20155229 "Network countermeasure technology" Exp8:web Foundation

Experimental content

(1). Web front-end HTML

Can install normally, start and stop Apache. Understand the HTML, understand the form, understand the get and post methods, and write an HTML containing the form.

(2). Web Front End Javascipt

Understand the basic JavaScript functionality and understand the DOM. Write JavaScript to verify the user name, password rules.

(3). Web backend: MySQL Foundation: normal installation, start MySQL, build library, create user, change password, build table

(4). Web backend: Writing PHP Web pages, connecting databases, authenticating users

(5). The simplest SQL injection, XSS attack test

Function Description: User can login, login user name password saved in the database, login successfully display welcome page.

Experimental steps Web front-end HTML

• GET: request data from a specified resource
• POST: submits the data to be processed to the specified resource.

Difference:

• Use sudo vi /etc/apache2/ports.conf the command to modify the port number that Apache uses.

• Use the netstat -tupln |grep 80 command to see if Port 80 is occupied, and if so, use kill+端口号 to kill the process

• Use the apachectl start command to turn on Apache services

• In the browser, enter the localhost:80 command, get, because the last experiment cloned page is QQ mailbox

• Using the cd /var/www/html working directory into Apache, create an. html file
• HTML for writing a simple login page

• Open browser Accesslocalhost:80/qian.html
• The following login screen appears, but the code does not write the page after the jump, so the landing page will not move.

Web Front end: JavaScript

DOM: is the standard for the audience, which defines the standard for accessing HTML and XML documents.

HTML DOM: is the standard object model of HTML, and is the standard programming interface of HTML. Defines the objects and properties of all HTML elements, and the methods by which they are accessed. In other words, the HTML DOM is the standard for how to get, modify, add, or delete HTML elements.

• In the above qian.html的基础上 , add a piece of JavaScript code, to complete the user whether to fill out the mailbox and password judgment.

• The added code:

<script language="javascript">      function validateLogin(){          var sUserName = document.frmLogin.username.value ;          var sPassword = document.frmLogin.password.value ;            if ((sUserName =="") || (sUserName=="Your name")){              alert("Please enter your user name!");              return false ;          }                 if ((sPassword =="") || (sPassword=="Your password")){              alert("Please enter the password!");              return false ;          }          }   </script>  

When the information is not filled in, the following prompts appear.

Web back end: MySQL Basics

• Use the command to turn on the /etc/init.d/mysql start MySQL service

• Use the mysql -u root -p command and enter the default password [email protected] to log in and enter MySQL.

• Using use mysql; the command, select MySQL database;
• Use the update user set password=PASSWORD("tvxq") where user=‘root‘; command to root Modify the password of the account
• Use flush privileges; the command to update permissions.

• After using the quit command to exit the database, log in again, log on successfully, the password is correct.

• create database fyhfyj;Create a new database using the command

• Use show databases; the command to view the currently existing database.

• Using use 库名 commands to make use of a database

• Use the create table 表名 (字段设定列表); command to create a data table in our database

• Use show tables a command to view the data table

• Use the insert into 表名 values(‘值1‘,‘值2‘,‘值3‘...); command to fill in the data table with the corresponding data

• Use the select * from 表名 command to query the data in the table
  

• Use the grant select(insert,update,delete) on 数据库.* to 用户名@登录主机 identified by "密码"; command to add new users to the database.
  

Web backend: Writing PHP Web pages

PHP: hypertext Preprocessor, is a common open source scripting language. PHP is a program embedded in the HTML (standard Common Markup Language application) in the document to execute, you can also execute the post-compilation code, compile can achieve encryption and optimize the code to run, so that the code runs faster.

