Question

考虑以下用于DVWA的login.php：

<?php

define( 'DVWA_WEB_PAGE_TO_ROOT', '' );
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';

dvwaPageStartup( array( 'phpids' ) );

dvwaDatabaseConnect();

if( isset( $_POST[ 'Login' ] ) ) {
    // Anti-CSRF
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'login.php' );

    $user = $_POST[ 'username' ];
    $user = stripslashes( $user );
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    $pass = $_POST[ 'password' ];
    $pass = stripslashes( $pass );
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    $query = ("SELECT table_schema, table_name, create_time
                FROM information_schema.tables
                WHERE table_schema='{$_DVWA['db_database']}' AND table_name='users'
                LIMIT 1");
    $result = @mysqli_query($GLOBALS["___mysqli_ston"],  $query );
    if( mysqli_num_rows( $result ) != 1 ) {
        dvwaMessagePush( "First time using DVWA.<br />Need to run 'setup.php'." );
        dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'setup.php' );
    }

    $query  = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
    $result = @mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );
    if( $result && mysqli_num_rows( $result ) == 1 ) {    // Login Successful...
        dvwaMessagePush( "You have logged in as '{$user}'" );
        dvwaLogin( $user );
        dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
    }

    // Login failed
    dvwaMessagePush( 'Login failed' );
    dvwaRedirect( 'login.php' );
}

$messagesHtml = messagesPopAllToHtml();

Header( 'Cache-Control: no-cache, must-revalidate');    // HTTP/1.1
Header( 'Content-Type: text/html;charset=utf-8' );      // TODO- proper XHTML headers...
Header( 'Expires: Tue, 23 Jun 2009 12:00:00 GMT' );     // Date in the past

// Anti-CSRF
generateSessionToken();

echo "
<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">

<html xmlns=\"http://www.w3.org/1999/xhtml\">

    <head>

        <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\" />

        <title>Login :: Damn Vulnerable Web Application (DVWA) v" . dvwaVersionGet() . "</title>

        <link rel=\"stylesheet\" type=\"text/css\" href=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/css/login.css\" />

    </head>

    <body>

    <div id=\"wrapper\">

    <div id=\"header\">

    <br />

    <p><img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/login_logo.png\" /></p>

    <br />

    </div> <!--<div id=\"header\">-->

    <div id=\"content\">

    <form action=\"login.php\" method=\"post\">

    <fieldset>

            <label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\"><br />


            <label for=\"pass\">Password</label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\"><br />

            <br />

            <p class=\"submit\"><input type=\"submit\" value=\"Login\" name=\"Login\"></p>

    </fieldset>

    " . tokenField() . "

    </form>

    <br />

    {$messagesHtml}

    <br />
    <br />
    <br />
    <br />
    <br />
    <br />
    <br />
    <br />

    <!-- <img src=\"" . DVWA_WEB_PAGE_TO_ROOT . "dvwa/images/RandomStorm.png\" /> -->
    </div > <!--<div id=\"content\">-->

    <div id=\"footer\">

    <p>" . dvwaExternalLinkUrlGet( 'http://www.dvwa.co.uk/', 'Damn Vulnerable Web Application (DVWA)' ) . "</p>

    </div> <!--<div id=\"footer\"> -->

    </div> <!--<div id=\"wrapper\"> -->

    </body>

</html>";

?>

我想获取用户将所有参数发送到服务器的所有参数，例如当用户输入他/她的用户名和密码时，他/她发送以下两个参数：＆＃39;用户名＆＃ 39;和密码＆＃39;。我写了一个简单的python脚本，它给了我login.php：

中的所有变量

import re

textfile = open('login.php', 'r')
filetext = textfile.read()
textfile.close()
matches = re.findall("\$[A-Za-z0-9-_'\"\[\] ]+", filetext)
print("\n".join(list(set(matches))))

此脚本的输出为：

$user 
$_DVWA['db_database']
$user' AND password
$query  
$messagesHtml
$GLOBALS["___mysqli_ston"]
$messagesHtml 
$user
$___mysqli_res 
$pass'
$query 
$_REQUEST[ 'user_token' ]
$result 
$_POST[ 'username' ]
$_SESSION[ 'session_token' ]
$_POST[ 'Login' ] 
$_POST[ 'password' ]
$pass

但实际上，我不需要所有这些。例如在$_POST[ 'password' ]中，我只想获得密码＆＃39;在$_SESSION[ 'session_token' ]中，我只想获得“session_token”＃39;。事实上，我想获得所有客户端参数（假设我有ABC [＆＃39; DEF＆＃39;]。我只想获得文本＆＃39; DEF＆＃39;）。我不知道该怎么做。

如何获取PHP超全局变量输入？

0 个答案: