, along with it's SSL certificates on their server, which held a horse racing site I part owned along with my own site. The horse racing site got sold, the owners built a new site on a different server but they cannot stop OVH from charging them monthly fees for Windows/SQL Server/Hosting etc due to a change in their login process where they now require people to login by accessing a link sent out to a specific email address. 

I have no access to the address, nor do the new owners, as the old owners deleted it and it cannot be recreated. Trying to speak to OVH just results in them saying that they cannot change the email due to EU Data Protection laws. So this company is paying a huge monthly fee to keep a server running which only hosts my own site that I cannot even access to add a new SSL, or move the DB and code to another webserver. So that is why you don't get an https version of my site at the moment!

I used to work at a well known UK software development company based outside London.

I worked for this company for 11 years and during that time I was the architect of 3 versions of an award winning job recruitment software product. The software I developed ran over 500 different job boards and consists of custom code (client and server) that was written from the ground up using Microsoft technologies.

The generic codebase I have created and the back-end management system that controls it allows for extremely fast production times. Also because of the generic design the main time delay between specification and deployment for each new site is actually the front end design and not the database or business layer development as it usually is with other systems.

I actually automated the process of creating a new site so that the non techies who do the project management could easily follow a stepped process to create a new job board by filling in a series of forms. These forms asked for information such as the new URL, site name, any existing site to copy their settings and categories from, as well as a site to copy the design from which could then be changed.. 

I then automated the process of creating new database records, copying data from existing sites to the new one, updating IDs and linked lists, building text files such as ISAPI rewrite files and constant files, setting up folder structures and even creating the site in IIS so that at the end of the process there was a fully functional new site ready to be tweaked by the "colouring in" people e.g the designers LOL.

Using a mix between normalised relational structures and EAV for custom requirements alongside automatically generated de-normalised flat tables and matrices for high speed searching, the system I created perfectly straddles the sometimes problematic trade off many developers have to make between quick development, good solid design and high performance.

The skills I have learnt developing this software has proved that is possible to maintain high traffic systems on Microsoft architecture utilising legacy technologies such as ASP Classic along with a number of .NET web services and console scripts to send bulk emails out, handle incoming spam mail, importing jobs by XML and many other external tasks. 

By developing this system I learnt the following skills and techniques such as:

• Database performance tuning.
• Application layer performance tuning.
• Developing highly secure websites.
• Automated traffic analysis and real time logging, visitor fingerprinting and automatic banning techniques.
• Object orientated and procedural development methodologies.
• Caching, Minification, compression and other optimisation techniques.
• JavaScript widget development, including a custom WYSIWYG editor, my own framework and many animated tools including geo-graphical searching using Googles Map API and our own data.
• Automated tasks to report, analyse and fix potential issues.
• Good coding practises including limited 3rd party COM object use, object re-use and other well known but sadly untaught tricks of the trade.
• C# .NET coding for various external scripts that vastly sped up processes such as bulk maling job alerts to thousands of users when compared to old VBScript techniques.
• Use of NoSQL DataBase's such as DTSearch for indexing our jobs and CV's and providing a fast search of the files using their COM interface.

A cursory look over this blog and my very old site www.strictly-software.com (which I cannot actually access anymore due to the OVH server issue mentioned earlier), will show you the wide variety of skills that I am trained in and hopefully the depth of knowledge that my articles and examples deliver prove that I know what I am talking about.

If you are interested in learning more about my work or are looking to hire someone for web or database development then you should contact me for further details.

If you are interested in having a performance audit on your legacy systems before considering whether to rewrite or tune up then you can also contact me at the details provided in the contact link in the footer.

PHP and the demise of ASP Classic

Coding with PHP and the demise of ASP Classic

I have just started dabbling my toes in the water with PHP and MySQL primarily because I have just created a new blog with wordpress. I have always been on the Microsoft side of the development world starting off with Macros and VBA coding, Access databases, SQL 6.5 through to 2005 and then when the Interweb was created by Al Gore in the 90's :) I started using ASP classic, Javascript and then C#, ASP.NET.

