考虑下面的login.php
是DVWA:
<?php
define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
dvwaPageStartup( array( 'phpids' ) );
dvwaDatabaseConnect();
if( isset( $_POST[ 'Login' ] ) ) {
// Anti-CSRF
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'login.php' );
$user = $_POST[ 'username' ];
$user = stripslashes( $user );
$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass = $_POST[ 'password' ];
$pass = stripslashes( $pass );
$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass = md5( $pass );
$query = ("SELECT table_schema, table_name, create_time
FROM information_schema.tables
WHERE table_schema='{$_DVWA['db_database']}' AND table_name='users'
LIMIT 1");
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query );
if( mysqli_num_rows( $result ) != 1 ) {
dvwaMessagePush( "First time using DVWA.<br />Need to run 'setup.php'." );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'setup.php' );
}
$query = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );
if( $result && mysqli_num_rows( $result ) == 1 ) { // Login Successful...
dvwaMessagePush( "You have logged in as '{$user}'" );
dvwaLogin( $user );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
}
// Login failed
dvwaMessagePush( 'Login failed' );
dvwaRedirect( 'login.php' );
}
$messagesHtml = messagesPopAllToHtml();
Header( 'Cache-Control: no-cache, must-revalidate'); // HTTP/1.1
Header( 'Content-Type: text/html;charset=utf-8' ); // TODO- proper XHTML headers...
Header( 'Expires: Tue, 23 Jun 2009 12:00:00 GMT' ); // Date in the past
// Anti-CSRF
generateSessionToken();
echo "
<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">
<html xmlns=\"http://www.w3.org/1999/xhtml\">
<head>
<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />
<title>Login :: Damn Vulnerable Web Application (DVWA) v" . dvwaVersionGet() . "</title>
<link rel=\"stylesheet\" type=\"text/css\" href=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/css/login.css\" />
</head>
<body>
<div id=\"wrapper\">
<div id=\"header\">
<br />
<p><img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/login_logo.png\" /></p>
<br />
</div> <!--<div id=\"header\">-->
<div id=\"content\">
<form action=\"login.php\" method=\"post\">
<fieldset>
<label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\"><br />
<label for=\"pass\">Password</label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\"><br />
<br />
<p class=\"submit\"><input type=\"submit\" value=\"Login\" name=\"Login\"></p>
</fieldset>
" . tokenField() . "
</form>
<br />
{$messagesHtml}
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<!-- <img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/RandomStorm.png\" /> -->
</div > <!--<div id=\"content\">-->
<div id=\"footer\">
<p>" . dvwaExternalLinkUrlGet( 'http://www.dvwa.co.uk/', 'Damn Vulnerable Web Application (DVWA)' ) . "</p>
</div> <!--<div id=\"footer\"> -->
</div> <!--<div id=\"wrapper\"> -->
</body>
</html>";
?>
我想得到用户发送给服务器的所有参数,例如当用户输入用户名和密码时,他/她发送这两个参数:“用户名”和“密码”。我编写了一个简单的python脚本,它提供了login.php
中的所有变量:
import re
textfile = open('login.php', 'r')
filetext = textfile.read()
textfile.close()
matches = re.findall("\$[A-Za-z0-9-_'\"\[\] ]+", filetext)
print("\n".join(list(set(matches))))
此脚本的输出为:
$user
$_DVWA['db_database']
$user' AND password
$query
$messagesHtml
$GLOBALS["___mysqli_ston"]
$messagesHtml
$user
$___mysqli_res
$pass'
$query
$_REQUEST[ 'user_token' ]
$result
$_POST[ 'username' ]
$_SESSION[ 'session_token' ]
$_POST[ 'Login' ]
$_POST[ 'password' ]
$pass
但实际上,我并不需要所有的。例如,在$_POST[ 'password' ]
中,我只想获得'password',在$_SESSION[ 'session_token' ]
中,我只想获得'session\u token'。实际上,我想获得所有客户端参数(假设我有ABC['DEF'])。我只想得到文本“DEF”)。我不知道怎么做。你知道吗
目前没有回答
相关问题 更多 >
编程相关推荐