PHP security-Brute force attack

Violent attacks

A violent attack is an attack that uses no special means to exhaust all possibilities. Its more formal term is the exhaustive attack-the attack of the various possibilities.

For access control, a typical brute force attack manifests as an attacker attempting to log on to a system with a large number of attempts. In most cases, the user name is known, and only the password needs to be guessed.

Despite the lack of skill in brute force attacks, dictionary attacks seem to have some skill. The biggest difference is the intelligence when making guesses. Dictionary attacks will only be exhaustive in the list of the most probable cases, rather than being exhaustive as a brute force attack.

Preventing verification attempts or limiting the number of allowed errors is a more effective security measure, but the dilemma is how to identify and block attackers without affecting the use of legitimate users.

In this case, the determination of consistency can help you differentiate between the two. This approach is similar to the practice of preventing session hijacking as described in chapter fourth, but the difference is that you want to identify an attacker rather than a legitimate user.

Consider the following HTML form:

CODE:   <form action= "http://example.org/login.php" method= "POST" >  <p>username: <input type= " Text "name=" username "/></p>  <p>password: <input type=" Password "name=" Password "/></p >  <p><input type= "Submit"/></p>  </form>

The attacker would look at the form and set up a script to post the valid data to http://www.php.cn/:

CODE:  <?php   $username = ' victim ';  $password = ' guess ';   $content = "username= $username &password= $password";  $content _length = strlen ($content);   $http _request = ";  $http _response = ";   $http _request. = "post/login.phphttp/1.1\r\n";  $http _request. = "host:example.org\r\n";  $http _request. = "content-type:application/x-www-form-urlencoded\r\n";  $http _request. = "Content-length: $content _length\r\n";  $http _request. = "connection:close\r\n";  $http _request. = "\ r \ n";  $http _request. = $content;   if ($handle = Fsockopen (' example.org '))  {    fputs ($handle, $http _request);     while (!feof ($handle))    {      $http _response. = Fgets ($handle, 1024x768);    }     Fclose ($handle);     /* Check Response */  }  else  {/    * Error */  }   ?>

To make this script, an attacker could simply join a loop to continue experimenting with different passwords and examine the $http_response variable after each attempt. Once the $http_response variable has changed, it can be assumed that the correct password was guessed.

There are many security measures that you can use to prevent such attacks. It is valuable to note that every HTTP request in a brute-force attack is not the same as the password, but the other part is exactly the same.

Although temporarily freezing your account after a certain number of failed attempts is an effective precaution, you may want to consider a more deterministic way to freeze your account so that attackers can less affect the normal use of your app by legitimate users.

There are also processes that can increase the difficulty of brute force attacks, making it less likely to succeed. A simple containment mechanism would be effective in doing this:

CODE: <?php/* mysql_connect () *//* MYSQL_SELECT_DB () */$clean = array ();   $mysql = Array ();  $now = time ();   $max = $now-15;   $salt = ' Shiflett ';  if (Ctype_alnum ($_post[' username ')) {$clean [' username '] = $_post[' username '];  } else {/* ... */} $clean [' password '] = MD5 ($salt. MD5 ($_post[' password ']. $salt));   $mysql [' username '] =mysql_real_escape_string ($clean [' username ']);   $sql = "Select Last_failure, password from users WHERE username = ' {$mysql [' username ']} '";       if ($result = mysql_query ($sql)) {if (mysql_num_rows ($result)) {$record = Mysql_fetch_assoc ($result); if ($record [' last_failure ']> $max) {/* Less than seconds since last failure*/} elseif ($rec ord[' password '] = = $clean [' password ']) {/* Successful login */} else {/* Failed login */$sql = "UPDATE users SET last_failure = ' $now ' WHERE username = ' {$mysql [' username ']} ';      mysql_query ($sql); }} else {/* Invalid Username */}} else {/* Error */}?>

The previous meeting limits how often the same user is tried again after the last validation failure. If you try again within 15 seconds after a failed attempt, the validation will fail, regardless of the correct password. This is the key point of the scheme. But it is not enough to simply block access within 15 seconds of a failed attempt-the output will be consistent regardless of input at this time, and will be different only if the login succeeds. Otherwise, an attacker could simply check for inconsistent output to determine whether the login was successful.

The above is the PHP security-violence attack content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

