#\u51b7\u591c@upker.net
\nFrom:http:\/\/www.bhst.org & http:\/\/upker.net
\n\u6587\u7ae0\u4ec5\u4e3a\u4e00\u6bb5\u65f6\u95f4\u6574\u7406\u7684\u7b14\u8bb0\u603b\u7ed3\uff0c\u4e00\u4e2a\u5206\u6790\u6846\u67b6\uff0c\u6ca1\u6709\u5b9e\u4f8b\u5316\u5206\u6790<\/p>\n
0x01 \u5de5\u5177\u7bc7<\/span><\/strong> 0x02 \u51fd\u6570\u7bc7<\/span><\/strong> require\u5728\u88ab\u5305\u542b\u6587\u4ef6\u6709\u9519\u8bef\u4ee3\u7801\u65f6\u5c06\u4e0d\u518d\u5f80\u4e0b\u6267\u884c htmlspecialchars() \u51fd\u6570\u628a\u4e00\u4e9b\u9884\u5b9a\u4e49\u7684\u5b57\u7b26\u8f6c\u6362\u4e3a HTML \u5b9e\u4f53\u3002 move_uploaded_file() \u51fd\u6570\u5c06\u4e0a\u4f20\u7684\u6587\u4ef6\u79fb\u52a8\u5230\u65b0\u4f4d\u7f6e\u3002<\/p>\n extract() \u51fd\u6570\u4ece\u6570\u7ec4\u4e2d\u628a\u53d8\u91cf\u5bfc\u5165\u5230\u5f53\u524d\u7684\u7b26\u53f7\u8868\u4e2d\u3002 parse_str() \u51fd\u6570\u628a\u67e5\u8be2\u5b57\u7b26\u4e32\u89e3\u6790\u5230\u53d8\u91cf\u4e2d. \uff08\u5e38\u89c1\u4e8e\u53d8\u91cf\u8986\u76d6\u6f0f\u6d1e\uff09 \u9488\u5bf9\u53d8\u91cf\u6307\u5b9a\u653b\u51fb eval() \u51fd\u6570\u628a\u5b57\u7b26\u4e32\u6309\u7167 PHP \u4ee3\u7801\u6765\u8ba1\u7b97\u3002\u8be5\u5b57\u7b26\u4e32\u5fc5\u987b\u662f\u5408\u6cd5\u7684 PHP \u4ee3\u7801\uff0c\u4e14\u5fc5\u987b\u4ee5\u5206\u53f7\u7ed3\u5c3e\u3002 preg_replace \u6267\u884c\u4e00\u4e2a\u6b63\u5219\u8868\u8fbe\u5f0f\u7684\u641c\u7d22\u548c\u66ff\u6362 0x03 \u6f0f\u6d1e\u7bc7<\/span><\/strong> \u5982\u679c\u4e00\u4e2a\u7f51\u7ad9\u63a5\u53d7\u8bf7\u6c42\u5730\u65b9\u6bd4\u8f83\u591a\uff0c\u5219\u5728\u6bcf\u6b21\u9875\u9762\u52a0\u8f7d\u65f6\u904d\u5386\u6574\u4e2adom\u6811\uff0c\u5728dom\u4e2d\u6bcf\u4e2aa\u548cform\u6807\u7b7e\u540e\u52a0\u5165token 0x04 \u914d\u7f6e\u7bc7<\/span><\/strong> 0x05 \u601d\u8def\u7bc7<\/span><\/strong> 0x06 \u5c0f\u7ed3<\/span><\/strong>
\n\u7f16\u8f91\u5668(notepad++,editplus,UE\u7b49\u7b49,\u770b\u4e2a\u4eba\u4e60\u60ef)
\nTommSearch(\u5b57\u7b26\u4e32\u68c0\u7d22) || grep
\nHttpProtocolDebugger(http\u534f\u8bae\u8c03\u8bd5\u5668)
\nFiddler(\u5206\u6790\u5305,\u6539\u5305)
\nSeay PHP\u4ee3\u7801\u5ba1\u8ba1\u5de5\u5177(php-code-audit\u5206\u6790\u8f85\u52a9)
\n\u51e0\u4e2a\u6709\u8da3\u7684\u9879\u76ee
\ndvwa(\u4ee3\u7801\u5ba1\u8ba1\u6d4b\u8bd5\u5e73\u53f0)
\nphpmvs
\nphp security audit check
\nPHP Vulnerability Hunter<\/p>\n
\naddslashed()\u6dfb\u52a0\u53cd\u659c\u6760
\nstripslashed()\u53bb\u6389\u53cd\u659c\u6760
\nget_magic_quotes_gpc() \u5224\u65ad\u662f\u5426\u5f00\u542fgpc
\nexpode(“.”,$array)\u5206\u5272\u6210\u6570\u7ec4
\nis_numeric()\u5224\u65ad\u662f\u5426\u4e3a\u6570\u5b57
\nsizeof()\u5224\u65ad\u957f\u5ea6
\ntrim() \u53bb\u9664\u5b57\u7b26\u4e32\u5f00\u5934\u548c\u672b\u5c3e\u7684\u7a7a\u683c\u6216\u5176\u4ed6\u5b57\u7b26
\nsystem() \u8f93\u51fa\u5e76\u8fd4\u56de\u6700\u540e\u4e00\u884cshell\u7ed3\u679c\u3002
\nexec() \u4e0d\u8f93\u51fa\u7ed3\u679c\uff0c\u8fd4\u56de\u6700\u540e\u4e00\u884cshell\u7ed3\u679c\uff0c\u6240\u6709\u7ed3\u679c\u53ef\u4ee5\u4fdd\u5b58\u5230\u4e00\u4e2a\u8fd4\u56de\u7684\u6570\u7ec4\u91cc\u9762\u3002
\npassthru() \u53ea\u8c03\u7528\u547d\u4ee4\uff0c\u628a\u547d\u4ee4\u7684\u8fd0\u884c\u7ed3\u679c\u539f\u6837\u5730\u76f4\u63a5\u8f93\u51fa\u5230\u6807\u51c6\u8f93\u51fa\u8bbe\u5907\u4e0a\u3002
\nEscapeShellCmd(),\u628a\u4e00\u4e2a\u5b57\u7b26\u4e32\u4e2d\u6240\u6709\u53ef\u80fd\u7792\u8fc7Shell\u800c\u53bb\u6267\u884c\u53e6\u5916\u4e00\u4e2a\u547d\u4ee4\u7684\u5b57\u7b26\u8f6c\u4e49\u3002\u8fd9\u4e9b\u5b57\u7b26\u5728Shell\u4e2d\u662f\u6709\u7279\u6b8a\u542b\u4e49\u7684\uff0c\u8c61\u5206\u53f7\uff08;\uff09\uff0c\u91cd\u5b9a\u5411\uff08>\uff09\u548c\u4ece\u6587\u4ef6\u8bfb\u5165 \uff08<\uff09\u7b49\u3002
\nEscapeShellArg() \u3002\u5728\u7ed9\u5b9a\u7684\u5b57\u7b26\u4e32\u4e24\u8fb9\u52a0\u4e0a\u5355\u5f15\u53f7\uff0c\u5e76\u628a\u5b57\u7b26\u4e32\u4e2d\u7684\u5355\u5f15\u53f7\u8f6c\u4e49\uff0c\u8fd9\u6837\u8fd9\u4e2a\u5b57\u7b26\u4e32\u5c31\u53ef\u4ee5\u5b89\u5168\u5730\u4f5c\u4e3a\u547d\u4ee4\u7684\u53c2\u6570\u3002
\n\u7528popen()\u51fd\u6570\u6253\u5f00\u8fdb\u7a0b