All the companies I have worked for have used Microsoft server technology and developed primarily in MS technologies. Other languages have been used including Delphi, Perl and Java but my core experience has been Microsoft for good or bad.

One thing I am surprised at though is how PHP which is a server side scripting language is still flourishing whilst ASP classic has really died a slow death. Obviously there are still lots of sites including large ones that I have developed still running on ASP classic but any new development would be carried out in .NET. I can see how much more flexible PHP is as a scripting language but apart from some better OO characteristics its still script. I am therefore wondering why Javascript used server side didn't take off as the primary language for coding ASP classic.

VBScript has so many downsides such as its Error handling, its useless memory intensive regular expression engine and the only object orientated aspect is encapsulation. Therefore with Javascript having better solutions for all these 3 and coders being familiar with it anyway through using it for client side scripting its a shame that more coders didn't take up the Javascript mantle when they could. Creating development sites on home PCs or any laptop with an MS OS is as easy as putting a .ASP file in your inetpub/wwwroot folder and running it from your browser.

There are new forms of serverside Javascript coding about including Jaxer and Rhino which as I understand it converts the Javascript into Java so it seems to be carrying on in different forms.

As for the PHP I am just getting used to some of the odd syntax such as -> and concatenation using periods but it seems pretty similar to ASP classic in that its loosely typed language and can appear very messy in places when the HTML is mixed with the code. However it has more inbuilt functionality and is a nicer language as I much prefer Java or C# like syntax when coding.

Top 10 Tips for improving ASP performance

Top 10 Tips For Speeding up ASP Classic Sites

1. Look for nested loops and replace them with SQL stored procs. Its surprising how many times I have looked at sites that when outputting product hierarchies or menus on those old catalogue sites use nested loops to build up the content. Its usually people who got into programming on the web side with little or no SQL knowledge that was then learnt later only as and when they required somewhere to persist the data. Replace nested loops with SQL Stacks (see BOL) or in 2005 a recursive CTE. From tests I have found the Stack to perform slightly faster than the CTE but both will outperform nested loops. The data will most likely be in an adjacency table anyway so its just the method of outputting it. I remember replacing one such beast of nested loops with a stored procedure stack and it increased performance by a factor of 20.

2. Re-use those objects. Do you have helper functions that carry out regular expressions or file system object actions that instantiate the object within the function. If you call these functions
more than once on a page you are creating an unneccesary overhead. Have a global include file where you declare some often used variables. Then the first time you call the function if it doesn't exist initialise it otherwise use the existing object pointer. Then destroy them all in your global footer.

3. Simplify any complex regular expressions by breaking them down into multiple parts. I have had problems with badly written regular expressions causing CPU on our webserver to max at 100%. On our quad it would jump to 25%, four hits at the same time and 100% and then no other pages would load. Also complex expressions that do lots of lookbacks will cause overhead and the longer the string you are testing against the more overhead you will get. Remember VBs Regular Expression engine is not as good as some others so its better to break those long complex expressions up into smaller tests if possible.

4. String concatenation. In ASP.NET you have the string builder class but in ASP classic you should create your own using Arrays to store the string and then do a JOIN at the end to return it. Doing something like the following

For x = 1 to 100
strNew = strNew & strOtherString
Next

May work okay if the size of the string in strOtherString is small and you have few iterations but
once those strings get larger the amount of memory used to copy the existing string and then add it to the new one will grow exponentially.

5. Try to redim arrays as few times as possible especially if you are doing a Preserve. Its always best to dim to the exact size before hand but if you don't know how big your array will be then
dim it to a large number first and then use a counter to hold how many elements you actually add. Then at the end you redim preserve once back down to the number of elements you actually used. This uses a lot less memory than having to redim preserve on each addition to the array.

