PHP Security-Brute Force Attack

Violent attack

## Brute force attack is an attack method that exhausts all possibilities without using any special means. Its more formal name is an exhaustive attack - an attack that exhausts all possibilities.

For access control, a typical brute force attack involves an attacker trying to log into the system through a large number of attempts. In most cases, the username is known and the password only needs to be guessed.

Although there is no skill in brute force attacks, there seems to be some skill in dictionary attacks. The biggest difference is the intelligence in making guesses. Dictionary attacks only exhaust the list of most likely situations, rather than exhausting all possible situations like brute force attacks.

Preventing verification attempts or limiting the number of allowed errors is a relatively effective security measure, but the dilemma in doing so is how to identify and block attackers without affecting legitimate users.

In this case, a determination of consistency can help you distinguish between the two. This method is very similar to the method for preventing session hijacking described in Chapter 4, but the difference is that you want to identify an attacker rather than a legitimate user.

Consider the following HTML form:

CODE:
 
  <form action="http://example.org/login.php"
method="POST">
  <p>Username: <input type="text"
name="username" /></p>
  <p>Password: <input type="password"
name="password" /></p>
  <p><input type="submit"
/></p>
  </form>

The attacker will view This form creates a script to POST legal data to http://www.php.cn/:

CODE:
 
 <?php
 
  $username = &#39;victim&#39;;
  $password = &#39;guess&#39;;
 
  $content =
"username=$username&password=$password";
  $content_length = strlen($content);
 
  $http_request = &#39;&#39;;
  $http_response = &#39;&#39;;
 
  $http_request .= "POST /login.php
HTTP/1.1\r\n";
  $http_request .= "Host: example.org\r\n";
  $http_request .= "Content-Type:
application/x-www-form-urlencoded\r\n";
  $http_request .= "Content-Length:
$content_length\r\n";
  $http_request .= "Connection: close\r\n";
  $http_request .= "\r\n";
  $http_request .= $content;
 
  if ($handle = fsockopen(&#39;example.org&#39;, 80))
  {
    fputs($handle, $http_request);
 
    while (!feof($handle))
    {
      $http_response .= fgets($handle, 1024);
    }
 
    fclose($handle);
 
    /* Check Response */
  }
  else
  {
    /* Error */
  }
 
  ?>

With this script, an attacker could also simply add a loop to continue trying different passwords and check the $http_response variable after each attempt. Once the $http_response variable changes, it can be considered that the correct password has been guessed.

There are many security measures you can take to prevent this type of attack. We noticed that in a brute force attack, each HTTP request is exactly the same except for the password, which is very valuable.

Although temporarily freezing accounts after a certain number of failed attempts is an effective defense, you may want to consider a more deterministic approach to freezing accounts so that attackers have less impact on legitimate users of your application. Normal use.

There are also processes that can make a brute force attack more difficult, making it less likely to succeed. A simple containment mechanism can effectively do this:

CODE:
 
 <?php
 
  /* mysql_connect() */
  /* mysql_select_db() */
 
  $clean = array();
  $mysql = array();
 
  $now = time();
  $max = $now - 15;
 
  $salt = &#39;SHIFLETT&#39;;
 
  if (ctype_alnum($_POST[&#39;username&#39;]))
  {
    $clean[&#39;username&#39;] = $_POST[&#39;username&#39;];
  }
  else
  {
    /* ... */
  }
  $clean[&#39;password&#39;] = md5($salt .
md5($_POST[&#39;password&#39;] . $salt));
  $mysql[&#39;username&#39;] =
mysql_real_escape_string($clean[&#39;username&#39;]);
 
  $sql = "SELECT last_failure, password
          FROM   users
          WHERE  username =
&#39;{$mysql[&#39;username&#39;]}&#39;";
 
  if ($result = mysql_query($sql))
  {
    if (mysql_num_rows($result))
    {
      $record = mysql_fetch_assoc($result);
 
      if ($record[&#39;last_failure&#39;]> $max)
      {
        /* Less than 15 seconds since last failure
*/
      }
      elseif ($record[&#39;password&#39;] ==
$clean[&#39;password&#39;])
      {
        /* Successful Login */
      }
      else
      {
        /* Failed Login */
 
        $sql = "UPDATE users
                SET    last_failure = &#39;$now&#39;
                WHERE  username =
&#39;{$mysql[&#39;username&#39;]}&#39;";
 
        mysql_query($sql);
      }
    }
    else
    {
      /* Invalid Username */
    }
  }
  else
  {
    /* Error */
  }
 
  ?>

The above example will restrict the last validation failure How often to try again later with the same user. If you try again within 15 seconds of a failed attempt, the verification will fail regardless of whether the password is correct. This is the key point of this plan. But simply blocking access for 15 seconds after a failed attempt is not enough - at this point the output will be consistent no matter what the input is, and will only differ after a successful login. Otherwise, an attacker could simply examine the inconsistent output to determine whether the login was successful.

The above is the content of PHP security-violent attack. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!