\n\u4e0a\u9762\u7684\u65b9\u6cd5\u53ea\u80fd\u7b80\u5355\u5730\u6267\u884c\u547d\u4ee4\uff0c\u5374\u4e0d\u80fd\u4e0e\u547d\u4ee4\u4ea4\u4e92\u3002\u4f46\u6709\u4e9b\u65f6\u5019\u5fc5\u987b\u5411\u547d\u4ee4\u8f93\u5165\u4e00\u4e9b\u4e1c\u897f\uff0c\u5982\u5728\u589e\u52a0Linux\u7684\u7cfb\u7edf\u7528\u6237\u65f6\uff0c\u8981\u8c03\u7528su\u6765\u628a\u5f53\u524d\u7528\u6237\u6362\u5230root\u624d\u884c\uff0c\u800csu\u547d\u4ee4\u5fc5\u987b\u8981\u5728\u547d\u4ee4\u884c\u4e0a\u8f93\u5165root\u7684\u5bc6\u7801\u3002\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u7528\u4e0a\u9762\u63d0\u5230\u7684\u65b9\u6cd5\u663e\u7136\u662f\u4e0d\u884c\u7684\u3002
\npopen ()\u51fd\u6570\u6253\u5f00\u4e00\u4e2a\u8fdb\u7a0b\u7ba1\u9053\u6765\u6267\u884c\u7ed9\u5b9a\u7684\u547d\u4ee4\uff0c\u8fd4\u56de\u4e00\u4e2a\u6587\u4ef6\u53e5\u67c4\u3002\u65e2\u7136\u8fd4\u56de\u7684\u662f\u4e00\u4e2a\u6587\u4ef6\u53e5\u67c4\uff0c\u90a3\u4e48\u5c31\u53ef\u4ee5\u5bf9\u5b83\u8bfb\u548c\u5199\u4e86\u3002\u5728PHP3\u4e2d\uff0c\u5bf9\u8fd9\u79cd\u53e5\u67c4\u53ea\u80fd\u505a\u5355\u4e00 \u7684\u64cd\u4f5c\u6a21\u5f0f\uff0c\u8981\u4e48\u5199\uff0c\u8981\u4e48\u8bfb\uff1b\u4ecePHP4\u5f00\u59cb\uff0c\u53ef\u4ee5\u540c\u65f6\u8bfb\u548c\u5199\u4e86\u3002\u9664\u975e\u8fd9\u4e2a\u53e5\u67c4\u662f\u4ee5\u4e00\u79cd\u6a21\u5f0f\uff08\u8bfb\u6216\u5199\uff09\u6253\u5f00\u7684\uff0c\u5426\u5219\u5fc5\u987b\u8c03\u7528pclose()\u51fd\u6570\u6765\u5173\u95ed \u5b83\u3002
\n\u4f8b\u5b501\uff1a
\n\/* PHP\u4e2d\u5982\u4f55\u589e\u52a0\u4e00\u4e2a\u7cfb\u7edf\u7528\u6237
\n\u4e0b\u9762\u662f\u4e00\u6bb5\u4f8b\u7a0b\uff0c\u589e\u52a0\u4e00\u4e2a\u540d\u5b57\u4e3ajames\u7684\u7528\u6237,
\nroot\u5bc6\u7801\u662f verygood\u3002\u4ec5\u4f9b\u53c2\u8003
\n*\/
\n$sucommand = “su –login root –command”;
\n$useradd = “useradd “;
\n$rootpasswd = “verygood”;
\n$user = “james”;
\n$user_add = sprintf(“%s “%s %s””,$sucommand,$useradd,$user);
\n$fp = @popen($user_add,”w”);
\n@fputs($fp,$rootpasswd);
\n@pclose($fp);<\/p>\n
\ninclude\u5728\u88ab\u5305\u542b\u6587\u4ef6\u6709\u9519\u8bef\u4ee3\u7801\u65f6\u4ecd\u7136\u5f80\u4e0b\u6267\u884c<\/p>\n
\n\u9884\u5b9a\u4e49\u7684\u5b57\u7b26\u662f\uff1a
\n& \uff08\u548c\u53f7\uff09 \u6210\u4e3a &
\n” \uff08\u53cc\u5f15\u53f7\uff09 \u6210\u4e3a ”
\n‘ \uff08\u5355\u5f15\u53f7\uff09 \u6210\u4e3a ‘
\n< \uff08\u5c0f\u4e8e\uff09 \u6210\u4e3a <
\n> \uff08\u5927\u4e8e\uff09 \u6210\u4e3a ><\/p>\n
