问候，
我设计的网站今天遭到破坏，目前致力于损害控制。未经授权，访问了两个用户帐户，包括主管理员。请查看正在使用的登录脚本，任何有关安全漏洞的见解都将受到赞赏。我不确定这是SQL注入还是可能在过去用于访问该区域的计算机上发生泄露。
由于
<?php
//Start session
session_start();
//Include DB config
require_once('config.php');
//Error message array
$errmsg_arr = array();
$errflag = false;
//Connect to mysql server
$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
if(!$link) {
die('Failed to connect to server: ' . mysql_error());
}
//Select database
$db = mysql_select_db(DB_DATABASE);
if(!$db) {
die("Unable to select database");
}
//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}
//Sanitize the POST values
$login = clean($_POST['login']);
$password = clean($_POST['password']);
//Input Validations
if($login == '') {
$errmsg_arr[] = 'Login ID missing';
$errflag = true;
}
if($password == '') {
$errmsg_arr[] = 'Password missing';
$errflag = true;
}
//If there are input validations, redirect back to the login form
if($errflag) {
$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
session_write_close();
header("location: http://somewhere.com");
exit();
}
//Create query
$qry="SELECT * FROM user_control WHERE username='$login' AND password='".md5($_POST['password'])."'";
$result=mysql_query($qry);
//Check whether the query was successful or not
if($result) {
if(mysql_num_rows($result) == 1) {
//Login Successful
session_regenerate_id();
//Collect details about user and assign session details
$member = mysql_fetch_assoc($result);
$_SESSION['SESS_MEMBER_ID'] = $member['user_id'];
$_SESSION['SESS_USERNAME'] = $member['username'];
$_SESSION['SESS_FIRST_NAME'] = $member['name_f'];
$_SESSION['SESS_LAST_NAME'] = $member['name_l'];
$_SESSION['SESS_STATUS'] = $member['status'];
$_SESSION['SESS_LEVEL'] = $member['level'];
//Get Last Login
$_SESSION['SESS_LAST_LOGIN'] = $member['lastLogin'];
//Set Last Login info
$qry = "UPDATE user_control SET lastLogin = DATE_ADD(NOW(), INTERVAL 1 HOUR) WHERE user_id = $member[user_id]";
$login = mysql_query($qry) or die(mysql_error());
session_write_close();
if ($member['level'] != "3" || $member['status'] == "Suspended") {
header("location: http://somewhere.com");
} else {
header("location: http://somewhere.com");
}
exit();
}else {
//Login failed
header("location: http://somewhere.com");
exit();
}
}else {
die("Query failed");
}
?>
更新
以下是安全脚本的更新版本，请告诉我您的想法。添加了一个小的SALT和一个表来阻止两个IP地址（禁用登录表单本身）和单个用户在四次验证失败后。 Mayday电子邮件也会发送给管理员，并通知用户他们已超出限制。
任何批评都将不胜感激！
<?php
//Start session
session_start();
//Include DB config
include $_SERVER['DOCUMENT_ROOT'] . '/includes/pdo_conn.inc.php';
//Error message array
$errmsg_arr = array();
$errflag = false;
//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return $str;
}
//Define a SALT
define('SALT', 'heylookitssuperman');
//Sanitize the POST values
$login = clean($_POST['login']);
$password = clean($_POST['password']);
//Encrypt password
$encryptedPassword = md5(SALT . $password);
//Input Validations
//Obtain IP address and check for past failed attempts
$ip_address = $_SERVER['REMOTE_ADDR'];
$checkIPBan = $db->prepare("SELECT COUNT(*) FROM ip_ban WHERE ipAddr = ? OR login = ?");
$checkIPBan->execute(array($ip_address, $login));
$numAttempts = $checkIPBan->fetchColumn();
//If there are 4 failed attempts, send back to login and temporarily ban IP address
if ($numAttempts == 1) {
$getTotalAttempts = $db->prepare("SELECT attempts FROM ip_ban WHERE ipAddr = ? OR login = ?");
$getTotalAttempts->execute(array($ip_address, $login));
$totalAttempts = $getTotalAttempts->fetch();
$totalAttempts = $totalAttempts['attempts'];
if ($totalAttempts >= 4) {
//Send Mayday SMS
$to = "admin@somewhere.com";
$subject = "Banned Account - $login";
$mailheaders = 'From: noreply@somewhere.com' . "\r\n";
$mailheaders .= 'Reply-To: noreply@somewhere.com' . "\r\n";
$mailheaders .= 'MIME-Version: 1.0' . "\r\n";
$mailheaders .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