6. Use stored procedures for complex SQL and try to reduce database calls by calling multiple SQL together and then using NextRecordset() to move to the next set of records when you need to. Using stored procedures will also reduce network traffic as its much easier to connect to the DB once and pass through the names of 3 stored procedures than connect 3 times passing through the X lines of SELECT statements that each recordset requires.

strSQL = "EXEC dbo.usp_asp_get_records1; usp_asp_get_recorddetails; usp_asp_get_country_list;"

Set objRS = objConnection.Execute(strSQL)

If not(objRS.BOF AND objRS.EOF) Then
arrRecords = objRS.GetRows()
Set objRS = objRS.NextRecordset()
End If
If not(objRS.BOF AND objRS.EOF) Then
arrRecordDetails = objRS.GetRows()
Set objRS = objRS.NextRecordset()
End If
If not(objRS.BOF AND objRS.EOF) Then
arrCountryList = objRS.GetRows()
End If

7. Make sure that you don't put multiple conditions in IF statements. ASP doesn't support short circuiting which means it evaluates every condition in an IF statement even if the first one
is false. So rewrite code such as:

If intCount = 1 AND strName = "CBE" AND strDataType = "R" Then
'Do something
End If

If intCount = 1 Then
 If strName = "CBE" Then
    If strDataType = "R" Then
       'Do something
    End If
 End If
End If

8. Also make sure you evalutate conditions in the correct order if you are checking a value for True and False then you don't waste an extra check when you can just change the order of the conditions.

If Not(bVal) Then
 Response.Write("NO")
Else
 Respone.Write("YES")
End If

Should obviously be

If (bVal) Then
 Response.Write("YES")
Else
 Respone.Write("NO")
End If

8. Cache as much data as possible if it doesn't change frequently. If you have lists that come from a database but never change or very infrequently change then you could either store them in memory and reload every so often or write the array to a file and then use that static array and only re-create the file when the data changes. I always add an admin only function into my sites that on the press of a button will reload everything I need to into files and cache. This prevents un-required database lookups.

9. Pages that contain database content that's added through the website that only changes when the user saves that content can be created to static HTML files if possible. Rather than rebuilding the page from the DB each time someone views it you can use the static version. Only rebuild the page when the user updates the content. For example a lot of CMS systems store the content within the DB but create a static version of the page for quick loading.

10. Encode and format content on the way into the database not each time its outputted to be displayed. Its more cost efficent to do something once on the way in that hundreds of times on the way out.

These are just a few of the things I have found out that can be very beneficial in speeding up a classic ASP site on the web side of things. As well as any performance tweaks that can be done application side you should take a look at the database to make sure thats performing as well as possible. If your site is data driven then a lot of the performance will be related to how quick you can build those recordsets up and deliver them to the client.

Before we rewrite all those ASP Classic sites as .NET

What Language Should I use?

Although .NET is the way a large percentage of websites are going I still find a lot of them surprisingly slow. As a developer you are always wanting to work with the newest technologies getting to spend time learning new languages to boost your CV and work with whatever is cutting edge at the time just for the fun of it. However most of all developers work for someone and a lot of the time the customer your sales team sell to doesn't care if the site they are paying for is written in PHP, ASP.NET or ASP Classic as long as it works, is fast and doesn't break every time more than 10 people visit it at the same time.


The Quickest .NET Site Development in History

My boss used to joke that we should upgrade one of our biggest sites from classic ASP to .NET but rather than rewriting it all we should just change all the file extensions from .asp to .aspx. We used to laugh about this thinking it would be a good way to get a .NET site up quickly that was faster than our competitors with no development costs. However it was only a pie in the sky joke until recently when we actually sold a version of this software to a foreign company who wanted control of the source code.

A few months later when one of their management team spoke to my boss he proudly informed him that they had indeed rewritten the whole system in .NET and paid a lot of money for doing so. My boss informed him that if they had done so that quickly we would like a copy ourselves as it would save us some time re-developing the system having taken 2+ years to get to the stage we were currently at when we sold it.