\n\u5bf9\u4e8e\u6570\u7ec4\u4e2d\u7684\u6bcf\u4e2a\u5143\u7d20\uff0c\u952e\u540d\u7528\u4e8e\u53d8\u91cf\u540d\uff0c\u952e\u503c\u7528\u4e8e\u53d8\u91cf\u503c\u3002
\n\u7b2c\u4e8c\u4e2a\u53c2\u6570 type \u7528\u4e8e\u6307\u5b9a\u5f53\u67d0\u4e2a\u53d8\u91cf\u5df2\u7ecf\u5b58\u5728\uff0c\u800c\u6570\u7ec4\u4e2d\u53c8\u6709\u540c\u540d\u5143\u7d20\u65f6\uff0cextract() \u51fd\u6570\u5982\u4f55\u5bf9\u5f85\u8fd9\u6837\u7684\u51b2\u7a81\u3002
\n\u672c\u51fd\u6570\u8fd4\u56de\u6210\u529f\u8bbe\u7f6e\u7684\u53d8\u91cf\u6570\u76ee\u3002
\n\u8bed\u6cd5
\nextract(array,extract_rules,prefix)<\/p>\n
\n\u8bed\u6cd5
\nparse_str(string,array)
\n\u53c2\u6570 \u63cf\u8ff0
\nstring \u5fc5\u9700\u3002\u89c4\u5b9a\u8981\u89e3\u6790\u7684\u5b57\u7b26\u4e32\u3002
\narray \u53ef\u9009\u3002\u89c4\u5b9a\u5b58\u50a8\u53d8\u91cf\u7684\u6570\u7ec4\u540d\u79f0\u3002\u8be5\u53c2\u6570\u6307\u793a\u53d8\u91cf\u5b58\u50a8\u5230\u6570\u7ec4\u4e2d\u3002<\/p>\n
\n\u4e0d\u4f7f\u7528foreach\u904d\u5386$_GET\u53d8\u91cf\uff0c\u6539\u7528$_GET[(index)]<\/p>\n
\n\u5982\u679c\u6ca1\u6709\u5728\u4ee3\u7801\u5b57\u7b26\u4e32\u4e2d\u8c03\u7528 return \u8bed\u53e5\uff0c\u5219\u8fd4\u56de NULL\u3002\u5982\u679c\u4ee3\u7801\u4e2d\u5b58\u5728\u89e3\u6790\u9519\u8bef\uff0c\u5219 eval() \u51fd\u6570\u8fd4\u56de false\u3002<\/p>\n
\n\/e\u53c2\u6570\u6267\u884c\u4ee3\u7801<\/p>\n
\n———————————————–
\n[1].Sql-Injection<\/span><\/strong>
\n\u7559\u610f:cookie\u53cax-forward-for\uff0c\u5bbd\u5b57\u8282\uff0c\u62a5\u9519\u6ce8\u5c04\u7b49
\n\u6316\u6398\u6f0f\u6d1e\u53c2\u8003
\n\u53d8\u91cf
\n$_GET[“”],$_POST[“”],$_COOKIE[“”], $SERVER[“”]
\n\u6570\u636e\u5e93\u64cd\u4f5c\u51fd\u6570
\nmysql_query()
\n\u6570\u5b57\u578b\u6ce8\u5165\u9632\u8303\uff1a
\n1.is_numeric() ctype_digit() intval()
\n2.str_length()\u786e\u5b9a\u957f\u5ea6
\n\u5b57\u7b26\u578b\u6ce8\u5165\u9632\u8303\uff1a
\n1.mysql_real_escape_string()
\n2.\u6570\u636e\u5e93\u67e5\u8be2\u8bed\u53e5\u524d\u52a0@\u9632\u7206\u9519
\n3.str_length()\u786e\u5b9a\u957f\u5ea6
\n———————————————–
\n[2].Command-Execution<\/span><\/strong>
\n\u51fd\u6570\uff1a
\nsystem(),passthru(),popen(),exec()