• /var/www/htmlCreate a new PHP test file in the directory

<?php  echo ($_GET["a"]);  include($_GET["a"]);  echo "This is lxm php test page!<br>";?>

Enter in the browser to localhost:80/fyhtest.php?a=/etc/passwd be able to view the /etc/passwd contents of the file

• After the test, the combination of PHP and MySQL together with the simple landing page previously written to authenticate

<?php$uname=$_POST["users"];$pwd=$_POST["Password"];echo $uname;$query_str="SELECT * FROM login where username=‘$uname‘ and password=‘$pwd‘;";$mysqli = new mysqli("127.0.0.1", "root", "tvxq", "mysql");/* check connection */if ($mysqli->connect_errno) {    printf("Connect failed: %s\n", $mysqli->connect_error);    exit();}echo "connection ok!";/* Select queries return a resultset */if ($result = $mysqli->query($query_str)) {    if ($result->num_rows > 0 ){            echo "<br> {$uname}:Welcome!!! <br> ";    }     else {        echo "<br> login failed!!!! <br> " ; }    /* free result set */    $result->close();}$mysqli->close();?>

MySQL fills in the previous data in the database.

Then change the action section of the previously written login page to. php so that the page will jump to fyhlogin.php when it is logged in.

In the. PHP Code,$mysqli = new mysqli("127.0.0.1", "user", "password", "DB");

• User--mysql logged in User name
• Password--mysql Password for login
• Name of the db--database

Enter the address in the browser to 127.0.0.1/qian.html access your own login page, enter the user name and password in the database for user authentication

Landing success,:

Login failed,:

Simplest SQL injection, XSS attack test SQL injection

SQL injection: by inserting a SQL command into a Web form to submit or entering a query string for a domain name or page request, you end up with a malicious SQL command that deceives the server.

Change the SQL query statement select * from lxmtable where username=‘‘ or 1=1#‘ and password=‘‘ to, at this time, enter in the User name input box‘ or 1=1#

You will find whatever password you enter, and the page will log in successfully.

(The # equivalent of an annotation, the subsequent content is changed to comment, 1=1 is always true, so this formula is constant)

• The user name and password are saved in the database through SQL injection.
• First change the code to if ($result = $mysqli->query($query_str))if ($result = $mysqli->multi_query($query_str))

Then enter the following statement in the User name input box.

‘;insert into fyhtable values(‘5229‘,‘123456‘);#

After injection, look at the table, the user and password have been injected.

Enter it into a Web page

Landing Success!

XSS attack

XSS attacks: XSS attack, the Universal cross-site scripting attack, is to not be confused with the abbreviation of cascading style sheets, so the cross-site scripting attack is abbreviated as XSS,XSS is a computer security vulnerability in Web applications that allows malicious Web users to embed code into pages that are available to other users.

To save a picture in a /var/www/html table of contents

Use a command to read this picture in a Web page, has failed

Later, with the help of classmates, added a line of code {$uname} to get, read again

Read success

Answers to questions after the experiment

(1) What is a form?

• Forms are primarily responsible for data collection functions in Web pages.
• There are three basic components of a form:
• Form Labels: Here The bread contains the URL of the CGI program used to process the form data and the method by which the data is submitted to the server.
• Form fields: Contains text boxes, password boxes, hidden fields, multiline text boxes, check boxes, radio boxes, drop-down selection boxes, file upload boxes, and so on.
• Form buttons: Includes the Submit button, reset button, and General button, which can be used to transfer data to CGI scripts on the server, or to cancel input, and to use form buttons to control other processing tasks that define the processing script.

(2) What language does the browser have to parse and run?

• HTML (Hyper-text markup Language)
• XML (Extensible Markup Language)
• Python, PHP, JavaScript, ASP and many other scripting languages.

(3) What dynamic languages does webserver support?

The three most commonly used dynamic web languages are:

• ASP (Activeserverpages)
• JSP (Javaserverpages)
• PHP (Hypertextpreprocessor).

Experiment Summary and experience

This experiment combined with the previous lessons, of course, there are new knowledge, such as PHP, but the place to do PHP a bit of a crash, because the code is always wrong, unable to get on the page, fortunately, after several hours of effort, finally succeeded. Has finished EXP8, to start exp9, hehe (ˇ?ˇ)

20155229 "Network countermeasure technology" Exp8:web Foundation