We all eagerly gathered round the nearest PC and entered the URL to examine this marvel of technology that had only taken 2 months for a complete rewrite. Imagine our surprise when we were met with the exact same site not just the look and feel but the exact same site structure, page layout, CSS styling, client side JavaScript and so on. The only difference we could find was a new sub directory that used the companies name before our existing site structure and all the pages were now renamed .aspx.

We got some of our .NET developers down to view the source code and found nothing that indicated it had been generated by .NET cod and in fact it looked exactly like the classic ASP source code including some secret debug code generated by ASP that I had outputted in specific places hidden in HTML comments. Nothing had changed apart from the extensions!

We reckoned that maybe the Indian team that had been given the contract for the rewrite had taken one look at how much code there was and how complicated it would be to even understand without any training let alone rewrite that they took the decision my boss had batted around as a joke.

Of course we no longer had access to their servers so we couldn't confirm 100% that it had been a file extension change and nothing else. Maybe they had in fact re-written the whole system in .NET and reproduced every single feature that was already there in the exact same way as before including all my debug statements and client side JS code that was generated by the system. If that was the case then what was the benefit to the client? They had just forked out a huge bill for a rewrite with no visible benefit. Another indicator that the site hadn't been rewritten was that it was still as fast as it was previously so I would give pretty good odds that the Indian outfit that had the contract made a very easy £20k or so.

My point being is if you have a system that is performing well and is earning your company £££ with constant sales then does the language its written it actually make much of a difference to the sale of that product. Wouldn't the speed, reliability and development time required to get it up and running be more important in the customers mind or is that .asp extension just considered too old and unfashionable nowadays in the small percentage of customers minds who even know the difference between .asp .aspx ?

And if you do have a customer that gets all panicky about those .asp extensions you can always use ISAPI URL rewriting to remove any mention of .asp or .aspx. Remember a fast well performing site is just that and the customer is probably not as bothered as you whether its been developed in classic ASP, .NET 3, PHP, Java or the next 3 lettered acronym language that comes along.

As a developer you may want to rewrite existing sites each time a new sexy technology comes out but unless there are desirable benefits to the company that pays your wages in doing this then its not going to happen. If you work for a small company then the time and money lost by taking a developer away from new work to rewrite an existing system is not going to be cost effective.

However saying that you might have a good case in convincing your boss to put that effort in a rewrite and there will always be tech savy customers out there who pay money over fist for the latest code base just like uber rich fashionistas that only wear the same clothes once. However before you do upgrade your classic ASP system try and see if you get it to perform as fast as it possibly can first. There's a high chance that a lot of classic ASP systems have a lot of bad code contained within them that could be tweaked to improve performance with a little work.

I work on a number of large high volume traffic sites that are still using classic ASP and have spent considerable time trying to get the best performance out of them as possible as a rewrite in .NET is going to take some considerable time and effort. If I have a poorly performing site then the steps I would go through on the way to a redevelopment are these:

1. Improve the ASP application code as much as possible. See top 10 tips for improving ASP sites.

2. Make sure the database is performing as well as possible and returning data to the application as quick as it can. View my top tips for increasing SQL performance article.

3. Make sure your hardware and software is configured correctly and that you don't have problems with the servers setup.

4. Consider moving to a 64 bit server and put more RAM in. See tips for moving from 32 to 64 bit server.

5. If all the previous have failed and you still do not have a scalable site that can take large amounts of traffic then consider a rewrite in .NET.

However there maybe some fundamental issue in the applications design or site structure that is causing problems. If so then a redesign is required anyway. Creating and maintaining scalable high volume sites in ASP classic is possible but requires some skill and knowledge. You need to weigh up the cost to the company in time and money that a total redesign and redevelopment would take opposed to any gains made by performance tuning and adding extra hardware.