文章目录
Insecure CAPTCHA
CAPTCHA(Completely Automated Public Turing test to tell Computers and Humans Apart,全自动区分计算机和人类的图灵测试)是一种常用的人机验证机制,旨在防止恶意机器人或自动化程序对网站进行滥用或攻击。
reCAPTCHA验证流程如下:
-
网站集成:网站管理员在网站上集成reCAPTCHA服务。这通常涉及到在网站的页面中插入reCAPTCHA的JavaScript代码,并配置相关参数。
-
验证请求:当用户尝试访问受保护的功能或提交表单时,网站会向reCAPTCHA服务器发送验证请求。
-
客户端验证:reCAPTCHA JavaScript库会加载并在用户的浏览器上显示验证码。验证码可以是图片验证、声音验证或倒立文字验证等。
-
用户操作:用户需要根据显示的验证码图像或声音,在相应输入框中正确地输入所见的字符或听到的单词。有时,用户可能还需要完成额外的交互任务,比如拖动滑块以进行拼图验证。
-
验证结果:一旦用户完成验证,reCAPTCHA JavaScript库会生成一个令牌(token)。
-
令牌验证:网站将令牌与reCAPTCHA服务器进行通信,以验证令牌的有效性和真实性。网站发送令牌并接收响应以确认用户是否成功通过了reCAPTCHA验证。
Insecure CAPTCHA(不安全的CAPTCHA)是指存在安全漏洞或易受攻击的验证码系统。
Low level
源代码
<?php
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recaptcha_private_key'],
$_POST['g-recaptcha-response']
);
// Did the CAPTCHA fail?
if( !$resp ) {
// What happens when the CAPTCHA was entered incorrectly
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
$hide_form = false;
return;
}
else {
// CAPTCHA was correct. Do both new passwords match?
if( $pass_new == $pass_conf ) {
// Show next stage for the user
echo "
<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
<form action=\"#\" method=\"POST\">
<input type=\"hidden\" name=\"step\" value=\"2\" />
<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
<input type=\"submit\" name=\"Change\" value=\"Change\" />
</form>";
}
else {
// Both new passwords do not match.
$html .= "<pre>Both passwords must match.</pre>";
$hide_form = false;
}
}
}
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check to see if both password match
if( $pass_new == $pass_conf ) {
// They do!
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );
// Update database
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
// Feedback for the end user
echo "<pre>Password Changed.</pre>";
}
else {
// Issue with the passwords matching
echo "<pre>Passwords did not match.</pre>";
$hide_form = false;
}
((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}
?>
代码审计
-
如果用户点击了提交按钮(name为"Change")并且步骤(step)为1,那么执行以下操作:
- 隐藏验证码表单(hide_form = true)
- 获取用户输入的新密码(pass_new)和确认密码(pass_conf)
- 调用recaptcha_check_answer()函数验证用户输入的验证码是否正确
- 如果验证码验证失败,则显示错误信息,并显示验证码表单($hide_form = false)
- 如果验证码验证成功,则检查两次输入的新密码是否相同
- 如果密码相同,则显示下一阶段的表单,提示用户点击按钮以确认更改
- 如果密码不相同,则显示错误消息,并显示验证码表单($hide_form = false)
-
如果用户点击了提交按钮(name为"Change")并且步骤(step)为2,那么执行以下操作:
- 隐藏验证码表单(hide_form = true)
- 获取用户输入的新密码(pass_new)和确认密码(pass_conf)
- 检查两次输入的新密码是否相同
- 如果密码相同,则对新密码进行安全处理,并更新数据库中的密码字段
- 如果密码不相同,则显示错误消息,并显示验证码表单($hide_form = false)
姿势
由代码审计知,只需使step=2,且两次输入的新密码相同,就可以绕过验证码,使数据库更新。
由于用户每次提交时,应用默认走step=1,因此抓包修改即可
抓包:
修改step参数并发包:
由回显可知,密码修改成功。
Medium level
源代码
<?php
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '1' ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recaptcha_private_key' ],
$_POST['g-recaptcha-response']
);
// Did the CAPTCHA fail?
if( !$resp ) {
// What happens when the CAPTCHA was entered incorrectly
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
$hide_form = false;
return;
}
else {
// CAPTCHA was correct. Do both new passwords match?
if( $pass_new == $pass_conf ) {
// Show next stage for the user
echo "
<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
<form action=\"#\" method=\"POST\">
<input type=\"hidden\" name=\"step\" value=\"2\" />
<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
<input type=\"hidden\" name=\"passed_captcha\" value=\"true\" />
<input type=\"submit\" name=\"Change\" value=\"Change\" />
</form>";
}
else {
// Both new passwords do not match.
$html .= "<pre>Both passwords must match.</pre>";
$hide_form = false;
}
}
}
if( isset( $_POST[ 'Change' ] ) && ( $_POST[ 'step' ] == '2' ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check to see if they did stage 1
if( !$_POST[ 'passed_captcha' ] ) {
$html .= "<pre><br />You have not passed the CAPTCHA.</pre>";
$hide_form = false;
return;
}
// Check to see if both password match
if( $pass_new == $pass_conf ) {
// They do!
