Õe¶ÔPHPµÄÍøÕ¾Ö÷Òª´aeÔÚÏÂÃae¼¸ÖÖ¹¥»÷½Ê½:
1¡¢ÃuÁi×¢Èe(Command Injection)
2¡¢eval×¢Èe(Eval Injection)
3¡¢¿Í»§¶Ë½Å±¾¹¥»÷(Script Insertion)
4¡¢¿çÍøÕ¾½Å±¾¹¥»÷(Cross Site Scripting, XSS)
5¡¢SQL×¢Èe¹¥»÷(SQL injection)
6¡¢¿çÍøÕ¾ÇeÇoαÔi¹¥»÷(Cross Site Request Forgeries, CSRF)
7¡¢Session »a»°½Ù³Ö(Session Hijacking)
8¡¢Session ¹Ì¶¨¹¥»÷(Session Fixation)
9¡¢HTTPÏiÓ¦²ðÖ¹¥»÷(HTTP Response Splitting)
10¡¢ÎļþÉÏ´«Â(C)¶´(File Upload Attack)
11¡¢Ä¿Â¼´(C)Ô½Â(C)¶´(Directory Traversal)
12¡¢Ô¶³ÌÎļþ°uº¬¹¥»÷(Remote Inclusion)
13¡¢¶¯Ì¬º¯Êý×¢Èe¹¥»÷(Dynamic Variable Evaluation)
14¡¢URL¹¥»÷(URL attack)
15¡¢±iµ¥Ìa½»ÆÛƹ¥»÷(Spoofed Form Submissions)
16¡¢HTTPÇeÇoÆÛƹ¥»÷(Spoofed HTTP Requests)
ÃuÁi×¢Èe¹¥»÷
PHPÖпÉÒÔʹÓÃÏÂÁÐ5¸oº¯ÊýÀ´Ö´ÐÐÍa²¿µÄÓ¦ÓóÌÐo»oº¯Êý
system¡¢exec¡¢passthru¡¢shell_exec¡¢¡°(Óeshell_exec¹¦ÄÜÏaͬ)
º¯ÊýÔÐÍ
string system(string command, int &return;_var)
command ÒªÖ´ÐеÄÃuÁi
return_var ´aeÅÖ´ÐÐÃuÁiµÄÖ´ÐкoµÄ״ֵ̬
string exec (string command, array &output;, int &return;_var)
command ÒªÖ´ÐеÄÃuÁi
output »ñµÃÖ´ÐÐÃuÁiÊa³oµÄÿһÐÐ×Öu´®
return_var ´aeÅÖ´ÐÐÃuÁiºoµÄ״ֵ̬
void passthru (string command, int &return;_var)
command ÒªÖ´ÐеÄÃuÁi
return_var ´aeÅÖ´ÐÐÃuÁiºoµÄ״ֵ̬
string shell_exec (string command)
command ÒªÖ´ÐеÄÃuÁi
Â(C)¶´ÊµÀý
Àý1:
//ex1.php
<?php
$dir = $_GET["dir"];
if (isset($dir))
{
echo "
";";
system("ls -al ".$dir);
echo "
eval×¢Èe¹¥»÷
evalº¯Êý½«ÊaÈeµÄ×Öu´®²ÎÊýµ±×÷PHP³ÌÐo´uÂeÀ´Ö´ÐÐ
º¯ÊýÔÐÍ:
mixed eval(string code_str) //eval×¢ÈeÒ»°a¢ÉuÔÚ¹¥»÷ÕßÄÜ¿ØÖÆÊaÈeµÄ×Ö*u´®µÄʱºo
//ex2.php
<?php
$var = "var";
if (isset($_GET["arg"]))
{
$arg = $_GET["arg"];
