The following are some famous CGI vulnerabilities collected and sorted out, and some security suggestions and solutions are provided. If these vulnerabilities are not fixed in time on the server, each vulnerability may be exploited by intruders, increase the server attack index.
1. phf
● Type: attack type
● Risk level: Medium
● Description: there is a program util. c In NCSA or Apache (version 1.1.1 or earlier) Non-commercial Web Server that allows in
them and what they can do.
ANDREW: if there is a lack of good leadership, it is more dependent on collective leadership. Do you think this may lead to a great team?
TIM: possible. But pay attention to it. Apache is a good example. Tim Berners-Lee made a blueprint and said, "I have thought about it, that is, hypertext server and hyper-text client ." Apache talents are willing to accept such constraints. I also remember that in the middle of 1990s, Netscape added something. Microsoft added someth
whether the PHP interpreter will be loaded into memory, typically processing CSS, JS and other static files is absolutely no need to load the interpreter.
2. Number of requests processed by a single process
Mod_php and fast-cgi are capable of processing multiple requests during the lifetime of each process, while CGI mode processes a request to destroy the process immediately, and CGI performance is very poor in high concurrency scenarios.
In the comprehensive, if the performance has a high
verify the user name and password before access is permitted. Some squids are listed belowVerification programs available:
LDAP: Linux Lightweight Directory Access Protocol (Linux Lightweight Directory Access Protocol)
NCSA: user name and password in the NCSA Style
SMB: services using the SMB protocol, such as SAMBA or Windows NT
MSNT: use Windows NT domain verification
PAM: Linux-based load-able ver
echo" Content-Type: text/html " echo" " echo" h2processes on this machine updated every 5 seconds/H2 " echo" Time: " date echo" p " echo" plaintext " PS-El echo" -- thisrandomstring -- " SL Eep 5 done note that the boundary setting is sent before the sleep statement, which ensures that the browser clears its buffer and displays the latest received data. NCSA httpd users cannot use spaces in the content type, including boundary parameters.
"improves the input I/O performance of text files
Output Format
Chart-create a chart image file (Microsoft Office 2000 or later is required)
TSV-write a text file that separates values with tabs and values with spaces
Syslog-send information to a syslog server or a text file in Syslog Format
Add function
MoD
Bit_and, bit_or, bit_not, bit_xor, bit_shl, bit_shr
Exp10, log10
Round and floor
Qntround_to_digit, qntfloor_to_digit
Strrepeat
In_row_number, out_row_number
Rot13
Extract_filename, extract
In the beginning there was NCSA Mosaic, and mosaic called itselfNcsa_mosaic/2.0 (Windows 3.1), And mosaic displayed pictures along with text, and there was much rejoicing.
And behold, then came a new Web browser known as "Mozilla", being short for "mosaic killer," But Mosaic was not amused, so the public name was changed to Netscape, and Netscape called itselfMozilla/1.0 (win3.1), And there was more rejoicing. and Netscape supported frames, and frames
History and prospects of the first stop Apache
In 1995, a developer of the National Computer Security Association (NCSA) created the NCSZ global network service software. Its biggest feature was the HTTP genie program, it was easier to configure and create the source code than the CERN server at that time. Due to the lack of other server software at that time, it soon became popular. But later, almost all core developers of the server left
what is CGI
CGI is currently maintained by NCSA, and NCSA defines CGI as follows:
CGI (Common Gateway Interface), a universal Gateway interface, is a program that runs on a server such as an HTTP server, providing an interface with the client HTML page.
Web browsing
To get a better idea of how CGI works, we can click on a link or URL from the Web page:
1. Use your browser to access the URL and connect to t
tell the browser to request the server which port is the service. That is, write "http://your.host.name: 8080" can connect to the other side of the port 8080;
2. Types of www host systems;
Generally, there are two types:
One is the Windows system's IIS + ms SQL + ASP WWW server, which is relatively easy to assume on the www host, but due to some features of windows, it is easy to be damaged by hackers;
The other is the www server (LAMP) of Apache + MySQL (PostgreSQL)
://www.dwz.cn/yFFgQ)Initially, CGI was developed in 1993 by the National Supercomputer Application Center (NCSA) for the NCSA HTTPd Web server. The Web server uses the UNIX shell environment variable to hold parameters passed from the Web server and then generates a separate process to run the CGI. The CGI processing flow is as follows:L Step1. The Web server receives a request from the client (browser), in
Recently in the study of computer networks, the browser's HTTP request message has been known, found an interesting phenomenon. Search for a moment, find the following article, laughing at me.
Are you curious about the user-agent that identifies the browser identity, and why each browser has the Mozilla word?
mozilla/5.0(Windows NT6.1; WOW64) applewebkit/537.36(khtml, like Gecko) chrome/27.0. 1453. 94safari/537.36mozilla/5.0(Linux; U Android4.1. 2; Zh-TW;GT-i9300build/jzo54k) apple
Are you curious about the user-agent that identifies the browser identity, and why each browser has the Mozilla word?
1
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.94 Safari/537.36
2
Mozilla/5.0 (Linux; U; Android 4.1.2; zh-tw; GT-I9300 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20
, pleaseYou don't have to discuss it with me, but the requirement is that the results must be completely made public to the internet.Welcome.# In this article, you are welcome to repeat these statements.# If you have any questions or suggestions, please mailto: iwillsurewin@163.net# Iwillsurewin 2000.7.28######################################## #################################### 1Type: attack typeName: phfRisk Level: MediumDescription: there is a program util. c in
running awstats_configure.pl if you prefer ):
A) awstats_configure.pl try to find your Apache web server config file (ask path if not found) and check inside your server log format configuration. if you use a common log, awstats_configure.pl will suggest to change it to have NCSA combined/XLF/ELF log format (you can use your own log format but this predefined logformat is often the best choice and make setup easier ).If you answer yes, awstats_config
PHP + APACHE implementation of user arguments. On a professional Web platform, the user's account and password are often required, that is, the identity confirmation action. Early NCSAhttpd servers did not provide this user validation function. on professional Web platforms, user accounts and passwords are often required, that is, identity validation. The early NCSA httpd server did not provide this user validation function. the Webmaster can only cre
/html1439106544.881 0 89.102.9.196tcp_denied/403 3706GET http://93.185.96.50/proxy/detectproxy.php-hier_none/-text/html1439106550.453 0 89.102.9.196tcp_denied/403 3712GET http://www2.nuabi.com/proxy/detectproxy.php-hier_none/-text/htmlWe use the NCSA Certification module to add certification to our squid. Why do I choose NCSA, because i have searched the internet most of the way.First we have to c
On the professional Web site, users often need the user's account number and password, that is, the action of identity recognition. The early NCSA httpd server did not provide this user-confirmed function, Webmaster can only manually create an identity-confirmed CGI program.
Most of the WEB servers since CERN httpd provide the user identity Confirmation feature. The settings for each set of WEB servers are not the same, but the settings are similar.
-fpm is an implementation of the fastcgi protocol.
CGI (Common Gateway Interface)
Initially, CGI was developed for the NCSA HTTPd Web server by the National Super Computer Application Center (NCSA) in 1993.
This Web server usesUNIX shell Environment VariablesTo save the parameters passed from the Web server, and then generate a CGI-runningIndependent Process. The first implementation of CGI is written in Pe
In many dedicated servers, the Web server should be the most well-known and commonly used, according to the different sites and web requirements, the Web server has several common environmental configuration scenarios, here to summarize shareIn many dedicated servers, the Web server should be the most well-known and commonly used, according to the different sites and web requirements, the Web server has several common environmental configuration scenarios, here is summed up to share:The current
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.