PHP Code Audit Code Execution injection

PHP Code Audit Code Execution injection

The so-called code execution injection is that the string parameters entered in some functions in PHP are executed as PHP code.

In this article, great article can be explored.

A common code execution function

Eval,assert,preg_replace

The eval function in the PHP manual means that the input string is programmed into PHP code

Test the code as follows, and then assign the value of the variable Moon to Phpinfo () in the URL

Execution succeeded in drawing the current PHP version,

Preg_replace perform regular expression search and replace

Allow code execution when the/E pattern modifier is present in pattern

ASSERT () checks the given assertion and, if the result is false, takes the appropriate action.

First Test the Eval function, this is the test code.

Here are the test results

Preg_replace ()

1 first parameter injection

/* Roughly the regular expression filter is phpinfo ()

Must have parameter/E URL test plus reg=/e

*/

The general meaning is to remove the style of the string containing Reg

First of all there is the parameter/E, this mode for code execution

Then enter the characters to be filtered, enter <\/PHP>, Mode/E, <php>phpinfo () </php> filter to

Phpinfo (), successful execution

2 The second way is simpler and better understood, direct injection

Preg_replace ("/moon/e", $_get[' moon '], "I love Moon");

3 parameter three injection success

The entire test code is appended

<?PHP//PHP Code Audit Code Execution injection/*if (isset ($_get[' moon ')) {$moon =$_get[' moon '];         1.eval ("\ $moon = $moon;"); 2.assert ("\ $moon = $moon;");} */ //Regular Code Execution/*parameter one injects echo $regexp = $_get[' reg ']; $String = ' <php>phpinfo () </php> ';//preg_replace ("/<php> (. *?) $regexp "," \\1 ", $String); Var_dump (Preg_replace ("/<php> (. *?) " $regexp "," \\1 ", $String)); */ //parameter two injects//preg_replace ("/moon/e", $_get[' moon '], "I love Moon");//Parameter three-injectionPreg_replace("/\s*\[php\" (. +?) \[\/php\]\s*/ies "," \\1 ",$_get[' Moon ']); ?>

PHP Code Audit Code Execution injection