*获取源码
*网站结构
*入口文件
*配置文件
*过滤功能
审计方法-通读全文法
disable_functions
disable_classes
safe_mode=off
safe_mode_exec_dir=/var/www/html
file_uploads=on
upload_max_filesize=8M
文件上传目录
upload_tmp_dir=
用户访问目录限制
open_basedir=
display_error=on
error_reporting=E_ALL
error_log=
log_errors=on
log_errors_max_length=1024
magic_quotes_gpc=On
magic_quotes_runtime=Off
allow_url_fopen = on
allow_url_include = Off
常见危险函数及特殊函数
eval()
assert()
preg_replace()
preg_replace("/test/e",$_GET['h'],"just test");
?h=phpinfo(),phpinfo()将会执行
create_function()
call_user_func()
call_func_array()
require
include
require_once
include_once
命令执行函数
exec()
passthru()
proc_open()
shell_exec()
system()
popen()
文件操作函数
copy
file_get_contents
file_put_contents
file
fopen
move_uploaded_file
readfile
rename
rmdir
unlink & delete
特殊函数
phpinfo()
symlink()
getenv()
putenv()
dl()
配置相关
ini_get()
ini_set
ini_alter
ini_restore
数字判断
is_numeric
数组相关
in_array
变量覆盖
parse_str()
mb_parse_str
extract()
import_request_variables()
列目录
glob
无参数获取信息
get_defined_vars
get_defined_constants
get_defined_functions
get_includes_files
= $tag_var?>
allow_url_include=".(ini_get('allow_url_include')?'On':'Off');
echo "\r\n
allow_url_fopen=".(ini_get('allow_url_fopen')?'On':'Off');
echo "\r\n";
include($_GET['v']);
*/
/*
echo shell_exec('ping 127.0.0.1');
echo shell_exec('ping '.$_GET["v"]);//?v=127.0.0.1 | whoami
*/
/*
file_put_contents('fpc.test', 'test');
file_put_contents('fpc.test', file_get_contents("http://www.baidu.com"));
unlink('fpc.test');
*/
/*
var_dump(getenv('test'));
putenv('test=123');
echo "\r\ntest=".getenv('test');
*/
/*
echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off');
ini_set("display_errors", 0);
echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off');
*/
/*
echo "is_numeric :";
var_dump(is_numeric($_GET["v"]));//?v=127' ?v=0e1 ?v=0x123
echo "\r\n";
echo "output :".$_GET["v"];
echo "\r\n";
echo "intval :".intval($_GET["v"]);
*/
/*
$v = 1;
var_dump(in_array($v, array("1",2,3)));
echo "\r\n";;
$a = '1abc'; // '1abc' == 1
in_array($a, array(1,2,3));//in_array($a, array(1,2,3),true);
in_array($a, array("2",2,3));
*/
/*
$str = "first=value&arr[]=foobar&arr[]=baz";
echo "";
parse_str($str,$array);
print_r($array);
var_dump(isset($first));
parse_str($str);
var_dump(isset($first));
echo "\$arr[0]=$arr[0]";
echo "\$arr[1]=$arr[1]";
*/
/*
echo "";
print_r(glob("t*.php"));
*/
echo "";
$test = 'test';
print_r(get_defined_vars());
define("TEST", 'test');
echo "";
print_r(get_defined_constants(true));
function abc(){}
print_r(get_defined_functions());
?>
';
exit;
}
function webshell(){
echo "this is a test";
}
Xdebug的配置PHP.ini
xdebug.auto_trace = 1
xdebug.trace_format = 0
xdebug.trace_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.trace_options = 0
xdebug.collect_params = 4
xdebug.collect_return = 1
xdebug.collect_vars = 1
xdebug.collect_assignments = 1
xdebug.profiler_append = 0
xdebug.profiler_enable = 1
xdebug.profiler_enable_trigger = 0
xdebug.profiler_output_dir="D:\phpStudy\tmp\xdebug"
xdebug.profiler_output_name = "cache.out.%t-%s"
xdebug.remote_enable = 1
xdebug.remote_handler = "dbgp"
xdebug.remote_host = "127.0.0.1"
zend_extension="D:\phpStudy\php\php-5.4.45\ext\php_xdebug.dll"