\n\u6570\u636e\u5e93\u64cd\u4f5c\u51fd\u6570\uff1a
\nexec,system,popen,passthru,proc_open,shell_exec
\n\u6267\u884c\u547d\u4ee4\u7ba1\u9053\u7b26 % | >
\n\u6d4b\u8bd5\u59820 | dir c:
\n|| \u53cc\u7ad6\u7ebf\u7684\u4f5c\u7528\uff0c\u524d\u9762\u8bed\u53e5\u6267\u884c\u9519\u8bef\u5219\u6267\u884c\u540e\u9762\u8bed\u53e5
\n\u5982xx”+||+whoami+||+echo
\n———————————————–
\n[3].File-Inclusion<\/span><\/strong>
\n\u51fd\u6570\uff1a
\ninclude(),require(),include_once(),require_once()
\n\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u8981\u6c42
\nallow_url_fopen() allow_url_include() file_get_contents()
\n\u7ed5\u8fc7\uff1azlib:\/\/\u548cogg:\/\/
\n5.2.0\u4e4b\u540e\u7248\u672c
\ndata:\/\/text\/plain;base64,PD9waHAgcGhwaW5mbygpOz8+ \/\/
\n@eval(file_get_contents(‘php:\/\/input’)); \/\/POST phpinfo();
\n\u914d\u5408%00\u622a\u65ad\uff0c\u65b0\u7248\u672c\u81ea\u52a8\u8f6c\u4e49
\n———————————————–
\n[4].CSRF<\/span><\/strong>
\nCSRF\u9632\u8303\u7b56\u7565
\n1>\u9a8c\u8bc1http-referer\u5b57\u6bb5
\n\u5b89\u5168\u6027\u4f4e\uff0c\u6613\u88ab\u4f2a\u9020
\n2>\u5728\u8bf7\u6c42\u5730\u5740\u4e2d\u6dfb\u52a0token\u5e76\u9a8c\u8bc1
\ntoken\u53ef\u5728\u7528\u6237\u767b\u5f55\u540e\u5b58\u653e\u5728session\u4e2d\uff0c\u6bcf\u6b21\u8bf7\u6c42\u65f6\u5c06token\u4ecesession\u4e2d\u53d6\u51fa\uff0c\u53bb\u8bf7\u6c42\u7684token\u5bf9\u6bd4\u4ee5\u9632\u8303CSRF
\nGET\u65b9\u5f0f:http:\/\/url\/?=token<\/p>\n
\n\u4f46\u5728\u52a8\u6001\u9875\u9762\u52a0\u8f7d\u540e\u4ea7\u751f\u7684html\u4ee3\u7801\uff0c\u5219\u9700\u8981\u4ee5\u786c\u7f16\u7801\u7684\u5f62\u5f0f\u624b\u5de5\u6dfb\u52a0
\n\u8fd9\u79cd\u65b9\u5f0f\u5b89\u5168\u6027\u5f31\u70b9\u5728\u4e8e\uff0c\u5982\u5728\u8bba\u575b\u7b49\u4ea4\u4e92\u6bd4\u8f83\u9891\u7e41\u7684\u5730\u65b9hacker\u53ef\u6784\u9020\u73af\u5883\u76d7\u53d6token\u5e76\u8fdb\u800c\u6784\u9020csrf\u653b\u51fb
\n\u6545\u624b\u5de5\u5173\u95edreferer
\n3>\u5728HTTP\u5934\u4e2d\u81ea\u5b9a\u4e49\u5c5e\u6027\u5e76\u8fdb\u884c\u9a8c\u8bc1\u3002\u901a\u8fc7XMLHttpRequest\u7c7b\u3002
\n\u901a\u5e38\u7528\u4e8eAjax\u65b9\u6cd5\u5bf9\u9875\u9762\u5c40\u90e8\u7684\u5f02\u6b65\u5237\u65b0
