PHP Vulnerability Full Solution (detailed introduction) _php Tutorial

The following are the main types of attacks for PHP websites:
1. Order Injection (Command injection)
2. Eval Injection (eval injection)
3. Client-side scripting Attack (script insertion)
4. Cross-site scripting attacks (Scripting, XSS)
5. SQL injection attack (SQL injection)
6. Cross-site request forgery attack (forgeries, CSRF)
7. Session hijacking (Sessions hijacking)
8, session fixed attack (session fixation)
9. HTTP response Split attack (HTTP Response splitting)
10 Files Upload Vulnerability (file Upload Attack)
11. Directory Traversal Vulnerability (directory traversal)
12. Remote file contains attack (inclusion)
13. Dynamic function Injection Attack (Variable Evaluation)
14. URL attack (URL attack)
15. Form submission Spoofing attack (spoofed form submissions)
16. HTTP request Spoofing Attack (spoofed HTTP requests)

Command Injection attack
The following 5 functions can be used in PHP to execute external applications or functions
System, exec, PassThru, Shell_exec, "(Same as shell_exec function)
Function prototypes
String System (String command, int &return_var)
Command to execute
Return_var the state value after the execution of the execution command is held
String exec (String command, array &output, int &return_var)
Command to execute
Output gets the string of each line that executes the command output
Return_var the status value after the execution of the command
void PassThru (String command, int &return_var)
Command to execute
Return_var the status value after the execution of the command
String shell_exec (String command)
Command to execute

Vulnerability Instance

Example 1:
ex1.php
$dir = $_get["dir"];
if (Isset ($dir))
{
echo "

";
        System ("Ls-al". $dir);
        echo "

";
}
?>
We submitHttp://www.sectop.com/ex1.php?dir=| cat/etc/passwd
After submission, the command becomes system ("Ls-al | CAT/ETC/PASSWD ");

Eval injection attack
The Eval function executes the input string parameter as a PHP program code.
Function Prototypes:
Mixed eval (string code_str)//eval injection typically occurs when an attacker can control the input string
ex2.php
$var = "Var";
if (Isset ($_get["Arg"]))
{
$arg = $_get["arg"];
Eval ("\ $var = $arg;");
echo "\ $var =". $var;
}
?>
When we submit Http://www.sectop.com/ex2.php?arg=phpinfo(), the vulnerability arises

Dynamic functions
Func A ()
{
DoSomething ();
}
Func B ()
{
DoSomething ();
}
if (Isset ($_get["func"]))
{
$myfunc = $_get["Func"];
Echo $myfunc ();
}
?>
The programmer intended to dynamically invoke the A and B functions, and then we commit the http://www.sectop.com/ex.php?func=phpinfo vulnerability to produce

Precautionary approach
1. Try not to execute external commands
2. Use custom functions or libraries to replace the functions of external commands
3. Use the Escapeshellarg function to handle command parameters
4. Use Safe_mode_exec_dir to specify the path to the executable file
The Esacpeshellarg function will escape any character that causes the argument or command to end, single quote "'", replace with "\", double quote "" ", replace with" \ "", semicolon ";" Replace with "\;"
Using Safe_mode_exec_dir to specify the path to the executable file, you can put the command that will be used in this path
Safe_mode = On
Safe_mode_exec_di r=/usr/local/php/bin/

Client Script implantation

Client-side scripting (script insertion) refers to inserting scripts that can be executed into objects such as forms, pictures, animations, or hyperlinked text. When the user opens these objects, the attacker 's implanted script is executed and the attack begins.
HTML tags that can be used as script implants typically include the following:
1. Infinite Bullet Frame
Insert Jump Fishing Page
Or use other self-constructed JS code to attack

Methods of prevention
Typically use the Htmlspecialchars function to convert special characters to HTML encoding
Function prototypes
String Htmlspecialchars (string string, int Quote_style, string charset)
String is the character to encode
Quote_style optional, the value can be Ent_compat, ent_quotes, Ent_noquotes, and the default value Ent_compat, which indicates that only double quotes are converted without converting single quotes. Ent_quotes, which represents both double and single quotation marks to be converted. Ent_noquotes, which means double quotes and single quotes are not converted
CharSet optional, indicating the character set used
The function converts the following special characters into HTML encoding:
&--> &
"--"
'--'
<--> <
>--> >
Change the 98th line of show.php

And then look at the Insert JS Vulnerability page

XSS Cross-site scripting attacks

XSS (Cross site Scripting), which is intended to be an XSS attack, in order to distinguish it from style sheet css (cascading style Sheet)
Cross-site scripting is primarily used by attackers to read Web site users ' cookies or other personal data, and once an attacker obtains such data, he can impersonate the user to log on to the site and gain access to the user.
General steps for cross-site scripting attacks:
1. An attacker sends an XSS HTTP link to the target user in some way
2. The target user logs on to this website, which opens an XSS link sent by the attacker during the login
3. The website executes this XSS attack script
4, the target user page jumps to the attacker's website, the attacker obtains the target user's information
5, the attacker uses the target user's information to log on the website, completes the attack

