Web Application Security Vulnerability Analysis and Prevention (PHP)

PHP is one of the most popular dynamic website development scripting languages in the Internet environment. The security of Web applications developed using PHP is also the focus of hackers. This article analyzes and describes the security of Web applications written in PHP through source code analysis.

In the previous articles, we analyzed and described common Web Security Vulnerability attacks and prevention methods, and analyzed the source code of Web applications written in ASP using examples. Similar to ASP, PHP is also one of the most popular dynamic website development scripting languages in the Internet environment. In recent years, the number of PHP users has exceeded ASP, in addition, open-source Web applications written in PHP can be seen everywhere in China's Internet environment. This article analyzes the Web Application Security Vulnerabilities developed in PHP through source code analysis, and describes feasible and effective preventive methods based on the actual vulnerabilities.

As described in previous articles, analyzing the security of Web applications mainly involves analyzing the variables and functions with security problems in Web applications. The analysis process for Web applications written in PHP is the same. It analyzes variable information that can be controlled by users in the program, it also analyzes whether the program has certain defects in the Process of processing variables or uses insecure functions. These insecure operations are the root cause of security problems in Web applications. As there are some differences in the process of obtaining and operating variables in different languages, we will analyze the acquisition of variables and common security vulnerabilities in PHP.

Variable acquisition

Web applications written in PHP can be implemented in multiple ways to GET variables. common ways to GET variables include $ _ GET, $ _ POST, $ _ COOKIE, and $ _ SERVER, $ _ GET indicates that the variable content is obtained through GET, and $ _ POST indicates that the variable content is obtained through the data segment of the HTTP datagram, $ _ COOKIE is used to obtain the variable content through the Cookie segment in the HTTP datagram text, and $ _ SERVER is used to obtain the variable content through the data content in the HTTP data header in the HTTP datagram text. Therefore, when analyzing the PHP program variables, you can find the variables by searching for the above keywords, you can also use some file editor software to Perform Batch search for PHP files under the Web application directory to determine where the variables are obtained, as shown in 1, you can use Editplus to search for PHP files in the Web application source code directory and find the location where the $ _ GET keyword appears.

Figure 1

However, in some Web applications developed using PHP, variables are directly operated without variable initialization. Therefore, while searching and analyzing the preceding keywords, you also need to analyze and test uninitialized variables to prevent omissions.

Vulnerability Analysis and Prevention

The Web application written in PHP used in this vulnerability analysis is damn vulnerable web app (DVWA ). This program is a Web application specially designed for teaching purposes by foreign network security personnel. This program integrates common security vulnerabilities in PHP applications, for example, SQL Injection Vulnerabilities, XSS cross-site scripting vulnerabilities, File Upload vulnerabilities, and command execution vulnerabilities. A program defines each vulnerability by defining high, medium, and low security levels, this helps you analyze data during learning. Vulnerabilities with low security levels often exist because they are not filtered. vulnerabilities in the security level indicate that the code is filtered, however, hackers can exploit this vulnerability because of incomplete filtering. However, high security levels are considered to be ideal security defense methods, A high-level demonstration shows the code levels that users can refer. Next we will analyze and describe the security of the program based on the vulnerability instance.

SQL Injection Vulnerability

During vulnerability analysis and testing, we need to set the security level in the DVWA security settings and load PHP code of different levels by setting the program, as shown in figure 2, we first set the security level to low level, and then the analysis and testing methods for each vulnerability are the same.

 

In SQL injection vulnerability analysis, the function code queries the database by entering the specified ID and displays the corresponding data, as shown in figure 3, enter admin information for the data that is displayed after the ID is 1 and submitted.

Figure 3

Through code analysis, we found that the DVWA program passed. in the htaccess file, set magic_quotes_gpc to Off, which means that the single quotes, double quotation marks, and other characters submitted through GET/POST/COOKIE will not be magic escaped, when analyzing low-level code with the SQL injection vulnerability, the Code content is shown in Figure 4.

Figure 4

From the code, we know that after the program obtains the variable through the GET method, it will be brought into the SQL statement for query without performing any checks and filtering on the $ id content, at the same time, because magic_quotes_gpc is set to Off, we can easily traverse all data content through joint queries. By viewing the database table structure, we know that the users table structure is shown in Figure 5.

