bWAPP----HTML Injection

HTML Injection - Stored (Blog)

界面

<div id="main">

    <h1>HTML Injection - Stored (Blog)</h1>

    <form action="<?php echo($_SERVER["SCRIPT_NAME"]);?>" method="POST">

    <table>

            <tr>

                <td colspan="6"><p><textarea name="entry" id="entry" cols="80" rows="3"></textarea></p></td>

            </tr>

            <tr>

                <td width="79" align="left">

                    <button type="submit" name="blog" value="submit">Submit</button>

                </td>

                <td width="85" align="center">

                    <label for="entry_add">Add:</label>
                    <input type="checkbox" id="entry_add" name="entry_add" value="" checked="on">

                </td>

                <td width="100" align="center">

                    <label for="entry_all">Show all:</label>
                    <input type="checkbox" id="entry_all" name="entry_all" value="">

                </td>

                <td width="106" align="center">

                    <label for="entry_delete">Delete:</label>
                    <input type="checkbox" id="entry_delete" name="entry_delete" value="">

                </td>

                <td width="7"></td>

                <td align="left"><?php echo $message;?></td>

            </tr>

    </table>

    </form>

    <br />

    <table id="table_yellow">

        <tr height="30" bgcolor="#ffb717" align="center">

            <td width="20">#</td>
            <td width="100"><b>Owner</b></td>
            <td width="100"><b>Date</b></td>
            <td width="445"><b>Entry</b></td>

        </tr>

   // 上面是html，下面开始是PHP源码

<?php

// Selects all the records

$entry_all = isset($_POST["entry_all"]) ? 1 : 0;

if($entry_all == false)
{

    $sql = "SELECT * FROM blog WHERE owner = '" . $_SESSION["login"] . "'";

}

else
{

    $sql = "SELECT * FROM blog";

}

$recordset = $link->query($sql);

if(!$recordset)
{

    // die("Error: " . $link->connect_error . "<br /><br />");

?>
        <tr height="50">

            <td colspan="4" width="665"><?php die("Error: " . $link->error);?></td>
            <!--
            <td></td>
            <td></td>
            <td></td>
            -->

        </tr>

<?php

}

while($row = $recordset->fetch_object())
{

    if($_COOKIE["security_level"] == "1" or $_COOKIE["security_level"] == "2")
    {

?>
        <tr height="40">

            <td align="center"><?php echo $row->id; ?></td>
            <td><?php echo $row->owner; ?></td>
            <td><?php echo $row->date; ?></td>
            <td><?php echo xss_check_3($row->entry); ?></td>

        </tr>

<?php

    }

    else
    {

?>
        <tr height="40">

            <td align="center"><?php echo $row->id; ?></td>
            <td><?php echo $row->owner; ?></td>
            <td><?php echo $row->date; ?></td>
            <td><?php echo $row->entry; ?></td>

        </tr>

<?php

    }

}

$recordset->close();

$link->close();

?>
    </table>

</div>

感觉防护代码这有点问题，我没看明白

function htmli($data)
{

    include("connect_i.php");                  //链接数据库

    switch($_COOKIE["security_level"])        //检测级别在cookie里
    {

        case "0" :

            $data = sqli_check_3($link, $data);
            break;

        case "1" :

            $data = sqli_check_3($link, $data);
            // $data = xss_check_4($data);
            break;

        case "2" :

            $data = sqli_check_3($link, $data);
            // $data = xss_check_3($data);
            break;

        default :

            $data = sqli_check_3($link, $data);
            break;

    }

无论case是几，执行的都是

sqli_check_3（）进行过滤

sqli_check_3()的定义是

应该把xss的防御加在这里

function sqli_check_3($link, $data)
{
   
    return mysqli_real_escape_string($link, $data);
    
}

mysql_real_escape_string() 函数转义 SQL 语句中使用的字符串中的特殊字符。

下列字符受影响：

• x00
• '
• "
• x1a

如果成功，则该函数返回被转义的字符串。如果失败，则返回 false。

1.low

级别同时不进行保护

2.medium

xss_check_4进行防xss保护

函数功能为

function xss_check_4($data)
{
 
 // addslashes - returns a string with backslashes before characters that need to be quoted in database queries etc.
 // These characters are single quote ('), double quote ("), backslash () and NUL (the NULL byte).
 // Do NOT use this for XSS or HTML validations!!!
 
 return addslashes($data);
 
}

在预定义字符前加反斜杠

预定义字符是：

• 单引号（'）
• 双引号（"）
• 反斜杠（）
• NULL

3.high

xss_check_3功能

 

function xss_check_3($data, $encoding = "UTF-8")
{

    // htmlspecialchars - converts special characters to HTML entities    
    // '&' (ampersand) becomes '&' 
    // '"' (double quote) becomes '"' when ENT_NOQUOTES is not set
    // "'" (single quote) becomes ''' (or ') only when ENT_QUOTES is set
    // '<' (less than) becomes '&lt;'
    // '>' (greater than) becomes '&gt;'  
    
    return htmlspecialchars($data, ENT_QUOTES, $encoding);
       
}

 htmlspecialchars（）功能，将部分字符转化为html字符