Are you bothered with PHP code audits for how to learn?

this post finally by what look at 2016-7-13 10:34 edit This post is what I see in other forums, it feels very good, so share it and discuss the study with everyone. Author: jing0102 In the original: Are you worried about how to learn \ PHP code audit? 0X01 Code Audit Introduction Code audit is a kind of source code analysis technology which aims at discovering program error, security vulnerability and violating program specification. Our code audit objects include not limited to auditing in the following languages in Windows and Linux system environments: Java, C, C #, ASP, PHP, JSP,. NET. Of course, today's more popular is the PHP code audit, because PHP is today's web security development of one of the mainstream language. 0x02 How to learn PHP code audit Now that we know the meaning of the code audit, we need to know that in the PHP source code to find vulnerabilities, defects, errors, you have to learn the corresponding source code language (PHP). ① understand PHP's approximate syntax ② initial ability to read PHP code ③ learn about the associated PHP dangerous functions (e.g. system () exec ()) ④ has a tool to locate, backtrack, and find (recommended: Tommsearch, seayphp Source Code audit tool) ⑤ look at some other people's analysis process ⑥ to do actual digging 0x03 how to carry out the PHP code audit ① first through a local local penetration test, once found that the wrong, you can use the Tommsearch to locate the relevant files (if the frame is the location of the need to be very cumbersome (frame positioning, you can refer to the article:/http darkm01lym0on.blog.163.com/blog/static/2567990922016019105947508/), but if it is not the framework, directly look at the URL of the file can be directly located) ② Tracking related code ③ do the corresponding test notes ④ Audit End Below I will myself to webmaster home the next source code to do a test it. Download Address: http://down.chinaz.com/soft/33915.htm E.g just downloaded a PHP message this system just looked at it casually Can see is a fk1.php file, view the source code of this file: $username =$_post["username"];//variable username is assigned the value of the username parameter passed over the following multiple meanings $QQ =$_post["QQ"]; $email =$_post["email"]; $homepage =$_post["homepage"]; $face =$_post["Face"]; $title =$_post["title"]; $content =$_post["Content"]; $time =date (' y-m-d h:i:s '); $ip =$_server[' remote_addr '];//record your IP $sql = "INSERT into Leavewords (USERNAME,QQ,EMAIL,HOMEPAGE,FACE,LEAVE_TITLE,LEAVE_CONTENTS,LEAVE_TIME,IP) VALUES (' $ Username ', $qq, ' $email ', ' $homepage ', ' $face ', ' $title ', ' $content ', ' $time ', ' $ip ') ';//use Insert to insert values for these messages mysql_query ($sql);//EXECUTE statement [Color=rgb (!important)] Copy code You can see the content of the submitted message has not been processed and executed the MySQL statement inserted into the database. The code can also be seen to be audited, so you can conclude that this can be audited in the background. I am now the front desk inserted payload to submit a message: The submission was successful: Back to the backstage: To the message management side: A pop-up box pops up and the code is executed smoothly. With this XSS storage vulnerability, we can make a cookie for XSS playing the backend administrator. -----------------------e.g End----------------------- The above is a simple audit idea, Daniel do not spray, small white can learn more! The road summary of the 0X04 code audit To tell the truth I was in the code audit this road for a year, I also tried to give up, but I still insist on down, although the technology is not fine, but, I learn the experience hope can help everyone. 1. Less blowing and more examples 2. Pay more attention to PHP code functions 3. The most important is also the hardest: persist Hope everyone in the days to promote each other! My bosom is quite! --------This article reprinted from: I Spring and autumn forum