Figure 5

We are interested in the user field and password field. Therefore, in the input box, we submit the 'Union select user, password from users # 'content. During the query, the content of the executed SQL statement is SELECT first_name, last_name FROM users WHERE user_id = ''union select user, password from users # '. The single quotation marks we enter are used to close the single quotation marks, the entered # number is commented out as a comment in the MySQL database query, which invalidates the subsequent statements. With this query, you can directly view sensitive data in all users tables, as shown in figure 6.

Figure 6

Code with a low security level can be said to be code that has not been filtered, so it is easy to cause malicious attacks. Next, let's take a look at the code content in the security level, as shown in 7.

Figure 7

We found that after the program obtains the content of the variable $ id, it will use the mysql_real_escape_string function to process the variable $ id and then include it in the SQL statement for execution. When we submit code with low security levels, we find that the content of the single quotes we submit is escaped, leading to the failure of the previous method, as shown in figure 8.

 

Figure 8

The function mysql_real_escape_string is used to escape symbols such as single quotation marks and double quotation marks in Variables Based on the character set definition in the database, that is to say, this function is very effective in the filtering process of injection. However, in the analysis, we found that in the Code with an intermediate security level, the content of the executed SQL statement is SELECT first_name, last_name FROM users WHERE user_id = $ id, we found that $ id is not enclosed by single quotes, that is to say, the current injection is a numeric injection, and the mysql_real_escape_string function does not work for this type of injection, therefore, the submitted content is changed to 0 union select user and password from users. After submission, the vulnerability is successfully exploited, as shown in figure 9.

Figure 9

How can we prevent SQL injection attacks from the code? The Code section with a high security level provides a complete solution, as shown in code 10.

Figure 10

From the code, we found that the Code filtering process not only filters out possible injection, but also uses the is_numeric function to determine whether the variable $ id is a number, if it is not a number, it will not continue execution, thus completely eliminating the possibility of SQL injection attacks during the SQL statement execution. In fact, it is sufficient to filter SQL injection attacks in this scenario by using the is_numeric function only to determine whether the variable $ id is a number, however, the author of the program adds filters for injection to facilitate our learning.

XSS Cross-Site Scripting Vulnerability

In the DVWA program, XSS cross-site scripting vulnerabilities are divided into two types: reflective and storage. The code processing process for the reflected and stored types in the program is basically the same. The only difference is whether the corresponding data content is written into the database. Therefore, during the code analysis process of XSS cross-site scripting attacks, we only analyze the reflective DEMO code. First, we analyze the vulnerability code with a low security level. Code with a low security level of reflection type is shown in 11.

Figure 11

 

From the code, we find that the program only determines whether the obtained content is null. If it is not empty, the corresponding code will be output. Based on the introduction of XSS cross-site scripting vulnerability in the previous few years, you can easily submit the data content as <script> alert (/xss /) </script> XSS cross-site attack, as shown in Figure 12.

Figure 12

In the Code with the reflected security level, we found that the program used the str_replace function to filter the possible <script> data submitted by the user, the code is shown in Figure 13.

Figure 13

However, this simple filtering method can still be easily bypassed, and there are many bypass methods. First, the <script> tag is not the only one that is used to execute XSS attacks. For example, the submitted content is XSS attacks can also be achieved, as shown in figure 14.

Figure 14

Similarly, for the features of this filtering code, we can also submit <scr <script> ERT> alert (/xss/) </script> for bypassing, because the str_replace function is used in the code to filter the string <script> and replace it with null, when we commit <scr <script> ERT> alert (/xss /) </script>, after the str_replace function, the data becomes <script> alert (/xss/) </script>, which exactly meets our XSS attack purpose.

How can we prevent the XSS cross-site scripting vulnerability in this scenario? The code in the high security level provides a complete security solution, as shown in code 15.

Figure 15

From the code, we found that the Code with a high security level uses the htmlspecialchars function to filter the submitted name variable, the main function of this function is to process the HTML code tag information that may exist in the parameter string, and escape the tag information to make it useless. When we submit the cross-site scripting code for the previous test, we find that the code is displayed in the string format, but the <and> symbols in the source code are escaped, as shown in 16.

 

Figure 16

For the XSS cross-site scripting vulnerability, the submitted data code appears in the HTML code data content, rather than the tag attribute information. Therefore, if a hacker wants to exploit this vulnerability, the purpose of code execution must be achieved by constructing HTML tags, while the htmlspecialchars function filters out this situation, effectively preventing the formation of XSS cross-site scripting vulnerability.