$msg = "<p>IP Address - " . $ip_address . ", Username - " . $login . "</p>";
mail($to, $subject, $msg, $mailheaders);
$setAccountBan = $db->query("UPDATE ip_ban SET isBanned = 1 WHERE ipAddr = '$ip_address'");
$setAccountBan->execute();
$errmsg_arr[] = 'Too Many Login Attempts';
$errflag = true;
}
}
if($login == '') {
$errmsg_arr[] = 'Login ID missing';
$errflag = true;
}
if($password == '') {
$errmsg_arr[] = 'Password missing';
$errflag = true;
}
//If there are input validations, redirect back to the login form
if($errflag) {
$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
session_write_close();
header('Location: http://somewhere.com/login.php');
exit();
}
//Query database
$loginSQL = $db->prepare("SELECT password FROM user_control WHERE username = ?");
$loginSQL->execute(array($login));
$loginResult = $loginSQL->fetch();
//Compare passwords
if($loginResult['password'] == $encryptedPassword) {
//Login Successful
session_regenerate_id();
//Collect details about user and assign session details
$getMemDetails = $db->prepare("SELECT * FROM user_control WHERE username = ?");
$getMemDetails->execute(array($login));
$member = $getMemDetails->fetch();
$_SESSION['SESS_MEMBER_ID'] = $member['user_id'];
$_SESSION['SESS_USERNAME'] = $member['username'];
$_SESSION['SESS_FIRST_NAME'] = $member['name_f'];
$_SESSION['SESS_LAST_NAME'] = $member['name_l'];
$_SESSION['SESS_STATUS'] = $member['status'];
$_SESSION['SESS_LEVEL'] = $member['level'];
//Get Last Login
$_SESSION['SESS_LAST_LOGIN'] = $member['lastLogin'];
//Set Last Login info
$updateLog = $db->prepare("UPDATE user_control SET lastLogin = DATE_ADD(NOW(), INTERVAL 1 HOUR), ip_addr = ? WHERE user_id = ?");
$updateLog->execute(array($ip_address, $member['user_id']));
session_write_close();
//If there are past failed log-in attempts, delete old entries
if ($numAttempts > 0) {
//Past failed log-ins from this IP address. Delete old entries
$deleteIPBan = $db->prepare("DELETE FROM ip_ban WHERE ipAddr = ?");
$deleteIPBan->execute(array($ip_address));
}
if ($member['level'] != "3" || $member['status'] == "Suspended") {
header("location: http://somewhere.com");
} else {
header('Location: http://somewhere.com');
}
exit();
} else {
//Login failed. Add IP address and other details to ban table
if ($numAttempts < 1) {
//Add a new entry to IP Ban table
$addBanEntry = $db->prepare("INSERT INTO ip_ban (ipAddr, login, attempts) VALUES (?,?,?)");
$addBanEntry->execute(array($ip_address, $login, 1));
} else {
//increment Attempts count
$updateBanEntry = $db->prepare("UPDATE ip_ban SET ipAddr = ?, login = ?, attempts = attempts+1 WHERE ipAddr = ? OR login = ?");
$updateBanEntry->execute(array($ip_address, $login, $ip_address, $login));
}
header('Location: http://somewhere.com/login.php');
exit();
}
?>
答案 0 :(得分：3)
这绝不是全面的，可能包括一般性审查的要素：
die()调用连接失败会调用mysql_error()，这可能泄漏敏感信息（数据库主机，用户名）mysql_real_escape_string()，这允许它确保关于字符集等正确地转义该值。连接header()来电包含字符串“location”;正确的标题名称是“位置”$_POST['password']，然后使用md5( $_POST['password'] )将其注入SQL中;虽然（由于md5()的行为）这不会引入漏洞，但它可能会在get_magic_quotes_gpc()被打开的环境中中断，并且有点不一致mysql_query()的调用没有指定连接句柄 - 尽管在这个脚本中，不太可能有另一个人在说谎，我喜欢在与MySQL交谈时明确 - 它给了我温暖的模糊< / LI>
你似乎存储密码哈希 - 很好 - 虽然使用MD5（不太好，可以说是），但没有任何形式的腌制 - 这意味着如果有人抓住你的密码哈希，那么他们可以使用彩虹表/蛮力试图破解密码。也就是说，你可能会争辩（我很高兴地接受），如果有人进入盒子并获得了这些数据，那么你还有其他潜在的问题。
我建议读一下http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html，这将解释为什么每用户盐会有所帮助，而MD5可能不再是密码散列函数的最佳选择。
不想超出这个答案的范围，并且推测太多;会议劫持会成为罪魁祸首吗？ （我对你的会话如何恢复一无所知，但你的代码可能“信任”会话数据似乎是合理的。当然，这并不容易让人失败 - 将地址绑定到IP地址是一个好的开始例如。）
答案 1 :(得分：1)
您可以在存储的密码中添加salt，以防止字典和rainbowtables攻击。
您还可以将密码存储在更强的哈希/加密哈希值而不是MD5中。
查看例如：http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-incorrectly.html
如果登录尝试失败次数过多，您也可以临时暂停ipaddresses。比如让我们说一个小时。
这样可以防止暴力攻击。好吧，不是真的阻止它，它至少使它变得更难。
答案 2 :(得分：-3)
我不是SQL专家，但我知道在数据库中存储密码（或密码哈希）通常不是一种好的安全措施。使用密码加密文件通常更安全，然后通过表单接受密码并尝试使用密码哈希对其进行解密。那样;没有密码本身的信息存储在服务器的硬盘上，没有密码，没有人可以解密文件（或数据库条目），即使他们有物理访问服务器或访问数据库文件。