What are the main attack methods for PHP websites?

Specify the prefix of environment variables that PHP programs can change, for example, safe_mode_allowed_env_vars = PHP _. if the value of this option is blank, php can change any environment variable.

1. Command Injection)

2. eval Injection)

3. Script Insertion)

4. Cross-Site Scripting (XSS)

5. SQL injection attacks)

6. Cross-Site Request forgery (CSRF)

7. Session Hijacking)

8. Session Fixation)

9. HTTP Response Splitting attack (HTTP Response Splitting)

10. File Upload Attack)

11. Directory Traversal vulnerability (Directory Traversal)

12. Remote file Inclusion attack)

13. Dynamic function injection (Dynamic Variable Evaluation)

14. URL attack)

15. Form submission spoofing attack (Spoofed Form Submissions)

16. HTTP request spoofing attack (Spoofed HTTP Requests)

In the future, the principles and defense methods of these vulnerabilities will be introduced one by one in each issue.

Several important php. ini options

Register Globals

Php> = 4.2.0, php. the default value of the register_globals option of ini is Off. when register_globals is set to On, the program can receive various environment variables from the server, including the variables submitted by the form, in addition, PHP does not need to initialize the variable value in advance, which leads to great security risks.

Example 1:

// Check_admin () is used to check the permissions of the current user. if the $ is_admin variable is set to true in admin, the following checks whether the variable is true and then performs some management operations.

// Ex1.php

If (check_admin ())
{
$ Is_admin = true;
}
If ($ is_admin)
{
Do_something ();
}
?>

This code section does not initialize $ is_admin to Flase in advance. if register_globals is On, then we directly submit the http://www.sectop.com/ex1.php? If is_admin = true, the check_admin () verification can be bypassed.

Example 2:

// Ex2.php

If (isset ($ _ SESSION ["username"])
{
Do_something ();
}
Else
{
Echo "you have not logged on !";
}
?>

When register_globals = On, we submit = dodo] http://www.sectop.com/ex2.php? _ SESSION [username] = dodo, which grants permissions to this user

Therefore, regardless of register_globals, we must remember that any transmitted data must be carefully verified and the variables must be initialized.

Safe_mode

Security mode. PHP is used to restrict access to documents, access to environment variables, and control execution of external programs. To enable security mode, you must set safe_mode = On in php. ini.

1. restrict file access

Safe_mode_include_dir = "/path1:/path2:/path3 ″

Different folders are separated by colons.

2. restrict access to environment variables

Safe_mode_allowed_env_vars = string

Specify the prefix of environment variables that PHP programs can change, for example, safe_mode_allowed_env_vars = PHP _. if the value of this option is blank, php can change any environment variable.

Safe_mode_protected_env_vars = string

Used to specify the prefix of environment variables that php programs cannot change

3. restrict execution of external programs

Safe_mode_exec_dir = string

The folder path specified by this option affects system, exec, popen, and passthru, but does not affect shell_exec and ''.

Disable_functions = string

Different function names are separated by commas (,). This option is not affected by the security mode.

Magic quotes

It is used to automatically escape input information of php programs. all single quotes ("'"), double quotes ("), backslash (" \ "), and NULL characters (NULL ), are automatically added with a backslash to escape

Magic_quotes_gpc = On is used to set magic quotes to On, which affects the data (GET, POST, Cookies) of HTTP requests)

Programmers can also use addslashes to escape the submitted HTTP request data, or use stripslashes to delete the escape