web常见攻击四 –不安全的验证码机制（Insecure

我是在dvwa（Damn Vulnerable Web App）上学到的这些东西，我把dvwa安装在了我的免费空间上，有兴趣的可以看看。DVWA 想要用户名和密码的可以联系我：sq371426@163.com dvwa 用的验证是google提供的，详情见google CAPCTHE 这里所谓的不安全的验证码机制是指对前台获得的验证码在后台验证不够全面引起的安全问题，呵呵，这里比较绕口是吧下面我们来看一下不安全的代码吧

<?php 
 
if( isset( $_POST['Change'] ) && ( $_POST['step'] == '1' ) ) { 
 
    $hide_form = true; 
    $user = $_POST['username']; 
    $pass_new = $_POST['password_new']; 
    $pass_conf = $_POST['password_conf']; 
    $resp = recaptcha_check_answer ($_DVWA['recaptcha_private_key'], 
        $_SERVER["REMOTE_ADDR"], 
        $_POST["recaptcha_challenge_field"], 
        $_POST["recaptcha_response_field"]); 
 
    if (!$resp->is_valid) { 
        // What happens when the CAPTCHA was entered incorrectly 
        echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; 
        $hide_form = false; 
        return;     
    } else { 
            if (($pass_new == $pass_conf)){ 
            echo "<pre><br />You passed the CAPTCHA! Click the button to confirm your changes. <br /></pre>";
            echo " 
            <form action=\"#\" method=\"POST\"> 
                <input type=\"hidden\" name=\"step\" value=\"2\" /> 
                <input type=\"hidden\" name=\"password_new\" value=\"" . $pass_new . "\" /> 
                <input type=\"hidden\" name=\"password_conf\" value=\"" . $pass_conf . "\" /> 
                <input type=\"submit\" name=\"Change\" value=\"Change\" /> 
            </form>"; 
            }     
 
            else{ 
                    echo "<pre> Both passwords must match </pre>"; 
            $hide_form = false; 
            } 
    } 
} 
 
if( isset( $_POST['Change'] ) && ( $_POST['step'] == '2' ) )  
{ 
    $hide_form = true; 
        if ($pass_new != $pass_conf) 
        { 
                echo "<pre><br />Both passwords must match</pre>"; 
        $hide_form = false; 
                return; 
        } 
        $pass = md5($pass_new); 
        if (($pass_new == $pass_conf)){ 
               $pass_new = mysql_real_escape_string($pass_new); 
               $pass_new = md5($pass_new); 
 
               $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
               $result=mysql_query($insert) or die('<pre>' . mysql_error() . '</pre>' ); 
 
               echo "<pre> Password Changed </pre>"; 
               mysql_close(); 
        } 
 
        else{ 
               echo "<pre> Passwords did not match. </pre>"; 
        } 
} 
 
?>

也许初学者都会这样的代码，但是自习看一看，这段代码存在一个致命的漏洞——虽然在第一步对验证码进行了验证，但是在第二部分却没有对验证码的有效性进行验证。下面这段代码修复了这个漏洞

<?php 
if( isset( $_POST['Change'] ) && ( $_POST['step'] == '1' ) ) { 
 
    $hide_form = true; 
    $user = $_POST['username']; 
    $pass_new = $_POST['password_new']; 
    $pass_conf = $_POST['password_conf']; 
    $resp = recaptcha_check_answer($_DVWA['recaptcha_private_key'], 
        $_SERVER["REMOTE_ADDR"], 
        $_POST["recaptcha_challenge_field"], 
        $_POST["recaptcha_response_field"]); 
 
    if (!$resp->is_valid) { 
        // What happens when the CAPTCHA was entered incorrectly 
        echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; 
        $hide_form = false; 
        return;     
    } else { 
            if (($pass_new == $pass_conf)){ 
            echo "<pre><br />You passed the CAPTCHA! Click the button to confirm your changes. <br /></pre>";
            echo " 
            <form action=\"#\" method=\"POST\"> 
                <input type=\"hidden\" name=\"step\" value=\"2\" /> 
                <input type=\"hidden\" name=\"password_new\" value=\"" . $pass_new . "\" /> 
                <input type=\"hidden\" name=\"password_conf\" value=\"" . $pass_conf . "\" /> 
                <input type=\"hidden\" name=\"passed_captcha\" value=\"true\" /> 
                <input type=\"submit\" name=\"Change\" value=\"Change\" /> 
            </form>"; 
            }     
 
            else{ 
                    echo "<pre> Both passwords must match </pre>"; 
            $hide_form = false; 
            } 
    } 
} 
 
if( isset( $_POST['Change'] ) && ( $_POST['step'] == '2' ) )  
{ 
    $hide_form = true; 
    if (!$_POST['passed_captcha']) 
    { 
                echo "<pre><br />You have not passed the CAPTCHA. Bad hacker, no doughnut.</pre>"; 
        $hide_form = false; 
        return; 
    } 
        $pass = md5($pass_new); 
        if (($pass_new == $pass_conf)){ 
               $pass_new = mysql_real_escape_string($pass_new); 
               $pass_new = md5($pass_new); 
 
               $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
               $result=mysql_query($insert) or die('<pre>' . mysql_error() . '</pre>' ); 
 
               echo "<pre> Password Changed </pre>"; 
               mysql_close(); 
        } 
 
        else{ 
               echo "<pre> Passwords did not match. </pre>"; 
        } 
} 
?>

到这里这段代码算是比较安全的了，但是仔细想想还是觉得这段代码哪里不对劲，是否过于冗余了呢。下面我们来看精简安全的代码

<?php 
if( isset( $_POST['Change'] ) && ( $_POST['step'] == '1' ) ) { 
 
    $hide_form = true; 
 
    <!--DVFMTSC-->$pass_new = $_POST['password_new']; 
    $pass_new = stripslashes( $pass_new ); 
    $pass_new = mysql_real_escape_string( $pass_new ); 
    $pass_new = md5( $pass_new ); 
 
    <!--DVFMTSC-->$pass_conf = $_POST['password_conf']; 
    <!--DVFMTSC-->$pass_conf = stripslashes( $pass_conf ); 
    $pass_conf = mysql_real_escape_string( $pass_conf ); 
    $pass_conf = md5( $pass_conf ); 
 
        $resp = recaptcha_check_answer ($_DVWA['recaptcha_private_key'], 
        $_SERVER["REMOTE_ADDR"], 
        $_POST["recaptcha_challenge_field"], 
        $_POST["recaptcha_response_field"]); 
 
    if (!$resp->is_valid) { 
        // What happens when the CAPTCHA was entered incorrectly 
        echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>"; 
        $hide_form = false; 
        return;     
    } else { 
                // Check that the current password is correct 
        $qry = "SELECT password FROM `users` WHERE user='admin' AND password='$pass_curr';"; 
        $result = mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>' ); 
 
                if (($pass_new == $pass_conf)  && ( $result && mysql_num_rows( $result ) == 1 )){ 
                       $insert="UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
                       $result=mysql_query($insert) or die('<pre>' . mysql_error() . '</pre>' ); 
 
                       echo "<pre> Password Changed </pre>"; 
                       mysql_close(); 
                } 
 
                else{ 
                       echo "<pre> Either your current password is incorrect or the new passwords did not match. Please try again. </pre>"; 
                } 
    } 
} 
?>

本博客所有文章如无特别注明均为原创。
复制或转载请以超链接形式注明转自起风了，原文地址《web常见攻击四 –不安全的验证码机制（Insecure》