eval("\$var = $arg;");
echo "\$var =".$var;
}
?>
µ±ÎÒÃÇÌa½» http://www.sectop.com/ex2.php?arg=phpinfo();Â(C)¶´¾Í²uÉuÁË
¶¯Ì¬º¯Êý
<?php
func A()
{
dosomething();
}
func B()
{
dosomething();
}
if (isset($_GET["func"]))
{
$myfunc = $_GET["func"];
echo $myfunc();
}
?>
³ÌÐoÔ±ÔÒaÊÇÏe¶¯Ì¬µ÷ÓÃAºÍBº¯Êý£¬ÄÇÎÒÃÇÌa½»http://www.sectop.com/ex.php?func=phpinfo Â(C)¶´²uÉu
À¶½¨
1¡¢¾¡Á¿²»ÒªÖ´ÐÐÍa²¿ÃuÁi
2¡¢Ê¹ÓÃ×Ô¶¨Òaº¯Êý»oº¯Êý¿aÀ´Ìae´uÍa²¿ÃuÁiµÄ¹¦ÄÜ
3¡¢Ê¹ÓÃescapeshellargº¯ÊýÀ´´¦ÀiÃuÁi²ÎÊý
4¡¢Ê¹ÓÃsafe_mode_exec_dirÖ¸¶¨¿ÉÖ´ÐÐÎļþµÄ¾¶
esacpeshellargº¯Êý»a½«ÈκÎÒýÆð²ÎÊý»oÃuÁi½aÊøµÄ×ÖuתÒa£¬µ¥ÒýºÅ¡°'¡±£¬Ìae»»³É¡°\'¡±£¬Ë«ÒýºÅ¡°"¡±£¬Ìae»»³É¡°\"¡±£¬ÖºÅ¡°;¡±Ìae»»³É¡°\;¡±
ÓÃsafe_mode_exec_dirÖ¸¶¨¿ÉÖ´ÐÐÎļþµÄ¾¶£¬¿ÉÒÔ°Ñ»aʹÓõÄÃuÁiÌaÇ°ÅÈe´Ë¾¶ÄÚ
safe_mode = On
safe_mode_exec_di r= /usr/local/php/bin/
¿Í»§¶Ë½Å±¾Ö²Èe
¿Í»§¶Ë½Å±¾Ö²Èe(Script Insertion)£¬ÊÇÖ¸½«¿ÉÒÔÖ´ÐеĽű¾²aÈeµ½±iµ¥¡¢Í¼Æ¬¡¢¶¯»»o³¬Á´½ÓÎÄ×ֵȶÔÏoÄÚ¡£µ±Óû§´o¿ªÕaÐ(C)¶ÔÏoºo£¬¹¥»÷ÕßËuÖ²ÈeµÄ½Å±¾¾Í»a±»Ö´ÐУ¬½ø¶ø¿ªÊ¼¹¥»÷¡£
¿ÉÒÔ±»ÓÃ×÷½Å±¾Ö²ÈeµÄHTML±eÇ(C)Ò»°a°uÀ¨ÒÔϼ¸ÖÖ:
1¡¢ ÎÞÏÞµ¯¿o
²aÈe ÌøתµoÓaÒ³Ãae
»oÕßʹÓÃÆaËu×ÔÐй¹ÔiµÄjs´uÂe½øÐй¥»÷
À¶µÄ½¨
Ò»°aʹÓÃhtmlspecialcharsº¯ÊýÀ´½«ÌØÊa×Öuת»»³ÉHTML±aÂe
º¯ÊýÔÐÍ
string htmlspecialchars (string string, int quote_style, string charset)
string ÊÇÒª±aÂeµÄ×Öu´®
quote_style ¿ÉÑ¡,Öµ¿ÉΪENT_COMPAT¡¢ENT_QUOTES¡¢ENT_NOQUOTES£¬Ä¬ÈÏÖµENT_COMPAT£¬±iʾֻת»»Ë«ÒýºÅ²»×ª»»µ¥ÒýºÅ¡£ENT_QUOTES£¬±iʾ˫ÒýºÅºÍµ¥ÒýºÅ¶¼Òª×ª»»¡£ENT_NOQUOTES£¬±iʾ˫ÒýºÅºÍµ¥ÒýºÅ¶¼²»×ª»»
charset ¿ÉÑ¡,±iʾʹÓõÄ×Öu¼¯
º¯Êý»a½«ÏÂÁÐÌØÊa×Öuת»»³Éhtml±aÂe:
& ¡ª-> &
" ¡ª-> "
¡® ¡ª-> ¡®
< ¡ª-> <
¡ª-> >
°Ñshow.phpµÄµÚ98ÐиijÉ
