phpd代码审计

*获取源码

*网站结构

*入口文件

*配置文件

*过滤功能

审计方法-通读全文法
disable_functions
disable_classes
safe_mode=off
safe_mode_exec_dir=/var/www/html
file_uploads=on
upload_max_filesize=8M
文件上传目录
upload_tmp_dir=
用户访问目录限制
open_basedir=
display_error=on
error_reporting=E_ALL
error_log=
log_errors=on
log_errors_max_length=1024
magic_quotes_gpc=On
magic_quotes_runtime=Off
allow_url_fopen = on
allow_url_include = Off

常见危险函数及特殊函数

eval()
assert()
preg_replace()
preg_replace("/test/e",$_GET['h'],"just test");
?h=phpinfo(),phpinfo()将会执行

create_function()
call_user_func()
call_func_array()

require
include
require_once
include_once

命令执行函数

exec()
passthru()
proc_open()
shell_exec()
system()
popen()

文件操作函数
copy
file_get_contents
file_put_contents
file
fopen
move_uploaded_file
readfile
rename
rmdir
unlink & delete

特殊函数
phpinfo()
symlink()
getenv()
putenv()
dl()

配置相关
ini_get()
ini_set
ini_alter
ini_restore

数字判断
is_numeric

数组相关
in_array

变量覆盖

parse_str()
mb_parse_str
extract()
import_request_variables()

列目录
glob

无参数获取信息
get_defined_vars
get_defined_constants
get_defined_functions
get_includes_files





allow_url_include=".(ini_get('allow_url_include')?'On':'Off');
echo "\r\n
allow_url_fopen=".(ini_get('allow_url_fopen')?'On':'Off'); echo "\r\n"; include($_GET['v']); */ /* echo shell_exec('ping 127.0.0.1'); echo shell_exec('ping '.$_GET["v"]);//?v=127.0.0.1 | whoami */ /* file_put_contents('fpc.test', 'test'); file_put_contents('fpc.test', file_get_contents("http://www.baidu.com")); unlink('fpc.test'); */ /* var_dump(getenv('test')); putenv('test=123'); echo "\r\ntest=".getenv('test'); */ /* echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off'); ini_set("display_errors", 0); echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off'); */ /* echo "is_numeric :"; var_dump(is_numeric($_GET["v"]));//?v=127' ?v=0e1 ?v=0x123 echo "\r\n"; echo "output :".$_GET["v"]; echo "\r\n"; echo "intval :".intval($_GET["v"]); */ /* $v = 1; var_dump(in_array($v, array("1",2,3))); echo "\r\n";; $a = '1abc'; // '1abc' == 1 in_array($a, array(1,2,3));//in_array($a, array(1,2,3),true); in_array($a, array("2",2,3)); */ /* $str = "first=value&arr[]=foobar&arr[]=baz"; echo "
";
parse_str($str,$array);
print_r($array);

var_dump(isset($first));

parse_str($str);
var_dump(isset($first));
echo "\$arr[0]=$arr[0]";
echo "\$arr[1]=$arr[1]";
*/

/*
echo "
";
print_r(glob("t*.php"));
*/


echo "
";
$test = 'test';
print_r(get_defined_vars());

define("TEST", 'test');
echo "
";
print_r(get_defined_constants(true));

function abc(){}
print_r(get_defined_functions());
 ?>
';
    exit;
}

function webshell(){
    echo "this is a test";
}

Xdebug的配置PHP.ini

xdebug.auto_trace = 1
xdebug.trace_format = 0
xdebug.trace_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.trace_options = 0

xdebug.collect_params = 4
xdebug.collect_return = 1
xdebug.collect_vars = 1
xdebug.collect_assignments = 1

xdebug.profiler_append = 0
xdebug.profiler_enable = 1
xdebug.profiler_enable_trigger = 0
xdebug.profiler_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.profiler_output_name = "cache.out.%t-%s"

xdebug.remote_enable = 1
xdebug.remote_handler = "dbgp"
xdebug.remote_host = "127.0.0.1"
zend_extension="D:\phpStudy\php\php-5.4.45\ext\php_xdebug.dll"

你可能感兴趣的:(phpd代码审计)