\n\u4f46\u9002\u5e94\u6027\u4e00\u822c\uff0c\u5bf9\u5df2\u6709\u7684\u7f51\u7ad9\u67b6\u6784\u5c40\u9650\u6027\u8f83\u5927
\n———————————————–
\n[5].XSS(Cross Site Script)<\/span><\/strong>
\n\u53cd\u5c04\u578b\u4e0e\u5b58\u50a8\u578b
\n\u63a7\u5236$_GET,$_POST,$_COOKIE \u5404\u79cd\u4f20\u5165\u7684\u53d8\u91cf
\n\u4f7f\u7528htmlspecialchars()\u51fd\u6570\u8fdb\u884c\u57fa\u7840\u8fc7\u6ee4
\n\u7ed3\u5408CSRF\u5b9e\u73b0\u81ea\u52a8\u5316\u5229\u7528
\n———————————————–
\n[6].File_Upload<\/span><\/strong>
\n\u51fd\u6570\uff1amove_uploaded_file()
\n\u53d8\u91cf\uff1a$_FILES
\nphp\u6587\u4ef6\u4e0a\u4f20\u5229\u7528form\u8868\u5355\u8fdb\u884c\u6587\u4ef6\u4e0a\u4f20\u65f6\u5fc5\u987b\u4e3apost\u4f7f\u7528multipart\/form-data\u624d\u80fd\u5b8c\u6574\u7684\u4f20\u9012\u6587\u4ef6\u6570\u636e
\nphp\u5229\u7528$_FILES\u7cfb\u7edf\u51fd\u6570\u7684\u76f8\u5173\u53c2\u6570\u4e0e\u51fd\u6570move_upload_file\u51fd\u6570\u6765\u5b9e\u4f8b\u628a\u7531$_FILES\u5168\u5c40\u53d8\u91cf\u751f\u6210\u7684\u4e34\u65f6\u6587\u4ef6\u79fb\u52a8\u5230\u6307\u5b9a\u76ee\u5f55\u5b8c\u6210\u6587\u4ef6\u7684\u4e0a\u4f20
\n$_FILES[‘files’][‘name’]\u5ba2\u6237\u7aef\u6587\u4ef6\u7684\u539f\u540d\u79f0
\n$_FILES[‘files’][‘type’]\u6587\u4ef6\u7684MIME\u7c7b\u578b
\n$_FILES[‘files’][‘size’]\u5df2\u4e0a\u4f20\u6587\u4ef6\u7684\u5927\u5c0f
\n$_FILES[‘files’][‘tmp_name’]\u50a8\u5b58\u7684\u4e34\u65f6\u6587\u4ef6\u540d\uff0c\u4e00\u822c\u4e3a\u7cfb\u7edf\u9ed8\u8ba4
\n$_FILES[‘files’][‘error’]\u8be5\u6587\u4ef6\u4e0a\u4f20\u5230\u76f8\u5173\u7684\u9519\u8bef\u4ee3\u7801
\n\u9632\u8303\u65b9\u5f0f\uff1a
\n1>\u5224\u65adMIME TYPE\u6587\u4ef6\u7c7b\u578b\u5982$_FILES[‘files’][‘type’]==”image\/jpeg”,\u5224\u65ad\u6587\u4ef6\u5927\u5c0f,\u5982$_FILES[‘files’][‘size’]<10000 && $_FILES[‘files’][‘size’]>100
\n2>\u6307\u5b9a\u4e0a\u4f20\u6587\u4ef6\u540d\uff0c\u5982\u4f9d\u8d56\u65f6\u95f4\u751f\u6210hash(time).jpg\u7b49\u65b9\u5f0f
\n3>\u6839\u636e\u6587\u4ef6\u540e\u7f00\u540d\u5224\u65ad\u6587\u4ef6
\n\u5982file_ext=substr($filename,$strrpos($filename,’.’)+1);
\n\u6ce8\u610f\u662f\u5426\u53ef\u80fd\u6709\u53cc\u6269\u5c55\u540d\uff0c\u4e8c\u6b21\u4e0a\u4f20\u7a81\u7834\u7b49\u903b\u8f91\u95ee\u9898