<?php echo htmlspecialchars(nl2br($row['question']), ENT_QUOTES); ?>
È»ºoÔÙ²e¿´²aÈejsµÄÂ(C)¶´Ò³Ãae
XSS¿çÕ¾½Å±¾¹¥»÷
XSS(Cross Site Scripting)£¬ÒaΪ¿çÍøÕ¾½Å±¾¹¥»÷£¬ÎªÁ˺ÍÑuʽ±icss(Cascading Style Sheet)Çø±ð£¬ËoдΪXSS
¿çÕ¾½Å±¾Ö÷Òª±»¹¥»÷ÕßÀuÓÃÀ´¶ÁÈ¡ÍøÕ¾Óû§µÄcookies»oÕßÆaËu¸oÈËÊý¾Ý£¬Ò»µ(C)¹¥»÷Õߵõ½ÕaÐ(C)Êý¾Ý£¬ÄÇôËu¾Í¿ÉÒÔαװ³É´ËÓû§À´µÇ¼ÍøÕ¾£¬»ñµÃ´ËÓû§µÄȨÏÞ¡£
¿çÕ¾½Å±¾¹¥»÷µÄÒ»°a²½Öe:
1¡¢¹¥»÷ÕßÒÔijÖֽʽ¢ËÍxssµÄhttpÁ´½Ó¸øÄ¿±eÓû§
2¡¢Ä¿±eÓû§µÇ¼´ËÍøÕ¾£¬ÔڵǽÆÚ¼a´o¿ªÁ˹¥»÷Õß*¢Ë͵ÄxssÁ´½Ó
3¡¢ÍøÕ¾Ö´ÐÐÁË´Ëxss¹¥»÷½Å±¾
4¡¢Ä¿±eÓû§Ò³ÃaeÌøתµ½¹¥»÷ÕßµÄÍøÕ¾£¬¹¥»÷ÕßÈ¡µÃÁËÄ¿±eÓû§µÄÐÅÏ¢
5¡¢¹¥»÷ÕßʹÓÃÄ¿±eÓû§µÄÐÅÏ¢µÇ¼ÍøÕ¾£¬Íe³É¹¥»÷
µ±ÓдaeÔÚ¿çÕ¾Â(C)¶´µÄ³ÌÐo³oÏÖµÄʱºo£¬¹¥»÷Õß¿ÉÒÔ¹¹ÔiÀaËÆ http://www.sectop.com/search.php?key= £¬ÓÕÆÓû§µa»÷ºo£¬¿ÉÒÔ»ñÈ¡Óû§cookiesÖµ
À¶½¨:
ÀuÓÃhtmlspecialcharsº¯Êý½«ÌØÊa×Öuת»»³ÉHTML±aÂe
º¯ÊýÔÐÍ
string htmlspecialchars (string string, int quote_style, string charset)
string ÊÇÒª±aÂeµÄ×Öu´®
quote_style ¿ÉÑ¡,Öµ¿ÉΪENT_COMPAT¡¢ENT_QUOTES¡¢ENT_NOQUOTES£¬Ä¬ÈÏÖµENT_COMPAT£¬±iʾֻת»»Ë«ÒýºÅ²»×ª»»µ¥ÒýºÅ¡£ENT_QUOTES£¬±iʾ˫ÒýºÅºÍµ¥ÒýºÅ¶¼Òª×ª»»¡£ENT_NOQUOTES£¬±iʾ˫ÒýºÅºÍµ¥ÒýºÅ¶¼²»×ª»»
charset ¿ÉÑ¡,±iʾʹÓõÄ×Öu¼¯
º¯Êý»a½«ÏÂÁÐÌØÊa×Öuת»»³Éhtml±aÂe:
& ¡ª-> &
" ¡ª-> "
¡® ¡ª-> ¡®
< ¡ª-> <
¡ª-> >
$_SERVER["PHP_SELF"]±aÁ¿µÄ¿çÕ¾
ÔÚij¸o±iµ¥ÖУ¬Èç¹uÌa½»²ÎÊý¸ø×Ô¼º£¬»aÓÃÕaÑuµÄÓi¾a
<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
¡¡
À¶½¨
À¶CSRFÒª±ÈÀ¶ÆaËu¹¥»÷¸u¼ÓÀ§ÄÑ£¬ÒoΪCSRFµÄHTTPÇeÇoËaÈ»Êǹ¥»÷ÕßαÔiµÄ£¬µ«ÊÇÈ´ÊÇÓÉÄ¿±eÓû§¢³oµÄ£¬Ò»°a³£¼uµÄÀ¶½¨ÓÐÏÂÃae¼¸ÖÖ:
1¡¢¼i²eÍøÒ³µÄÀ´Ô´
2¡¢¼i²eÄÚÖõÄÒþ²Ø±aÁ¿
3¡¢Ê¹ÓÃPOST£¬²»ÒªÊ¹ÓÃGET
¼i²eÍøÒ³À´Ô´
ÔÚ//pass.phpͲ¿¼ÓÈeÒÔϺiÉ«×ÖÌa´uÂe£¬ÑeÖ¤Êý¾ÝÌa½»
