search
Homephp教程php手册php allow_url_include的应用和解释

php allow_url_include的应用和解释

Jun 13, 2016 pm 12:17 PM
includephpurlreasonandexistSafetyapplicationsuggestionofResearchersexplainthis

因为这个原因,许多安全研究人员建议在php.ini配置中禁用指向allow_url_fopen。不幸的是,许多推荐这种方法的人,并没有意识到,这样会破坏很多的应用并且并不能保证100%的解决remote URL includes以及他带来的不安全性。

通常,用户要求在他们使用其他的文件系统函数的时候,php允许禁止URL包含和请求声明支持。

因为这个原因,计划在PHP6中提供allow_url_include。在这些讨论之后,这些特性在php5.2.0 中被backported。现在大多数的安全研究人员已经改变了他们的建议,只建议人们禁止allow_url_include。

不幸的是,allow_url_fopen和allow_url_include并不是导致问题的原因。一方面来说在应用中包含本地文件仍然是一件足够危险的事情,因为攻击者经常通过sessiondata, fileupload, logfiles,...等方法获取php代码………

另一方面allow_url_fopen和allow_url_include只是保护了against URL handles标记为URL.这影响了http(s) and ftp(s)但是并没有影响php或date(new in php5.2.0) urls.这些url形式,都可以非常简单的进行php代码注入。

Example 1: Use php://input to read the POST data 

<?php
// Insecure Include
// The following Include statement will
// include and execute everything POSTed
// to the server

include "php://input";
?>

Example 2: Use data: to Include arbitrary code

<?php
// Insecure Include
// The following Include statement will
// include and execute the base64 encoded
// payload. Here this is just phpinfo()

include "data:;base64,PD9waHAgcGhwaW5mbygpOz8+";
?>

把这些放到我们的运算里面将会非常明显的发现既不是url_allow_fopen也不是url_allor_include 被保障。这些只是因为过滤器很少对矢量进行过滤。能够100%解决这个URL include vulnerabilities的方法是我们的Suhosin扩展.

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

MantisBT

MantisBT

Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

Dreamweaver Mac version

Dreamweaver Mac version

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

PhpStorm Mac version

PhpStorm Mac version

The latest (2018.2.1) professional PHP integrated development tool

WebStorm Mac version

WebStorm Mac version

Useful JavaScript development tools