\n4>\u670d\u52a1\u5668\u5c1d\u8bd5\u6e32\u67d3\u6587\u4ef6\u7b49\u65b9\u5f0f\u5224\u65ad\u662f\u5426\u4e3a\u56fe\u7247
\n5>\u4e0d\u4f9d\u8d56\u4e8e\u5ba2\u6237\u7aefjs\u811a\u672c\u9650\u5236\u4e0a\u4f20\u6587\u4ef6\u7c7b\u578b
\n6>\u767d\u540d\u5355\u89c4\u5219
\napache\u670d\u52a1\u5668\u5e38\u89c1\u4e0a\u4f20\u5b89\u5168\u95ee\u9898
\n1>\u914d\u5408.htaccess\u5229\u7528\u4e0a\u4f20
\nAllOverride ALL \u5141\u8bb8\u5b50\u89c4\u5219\u8986\u76d6\u7236\u89c4\u5219
\n.htaccess\u6dfb\u52a0AddType Application\/x-httpd-php .jpg
\n2>\u6587\u4ef6\u540d\u89e3\u6790\u6f0f\u6d1e
\n*.php.123
\n\u5728.htaccess\u6dfb\u52a0AddHandler php5-script .php\uff0c\u6587\u4ef6\u540d\u4e2d\u5305\u542bphp\u6269\u5c55\u540d\u53ef\u4ee5php\u811a\u672c\u6267\u884c\uff0c\u5982x.php.jpg
\n.php3 .php4\u6269\u5c55\u540d<\/p>\n
\n1>\u5173\u6ce8\u6f0f\u6d1e\u4fe1\u606f,\u53ca\u65f6\u66f4\u65b0\u7248\u672c
\n2>php.ini httpd.conf .htaccess\u6587\u4ef6\u914d\u7f6e
\n1)safe_mode\u76f8\u5173\u914d\u7f6e
\n2)register_globals\u5173\u95ed
\n3)open_basedir\u914d\u7f6e\uff0c\u9632\u8303\u76ee\u5f55\u904d\u5386
\n4)allow_url_fopen\u5173\u95ed
\n5)disable_functions\u914d\u7f6e
\n6)magic_quotes_gpc\u6253\u5f00
\n7)error_reporting=E_ALL & ~E_NOTICE
\n8)display_errors=Off\u907f\u514d\u653b\u51fb\u8005\u83b7\u53d6\u66f4\u591a\u4fe1\u606f
\n9)expose_php=Off\u9690\u85cf\u7248\u672c\u4fe1\u606f
\n3>\u6700\u5c0f\u5316\u670d\u52a1\u5668\u5176\u4ed6\u8d26\u6237\u6743\u9650
\n4>\u7b2c\u4e09\u65b9\u5b89\u5168\u52a0\u56fa\u8f6f\u4ef6\u5b89\u88c5
\n5>\u8c03\u7528\u7b2c\u4e09\u65b9\u5b89\u5168\u9632\u62a4\u6587\u4ef6\uff0c\u914d\u7f6ephp.ini
\ninclude_path=”.:\/php\/includes”
\nauto_pretend_file=”anti-inj.php”
\nauto_appent_file=<\/p>\n
\n\u521a\u5f00\u59cb\u7ec3\u4e60\u5ba1\u8ba1\u65f6\uff0c\u62ff\u5230\u4e00\u5957\u6e90\u7801\uff0c\u9a6c\u4e0a\u505a\u7684\u4e8b\u60c5\u5c31\u662f\uff0c\u4e22\u5230\u5de5\u5177\u91cc\uff0c\u53bb\u626b\u654f\u611f\u7684\u51fd\u6570\uff0c\u7136\u540e\u53bb\u4e00\u4e2a\u4e00\u4e2a\u7684\u56de\u6eaf\u5b83\uff0c\u627e\u5230\u5165\u53e3\u70b9\u3002\u4f46\u662f\uff0c\u8fd9\u6837\u5ba1\u8ba1\u5f88\u6d6a\u8d39\u65f