Php Vulnerabilities (I)-security issues of PHP Web pages

Php Vulnerabilities (I)-security issues of PHP Web pages

PHP websites are vulnerable to the following attacks:

1. Command Injection)

2. Eval Injection)

3. Script insertion)

4. Cross-site scripting (XSS)

5. SQL injection attacks)

6. Cross-Site Request Forgery (csrf)

7. session hijacking)

8. Session Fixation)

9. Http response splitting attack (HTTP Response Splitting)

10,FileUploadVulnerabilities(File upload attack)

11. Directory Traversal Vulnerability (directory traversal)

12. Remote File Inclusion attack)

13,DynamicFunction injection (dynamic variable evaluation)

14. url attack)

15. Form submission spoofing attack (Spoofed form submissions)

16. http request spoofing attack (Spoofed HTTP requests)

In the future, the principles and defense methods of these vulnerabilities will be introduced one by one in each issue.

ImportantPHP. IniOption

Register globals

Php> = 4.2.0, the default value of the register_globals option of PHP. INI is set to off. When register_globals is set to on,ProgramIt can receive various environment variables from the server, including the variables submitted by the form. In addition, PHP does not have to initialize the variable value in advance, which leads to a great security risk.

Example 1:

// Check_admin () is used to check the permissions of the current user. If the $ is_admin variable is set to true in admin, the following code checks whether the variable is true and then runsManagementSome operations

// Ex1.php

<? PHP
If (check_admin ())
{
$ Is_admin = true;
}
If ($ is_admin)
{
Do_something ();
}
?>

This sectionCode$ Is_admin was not initialized to flase beforehand. If register_globals is on, then we directly submit the http://www.sectop.com/ex1.php? Is_admin = true, you can bypass the check_admin ()Verify

Example 2:

// Ex2.php
<? PHP
If (isset ($ _ session ["username"])
{
Do_something ();
}
Else
{
Echo "You have not logged on! ";
}
?>

When register_globals = on, we submit the http://www.sectop.com/ex2.php? _ Session [username] = Dodo, which grants permissions to this user

Therefore, regardless of register_globals, we must remember that any transmitted data must be carefully verified and the variables must be initialized.

Safe_mode

Security Mode. php is used to restrict access to documents, access to environment variables, and control execution of external programs. To enable security mode, you must set safe_mode = on in PHP. ini.

1. Restrict File Access

Safe_mode_include_dir = "/path1:/path2:/path3"

Different folders are separated by colons.

2. Restrict access to environment variables

Safe_mode_allowed_env_vars = string

Specify the prefix of environment variables that PHP programs can change, for example, safe_mode_allowed_env_vars = PHP _. If the value of this option is blank, PHP can change any environment variable.

Safe_mode_protected_env_vars = string

Used to specify the prefix of environment variables that PHP programs cannot change

3. Restrict execution of external programs

Safe_mode_exec_dir = string

The folder path specified by this option affects system, exec, popen, and passthru, but does not affect shell_exec and ''.

Disable_functions = string

Different function names are separated by commas (,). This option is not affected by the security mode.

Magic quotes

It is used to automatically escape input information of PHP programs. All single quotes (""), double quotes ("), backslash (" \ "), and nullCharacter(Null), are automatically added with a backslash to escape

Magic_quotes_gpc = on is used to set magic quotes to on, which affects the data (get, post, cookies) of HTTP requests)

ProgrammerYou can also use addslashes to escape the submitted HTTP request data, or use stripslashes to delete the escape