May062020
DVWA-6.3 Insecure CAPTCHA（不安全的验证码）-High
High Level
查看源码
<?php
if( isset( $_POST[ 'Change' ] ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recaptcha_private_key' ],
$_POST['g-rec...阅读全文
抢沙发
May062020
DVWA-6.2 Insecure CAPTCHA（不安全的验证码）-Medium
Medium Level
查看代码
<?php
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recapt...阅读全文
May062020
DVWA-6.1 Insecure CAPTCHA（不安全的验证码）-Low
Insecure CAPTCHA
Insecure CAPTCHA，意思是不安全的验证码，CAPTCHA是Completely Automated Public Turing Test to Tell Computers and Humans Apart (全自动区分计算机和人类的图灵测试)的简称。但个人觉得，这一模块的内容叫做不安全的验证流程更妥当些，因为这块主要是验证流程出现了逻辑漏洞，谷歌的验证码表示不背这个锅。
reCAPTCHA验证流程
这一模块的验证码使用的是Google提供reC...阅读全文
May062020
DVWA-5.4 File Upload（文件上传）-Impossible
Impossible Level
查看源码
<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Check Anti-CSRF token----校验token
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + ...阅读全文
May062020
DVWA-5.3 File Upload（文件上传）-High-绕过文件类型限制
High Level
查看源码
<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_ext = substr( $uploaded_na...阅读全文
May062020
DVWA-5.2 File Upload（文件上传）-Medium-绕过文件类型限制
Medium Level
查看代码
<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// File information
$uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
$uploaded_type = $_FILES[ 'uploaded...阅读全文
May062020
DVWA-5.1 File Upload（文件上传）-Low
Low Level
查看源码
<?php
if( isset( $_POST[ 'Upload' ] ) ) {
// Where are we going to be writing to?
$target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );
// Can we move the file to the upload folder?
if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $tar...阅读全文
May062020
DVWA-4.4 File Inclusion（文件包含）-Impossible-白名单
Impossible Level
查看源码
<?php
// The page we wish to display
$file = $_GET[ 'page' ];
// Only allow include.php or file{1..3}.php
if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) {
// This isn't the page we want!
echo "ERROR: File not found!";
exit;
}
?>
可以...阅读全文
May062020
DVWA-4.3 File Inclusion（文件包含）-High-利用file协议绕过防护策略
High Level
查看源码
<?php
// The page we wish to display
$file = $_GET[ 'page' ];
// Input validation
if( !fnmatch( "file*", $file ) && $file != "include.php" ) {
// This isn't the page we want!
echo "ERROR: File not found!";
exit;
}
?>
fnmatch() 函数根据指定的模式来匹配文件名或字符串。
可以看到，High级别的代码使用了fnmatch函数...阅读全文
May062020
DVWA-4.2 File Inclusion（文件包含）-Medium-双写绕过str_replace替换规则
Medium Level
服务器端核心代码
<?php
// The page we wish to display
$file = $_GET[ 'page' ];
// Input validation
$file = str_replace( array( "http://", "https://" ), "", $file );
$file = str_replace( array( "../", "..\"" ), "", $file );//个人感觉这里的源码错了，应该改为"..\\"，其中第一个反斜杠用来转义第二个反斜杠
?>
可以看到，Medium级别的代码增加了s...阅读全文