WEB应用安培全训.ppt

验证不充分之文件包含 易受攻击的代码片断： ?php $content = $_GET[content]; include($content); ? 攻击者用如下请求可以包含图片木马： /test.php?content=x.jpg Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 验证不充分之任意文件读取 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 验证不充分之变量覆盖 易受攻击的代码片段： ?php if ($pass == hello) { $auth = 1; } Parse_str($_SERVER[QUERY_STRING]?); if ($auth == 1) { echo some important information; } ? 上面的代码首先检查用户的密码是否为hello，如果匹配的话，设置$auth 为1，即通过认证。之后如果$suth为1的话，就会显示一些重要信息。 这段代码假定$auth在没有设置值的时候是空的，但是攻击者可以创建任何 全局变量并赋值，通过类似/test.php?auth=1的方法，我 们完全可以欺骗这段代码，使它相信我们是已经认证过的。 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 逻辑漏洞 不同的用户错误 判断出存在admin用户 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 逻辑漏洞 找回密码设计缺陷 修改任意用户密码 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 解析漏洞 IIS 6.0解析漏洞 ①目录解析 /test.asp/test.jpg ②文件解析 /test.asp;1.jpg IIS6.0 默认的可执行文件除了asp还包含这三种 ①/test.asa ②/test.cer ③/test.cdx Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 解析漏洞 Apache解析漏洞 Apache 是从右到左开始判断解析，如果为不 可识别解析，就再往左判断。 /test.php.xxx /test.php.rar Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 解析漏洞 Nginx解析漏洞 影响版本:0.5.,0.6., 0.7 = 0.7.65, 0.8 = 0.8.37 /test.jpg/1.php /test.jpg%00.php Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. WEB应用安全培训 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 常见WEB漏洞 常见WEB后门介绍 Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile . Copyright 2004-2011 Aspose Pty Ltd. 漏洞名称 SQL注入 跨站脚本攻