Command Execution Vulnerability

In DVWA, the main function of the command execution vulnerability page is to run the ping command by entering an IP address. The code of the low security level file is shown in figure 17.

Figure 17

From the code, we found that after obtaining the IP address entered by the user, the program will first determine the operating system type of the server and then execute the corresponding ping command, however, the information entered by the user is not filtered. Based on the exploitation method of the command execution vulnerability described in the previous few articles, you can use the pipeline operator | to exploit the command execution vulnerability. The submitted content is | net user and you can see the account information of the current Windows server as shown in 18.

Figure 18

In the code of the medium security level, we found that the Code uses the str_replace function to filter the &; in the data content submitted by the user, as shown in 19.

Figure 19

The main purpose of code filtering is to prevent multiple statements from being executed in the data content submitted by the user. That is to say, the next command is executed after the ping command is executed, however, this filtering method does not take the pipeline operator into account, which can also cause bypassing. The high security level code provides a complete security solution for this scenario. The code is shown in 20.

Figure 20

The Code filters and processes IP addresses based on the actual situation of the scenario to ensure that the input data is in the specified IP address format, if the entered information does not conform to the format, the information entered by the user is considered illegal. In this scenario, we can also check the validity of the IP address format by matching the regular expression.

File Upload Vulnerability

The file upload vulnerability is one of the most serious vulnerabilities in Web applications, because hackers can directly obtain website permissions by uploading Webshell files, thus laying the foundation for further penetration attacks. Serious vulnerabilities can also be seen in the DVWA program, because the sample code of the high security level provided by the DVWA program is still bypassed, next we will analyze the file upload vulnerability with the DVWA code.

First, we will analyze the low-security-level code, as shown in Figure 21.

Figure 21

From the code, we found that after the program obtains the data content Information uploaded by the user, it moves the uploaded file to the hackable/uploads/folder without filtering the file type and content. In other words, hackers can directly upload a Webshell written in PHP to the website directory through the file upload function, as shown in Figure 22. They can directly upload the PHP file to obtain the Webshell.

Figure 22

This low-security upload vulnerability is quite dangerous. Next, let's take a look at how the security-level code is implemented. The core code for uploading the medium security level is shown in 23.

Figure 23

From the code, we found that the type and size of uploaded files are filtered during the program processing process. However, we have introduced this in our previous article on the Upload Vulnerability attack, it is easy for hackers to filter MIME types. by uploading and capturing packets, hackers can modify the Data Length and MIME Type in the data packet to the specified image/jpeg type, then, you can easily bypass the re-submission through data packet submission tools such as NC. As shown in Figure 24, code for the central security level is bypassed.

Figure 24

In this vulnerability scenario, the high-security code provided by the DVWA program is also bypassed by hackers. Shows the core code for uploading a file with a high security level.

Figure 25

From the code, we found that the security check in the high security level code is performed by detecting the filename extension. First, after the program obtains the File Uploaded by the user, it will check that the file hits the rightmost one. then, determine whether the content is in the format of jpg/JPG/jpeg/JPEG. if the content is in the form of an image, move the file to the hackable/uploads/folder. However, this filtering method still has the possibility of being bypassed. Because the file name is completely consistent with the features of the normal file for filtering check, this method can be used to conveniently bypass and obtain an executable Webshell by using the parsing vulnerability, as shown in Figure 26.

Figure 26

Therefore, for this file upload scenario, it is better to filter the files to be saved by randomizing the names of the files. Because the uploaded content is an image, you should first define the format of the image suffix generated when moving the file to prevent various possible upload attacks. For security protection against File Upload vulnerabilities, refer to my previous article "Analysis of File Upload Attack and Defense in Web Attack and Defense series".

Summary

In the DVWA program, security vulnerabilities that can be demonstrated include not only those. Due to space reasons, this article only selects several representative security vulnerabilities for analysis and description, security Vulnerability prevention is also analyzed. In the current Internet environment, most websites are built and operated using open-source Web applications, and such open-source Web applications are vulnerable to hacker attacks, this vulnerability is also one of the focuses of hackers. Therefore, after having a certain understanding of code security analysis, the security audit of your website code will undoubtedly bring more security protection to the website, so that the website can operate securely and stably.