本文共 1645 字，大约阅读时间需要 5 分钟。

PHP ????????

??Web??????PHP ???????????????????????????????????????????????????????

1. PHP ????

?????

• ????? ??????????????????????
• ??? {<!-- #exec cmd="ls -a" -->}

?????

• ???????????safe_mode???
• ??tidy???????????????<script>???

2. SSI ??

?????

• ??? ?????SSI?Server-side Includes??????????????
• ????? ??<!--#exec cmd="??" -->???????

?????

• ??SSI?????????????????????

3. ??????

?????

• ??? ??unserialize()???????????
• ???? ??????????????????????

?????

• ??PHP_INT_MAX???????????
• ??php.ini??serialize_callback??????????

4. RCE????????

?????

• ????? ??eval()?exec()?system()?????????
• ??? assert(eval($_POST[1]))

?????

• ??eval()?exec()????????????????
• ??PHP?safe_mode??????????

5. SQL ??

?????

• ????? ???.escape()???????SQL???????
• ??? 1 union all select * from users

?????

• ???????? prepared statements???????SQL?
• ?????????PHP?PDO??????

6. XSS??????

?????

• ????? ??<script>???????????
• ??? <script>alert(document.cookie)</script>

?????

• HTML-encode???????<, >, &???????
• ????????????OWASP ZAP??XSS???

7. PHP ????

?????

• ??? ??phpinfo()?????????
• ????? ??phpinfo()???????????????

?????

• ??phpinfo()????????????????????
• ????php.ini?????????????????

8. ??????

?????

• ??? ??php://filter/read=convert.base64-decode/resource=index.php
• ????? ??????????Web????

?????

• ??php://filter??????display_errors = Off?
• ???????????????????????

9. SQL LAG??????

?????

• ??? case when 1 then sleep(3) else 0 end
• ????? ????????????????????

?????

• ??????slow_query_log???????
• ???????????max_execution_time?time_limit?

10. RCE bypass???RCE???

?????

• ??? ??__call()???????????
• ????? ??????????????????

?????

• ??Safe Mode??????????
• ????PHP????????????????

?????????PHP ????????????Web ??????????????????

转载地址：http://nkawz.baihongyu.com/