if($_GET["act"])
{
if(isset($_SERVER["HTTP_REFERER"]))
{
$serverhost = $_SERVER["SERVER_NAME"];
$strurl = str_replace("http://","",$_SERVER["HTTP_REFERER"]);
$strdomain = explode("/",$strurl);
$sourcehost = $strdomain[0];
if(strncmp($sourcehost, $serverhost, strlen($serverhost)))
{
unset($_POST);
echo "";
}
}
$username=$_POST["username"];
$sh=$_POST["sh"];
$gg=$_POST["gg"];
$title=$_POST["title"];
$copyright=$_POST["copyright"]."
Ée¼ÆÖÆ×÷£ºÏÃÃÅËaeÔµÍøÂç¿Æ¼¼";
$password=md5($_POST["password"]);
if(empty($_POST["password"]))
{
$sql="update gly set username='".$username."',sh=".$sh.",gg='".$gg."',title='".$title."',copyright='".$copyright."' where id=1";
}
else
{
$sql="update gly set username='".$username."',password='".$password."',sh=".$sh.",gg='".$gg."',title='".$title."',copyright='".$copyright."' where id=1";
}
mysql_query($sql);
mysql_close($conn);
echo "";
}
¼i²eÄÚÖÃÒþ²Ø±aÁ¿
ÎÒÃÇÔÚ±iµ¥ÖÐÄÚÖÃÒ»¸oÒþ²Ø±aÁ¿ºÍÒ»¸osession±aÁ¿£¬È»ºo¼i²eÕa¸oÒþ²Ø±aÁ¿ºÍsession±aÁ¿ÊÇñÏaµÈ£¬ÒÔ´ËÀ´ÅжÏÊÇñͬһ¸oÍøÒ³Ëuµ÷ÓÃ
<?php
include_once("dlyz.php");
include_once("../conn.php");
if($_GET["act"])
{
if (!isset($_SESSION["post_id"]))
{
// Éu³ÉΨһµÄID£¬²¢Ê¹ÓÃMD5À´¼ÓÃÜ
$post_id = md5(uniqid(rand(), true));
// ´´½¨Session±aÁ¿
$_SESSION["post_id"] = $post_id;
}
// ¼i²eÊÇ*ñÏaµÈ
if (isset($_SESSION["post_id"]))
{
// ²»ÏaµÈ
if ($_SESSION["post_id"] != $_POST["post_id"])
{
// Ça³ýPOST±aÁ¿
unset($_POST);
echo "";
}
}
¡¡
<input type="reset" name="Submit2" value="ÖØ ÖÃ"> <input type="hidden" name="post_id" value="<?php echo $_SESSION["post_id"];?>">