Uncommon injection-inject using IP addresses

I used to publish an article on IP injection attacks in the QQ space. This injection is actually not mysterious, but often ignored.
There are several ways to forge an IP address. One is to modify an IP data packet. If you are interested, you can check the structure of the IP data packet. The other is to modify the http header information to forge an IP address. Three environment variables are usually used for "client" IP addresses: $ _ SERVER ['HTTP _ CLIENT_IP '] and $ _ SERVER ['x _ FORWARDED_FOR'] and $ _ SERVER ['remote _ ADDR '] Actually, these three environment variables have limitations. The first two can be forged at will. You only need to set the corresponding value in the sent http header. Any character can be used, and 3rd environment variables. If you use an anonymous proxy, this variable displays the proxy IP address.

// Obtain the Client IP Address
Function getIP (){
$ Cip = '';
If ($ _ SERVER ('HTTP _ CLIENT_IP ') & strcasecmp ($ _ SERVER ('HTTP _ CLIENT_IP'), 'unknown ')){
$ Cip = $ _ SERVER ('HTTP _ CLIENT_IP ');
} Elseif ($ _ SERVER ('HTTP _ X_FORWARDED_FOR ') & strcasecmp ($ _ SERVER ('HTTP _ X_FORWARDED_FOR'), 'unknown ')){
$ Cip = $ _ SERVER ('HTTP _ X_FORWARDED_FOR ');
} Elseif ($ _ SERVER ('remote _ ADDR ') & strcasecmp ($ _ SERVER ('remote _ ADDR'), 'unknown ')){
$ Cip = $ _ SERVER ('remote _ ADDR ');
} Elseif (isset ($ _ SERVER ['remote _ ADDR ']) & $ _ SERVER ['remote _ ADDR '] & strcasecmp ($ _ SERVER ['remote _ ADDR'], 'unknown ')){
$ Cip = $ _ SERVER ['remote _ ADDR '];
}
Return $ cip;
}

As mentioned above, if I can forge HTTP_CLIENT_IP, as long as it is not unkown, it will make $ cip unretained to accept the forged data, and then:

1 $ db-> row_delete ("online", "userid = '$ userid' or ip ='". getIP ()."'");

This statement is actually executed (assuming the current user ID is 1, this is irrelevant) delete from online where userid = 1 or ip = '$ ip'

If I forge http_client_ip to '; delete from 'user' #, the preceding SQL statement will become

Delete from online where userid = 1 or ip = ''; delete from 'user' (because # is commented out), which is dangerous.

The attack script will not be sent. It is very simple. Just forge the head.
 

 

Author: thorn bird