6\u95f4\uff0c\u6bcf\u6b21\u90fd\u8981\u5728\u56de\u6eaf\u8fc7\u7a0b\u4e2d\uff0c\u4e0d\u65ad\u7684\u53bb\u5bfb\u627e\u6e90\u7801\u4e2d\u5b9a\u4e49\u7684\u4e00\u4e9b\u901a\u7528\u51fd\u6570\u3002\u7531\u4e8e\u4e0d\u4e86\u89e3\u6574\u4e2a\u6e90\u7801\u7684\u6d41\u7a0b\uff0c\u5bfc\u81f4\u5728\u627e\u8fd9\u4e9b\u901a\u7528\u51fd\u6570\u7684\u8fc7 \u7a0b\u4e2d\u6d6a\u8d39\u4e86\u5f88\u591a\u7684\u65f6\u95f4\u4e0e\u7cbe\u529b\u3002
\n\u6240\u4ee5\uff0c\u6211\u91cd\u65b0\u8c03\u6574\u4e86\u6211\u7684\u5ba1\u8ba1\u6d41\u7a0b\u3002\u5728\u62ff\u5230\u6e90\u7801\u4e4b\u540e\uff0c\u5148\u4ece\u5b83\u5f00\u59cb\u7684\u5730\u65b9\uff08\u4e00\u822c\u662f\u6839\u76ee\u5f55\u4e0b\u7684index\u6587\u4ef6\uff09\u6309\u7167\u6267\u884c\u7684\u987a\u5e8f\u53bb\u8bfb\u4ee3\u7801\uff0c\u4e00\u76f4\u5230\u5b83\u7684\u521d\u59cb\u5316\u5185\u5bb9\uff0c \u548c\u57fa\u672c\u529f\u80fd\u5b9e\u73b0\u5b8c\u6bd5\u4e3a\u6b62\u3002\u8fd9\u6837\uff0c\u53ef\u4ee5\u660e\u786e\u7684\u4e86\u89e3\u6574\u5957\u6e90\u7801\u7684\u7ed3\u6784\uff0c\u54ea\u4e00\u79cd\u51fd\u6570\u6587\u4ef6\u653e\u5728\u54ea\u4e2a\u6587\u4ef6\u5939\u4e0b\uff1b\u77e5\u9053\u901a\u7528\u51fd\u6570\u653e\u5728\u54ea\u4e2a\u6587\u4ef6\u4e2d\u3002\u8fd9\u5bf9\u6211\u4eec\u5728\u4e4b\u540e\u9605\u8bfb\u201c\u7591\u4f3c\u201d\u6709\u95ee\u9898\u7684\u4ee3\u7801\u65f6\uff0c\u6709\u5f88\u597d\u7684\u5e2e\u52a9\uff0c\u4f8b\u5982\uff0c\u5728\u770b\u5230\u4e00\u4e2a\u901a\u7528\u51fd\u6570\u65f6\uff0c\u6211\u4eec\u53ef\u4ee5\u5feb\u901f\u7684\u5207\u6362\u5230\u901a\u7528\u51fd\u6570\u6587\u4ef6\uff0c\u67e5\u627e\u8fd9\u4e2a\u51fd\u6570\u7684\u5b9e\u73b0\u4ee3\u7801\u3002
\n\u6ce8:\u6b64\u5904\u5f15\u7528\u4fee\u6539\u5510\u95e8\u4e09\u5c11\u6587\u7ae0\u300aPHP\u4ee3\u7801\u5ba1\u8ba1\u5b66\u4e60\u603b\u7ed3\u300b<\/p>\n
\n\u4ee3\u7801\u5ba1\u8ba1\u4e00\u5982\u9006\u5411\u5de5\u7a0b\uff0c\u5747\u9700\u8981\u8010\u5fc3\u4e0e\u7ec6\u5fc3\u3002
\n\u6b64\u5916\uff0c\u5173\u6ce8\u6f0f\u6d1e\u53d1\u5e03\u5e73\u53f0\u4e0a\u6700\u65b0\u6f0f\u6d1e\u5e76\u8ddf\u8e2a\u52a0\u4ee5\u5206\u6790\u4e5f\u662f\u4e00\u4e2a\u5f88\u5feb\u63d0\u5347\u81ea\u5df1\u80fd\u529b\u7684\u65b9\u6cd5\u3002<\/p>\n