Php manish

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables

PHP Tainted variables Application Client host Web browser Application Server host Web server user dbms Applications written in HTML, Javascript, Java, (Flash, pdf, doc, ppt) Applications written in PHP, ASP, Java, Perl, Ruby, Haskell, (SQL, Shell) Server Client

[object Object],[object Object],[object Object],PHP Tainted variables <html> <body> <?php echo " Hello, " . $_GET[ ' name ' ] ; ?> Static hypertext... </body> </html> Hello, Wietse Static hypertext...

[object Object],[object Object],[object Object],PHP Tainted variables

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables

[object Object],[object Object],[object Object],PHP Tainted variables select * from users where username= ' $username ' and password= ' $password ' Username: admin Password: ' or 1=1 -- select * from users where username= ' admin ' and password= ' ' or 1=1 -- ' Now it is data Now it is executable code

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables ' " nul

[object Object],[object Object],PHP Tainted variables

[object Object],[object Object],PHP Tainted variables source =request “ Wietse ” status=tainted operator=concat propagate taint source =script “ Hello, ” status=clean “ Hello, Wietse ” status=tainted sink =echo detect taint Note: this is the simplest way to propagate taint

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables Warning: echo(): Argument contains data that is not converted with htmlspecialchars() or htmlentities() in /path/to/script on line X

PHP Tainted variables source=network “ Wietse ” status=tainted operator=concat propagate taint source=script “ Hello, ” status=clean “ Hello, Wietse ” status=clean sink=echo detect taint “ Wietse ” status=clean conversion= htmlentities convert data, remove taint Script: echo " Hello, " . html-entities ($_GET[ ' name ' ]); Request : GET /hello.php? name=Wietse

PHP Tainted variables 1 Configurable Taint flavor Source mark policy 1 Conversion function Sink detect policy 1 TC_HTML Input from web or database htmlspecialchars htmlemtities HTML output TC_MYSQL Input from web or database mysql_escape_string mysql_real_escape_string MySQL query TC_SHELL Input from web or database escapeshellcmd escapeshellarg Shell command TC_SELF Input from web untaint($var, TC_SELF) include, eval, ... TC_USER1 TC_USER2 application dependent untaint($var, TC_SELF) application dependent

[object Object],[object Object],[object Object],PHP Tainted variables mysql_query( " select * from users where name= " . mysql_real_escape_string($name) . " and .. if (ctype_alnum($name)) { mysql_query( " select * from users where name=$name ...

[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables

[object Object],[object Object],[object Object],PHP Tainted variables if (op->taint1 || op2->taint) result->taint = (op1->taint | op2->taint); else result->taint = 0; result->taint = (op1->taint | op2->taint);

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],PHP Tainted variables

[object Object],PHP Tainted variables

Php manish

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Php manish

Ähnlich wie Php manish (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Php manish