When a program with a cross-site vulnerability appears, an attacker could construct a similar http://www.sectop.com/search.php?key=, tricking the user into clicking to obtain the user's cookie value
Precautionary approach:
Convert special characters to HTML encoding using the Htmlspecialchars function
Function prototypes
String Htmlspecialchars (string string, int Quote_style, string charset)
String is the character to encode
Quote_style optional, the value can be Ent_compat, ent_quotes, Ent_noquotes, and the default value Ent_compat, which indicates that only double quotes are converted without converting single quotes. Ent_quotes, which represents both double and single quotation marks to be converted. Ent_noquotes, which means double quotes and single quotes are not converted
CharSet optional, indicating the character set used
The function converts the following special characters into HTML encoding:
&--> &
"--"
'--'
<--> <
>--> >

$_server[Cross-site for "php_self"] variables
In a form, if you submit a parameter to yourself, you would use a statement like this

$_server[the value of the "php_self"] variable is the current page name
Cases:
http://www.sectop.com/get.php
The above form in get.php
Then we submit
http://www.sectop.com/get.php/">
Then the form becomes


Save As attack.html and put it on your website http://www.sectop.com/ attack.html, this page after access will automatically submit parameters to the target program's pass.php, the user name is changed to root, the password is changed to root, and then we go to the message board to send a message, hide this link, management access, his user name and password all changed to root

Precautionary approach
It is more difficult to guard against csrf than to guard against other attacks, because CSRF HTTP requests are made by attackers, but they are issued by the target user, and there are a few common ways to prevent them:
1, check the source of the Web page
2. Check the built-in hidden variables
3, use post, do not use get
Check the page source
Add the following red font code to the//pass.php header to verify data submission

if ($_get["Act"])
{
if (Isset ($_server["Http_referer"))
{
$serverhost = $_server["SERVER_NAME"];
$strurl = Str_replace ("http://", "" ", $_server[" Http_referer "]);
$strdomain = Explode ("/", $strurl);
$sourcehost = $strdomain [0];
if (strncmp ($sourcehost, $serverhost, strlen ($serverhost)))
{
Unset ($_post);
echo "";
}
}
$username =$_post["username"];
$sh =$_post["sh"];
$gg =$_post["GG"];
$title =$_post["title"];
$copyright =$_post["Copyright"].
Design and production: Xiamen, the network Technology ";
$password =md5 ($_post["password"]);
if (Empty ($_post["password"]))
{
$sql = "Update gly set Username= '". $username. "', sh=". $sh. ", gg= '". $gg. "', title= '". $title. "', copyright= '". $copyright. " where id=1 ";
}
Else
{
$sql = "Update gly set Username= '". $username. "', password= '". $password. "', sh=". $sh. ", gg= '". $gg. "', title= '". $title. " , copyright= ' ". $copyright." ' Where id=1 ';
}
mysql_query ($sql);
Mysql_close ($conn);
echo "";
}
Check for built-in hidden variables
We built a hidden variable and a session variable in the form, and then checked whether the hidden variable and the session variable were equal to determine whether the same page was called
Include_once ("dlyz.php");
Include_once (".. /conn.php ");
if ($_get["Act"])
{
if (!isset ($_session["post_id"))
{
Generate a unique ID and use MD5 to encrypt
$post _id = MD5 (Uniqid (rand (), true));
Creating Session Variables
$_session["post_id"] = $post _id;
}
Check for equality
if (Isset ($_session["post_id"))
{
Not equal
if ($_session["post_id"]! = $_post["post_id"])
{
Clear Post variables
Unset ($_post);
echo "";
}
}

......

">



}
Mysql_close ($conn);
?>


Use post, do not use get
When passing form fields, be sure to use post, do not use GET, handle variables and do not use $_request directly

HTTP response Split

Format of the HTTP request

1) Request Information: For example "get/index.php http/1.1", request index.php file

2) Header: For example "Host:localhost", indicating the server address

3) Blank line

4) Information body

Both the request information and the header must end with a newline character (CRLF), and the blank line can contain only line breaks and no other whitespace.

The following example sends an HTTP request to the server www.yhsafe.com

get/index.php http/1.1 //Request Information

Host:www.yhsafe.com // table header

The space line symbol indicates the return key, and after a blank line the HTTP request is sent after a space, only the host header in the header of the HTTP request is necessary, and the rest of the HTTP headers are based on the content of the HTTP request. methods for HTTP requests1) GET: Request response 2) HEAD: The same response as GET, only requires response header 3) POST: Send data to the server for processing, Data contained in HTTP message body 4) PUT: Upload file 5) Delete: Delete file 6) Trace: Trace received request 7) options: Return to the HTTP request supported by the server 8) Connect: Convert HTTP request connection to transparent tcp/ IP Channel format of the HTTP responseAfter the server has processed the HTTP request made by the client, the following response is sent. 1) The first line is the status Code 2) the second line starts with the other information the status code contains a number that identifies the state and a word that describes the status. For example: http/1.1 OK200 is the number that identifies the status, OK is the word that describes the status, and the status code identifies the request successfully.

Examples of HTTP requests and responses

Open cmd input telnet, enter open www.00aq.com 80

Enter after opening the connection

get/index.php http/1.1

Host:www.00aq.com

Returns the header of the HTTP response

Back to home page content

Use PHP to send HTTP requests

Header function can be used to send HTTP request and response headers

Function prototypes

void header (String string [, bool replace [, int http_response_code]])

http://www.bkjia.com/PHPjc/326308.html www.bkjia.com true http://www.bkjia.com/PHPjc/326308.html techarticle There are several types of attacks on PHP websites: 1, Command injection 2, eval injection (eval injection) 3, client script attack (script insertion) 4, cross-site feet ...