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );
// Update database
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
// Feedback for the end user
echo "<pre>Password Changed.</pre>";
}
else {
// Issue with the passwords matching
echo "<pre>Passwords did not match.</pre>";
$hide_form = false;
}
((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}
?>
代码审计
首先,当用户点击提交按钮并且步骤为1时,执行以下操作:
- 隐藏验证码表单($hide_form = true)
- 获取用户输入的新密码(pass_new)和确认密码(pass_conf)
- 使用recaptcha_check_answer()函数检查用户输入的验证码是否正确
- 如果验证码验证失败,则显示错误信息,并显示验证码表单($hide_form = false)
- 如果验证码验证成功,则检查两次输入的新密码是否相同
- 如果密码相同,则显示下一阶段的表单,提示用户点击按钮以确认更改
- 如果密码不相同,则显示错误消息,并显示验证码表单($hide_form = false)
然后,当用户点击提交按钮并且步骤为2时,执行以下操作:
-
隐藏验证码表单($hide_form = true)
-
获取用户输入的新密码(pass_new)和确认密码(pass_conf)
-
检查是否通过了第一步的验证码验证
// Check to see if they did stage 1
if( !$_POST[ 'passed_captcha' ] ) {
$html .= "<pre><br />You have not passed the CAPTCHA.</pre>";
$hide_form = false;
return;
}
- 检查两次输入的新密码是否相同
- 如果密码相同,则对新密码进行安全处理,并更新数据库中的密码字段
- 如果密码不相同,则显示错误消息,并显示验证码表单($hide_form = false)
姿势
只需绕过程序对第一步的验证码验证即可
抓包:
修改参数并发包:
由回显可知,密码修改成功。
High level
源代码
<?php
if( isset( $_POST[ 'Change' ] ) ) {
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_conf = $_POST[ 'password_conf' ];
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recaptcha_private_key' ],
$_POST['g-recaptcha-response']
);
if (
$resp ||
(
$_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'
&& $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA'
)
){
// CAPTCHA was correct. Do both new passwords match?
if ($pass_new == $pass_conf) {
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );
// Update database
$insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "' LIMIT 1;";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
// Feedback for user
echo "<pre>Password Changed.</pre>";
} else {
// Ops. Password mismatch
$html .= "<pre>Both passwords must match.</pre>";
$hide_form = false;
}
} else {
// What happens when the CAPTCHA was entered incorrectly
$html .= "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
$hide_form = false;
return;
}
((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}
// Generate Anti-CSRF token
generateSessionToken();
?>
代码审计
-
首先,将隐藏验证码表单的标志设置为true,然后获取用户输入的新密码和确认密码。
-
接下来,调用recaptcha_check_answer()函数,验证用户输入的验证码是否正确。如果验证码验证通过,或者根据特定条件(隐藏域值为’hidd3n_valu3’且用户代理为’reCAPTCHA’)判断为验证通过,则进行以下操作:
-
验证两次输入的新密码是否相同。
如果密码相同,则将新密码进行安全处理,通过使用mysqli_real_escape_string()函数进行转义,并使用md5()函数进行加密。
更新数据库中当前用户的密码字段,通过执行UPDATE语句。
反馈给用户密码已更改的提示信息。 -
如果两次输入的密码不相同,则将错误消息赋值给$html变量,并将隐藏验证码表单的标志设为false,以便重新显示验证码表单。
-
如果验证码验证失败,则将错误消息赋值给$html变量,并将隐藏验证码表单的标志设为false,以便重新显示验证码表单。同时,使用return关键字结束脚本的执行。
-
最后,调用generateSessionToken()函数生成一个防跨站请求伪造(CSRF)的令牌。
姿势
由于可根据特定条件(隐藏域值为’hidd3n_valu3’且用户代理为’reCAPTCHA’)验证通过
$_POST[ 'g-recaptcha-response' ] == 'hidd3n_valu3'
&& $_SERVER[ 'HTTP_USER_AGENT' ] == 'reCAPTCHA'
故可修改 HTTP_USER_AGENT 和添加== g-recaptcha-response 绕过
由上图回显可知,密码修改成功。
Impossible level
源代码
<?php
if( isset( $_POST[ 'Change' ] ) ) {
// Check Anti-CSRF token
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
// Hide the CAPTCHA form
$hide_form = true;
// Get input
$pass_new = $_POST[ 'password_new' ];
$pass_new = stripslashes( $pass_new );
$pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_new = md5( $pass_new );
$pass_conf = $_POST[ 'password_conf' ];
$pass_conf = stripslashes( $pass_conf );
$pass_conf = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_conf ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_conf = md5( $pass_conf );
$pass_curr = $_POST[ 'password_current' ];
$pass_curr = stripslashes( $pass_curr );
$pass_curr = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass_curr ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass_curr = md5( $pass_curr );
// Check CAPTCHA from 3rd party
$resp = recaptcha_check_answer(
$_DVWA[ 'recaptcha_private_key' ],
$_POST['g-recaptcha-response']
);
// Did the CAPTCHA fail?
if( !$resp ) {
// What happens when the CAPTCHA was entered incorrectly
echo "<pre><br />The CAPTCHA was incorrect. Please try again.</pre>";
$hide_form = false;
}
else {
// Check that the current password is correct
$data = $db->prepare( 'SELECT password FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
$data->bindParam( ':password', $pass_curr, PDO::PARAM_STR );
$data->execute();
// Do both new password match and was the current password correct?
if( ( $pass_new == $pass_conf) && ( $data->rowCount() == 1 ) ) {
// Update the database
$data = $db->prepare( 'UPDATE users SET password = (:password) WHERE user = (:user);' );
$data->bindParam( ':password', $pass_new, PDO::PARAM_STR );
$data->bindParam( ':user', dvwaCurrentUser(), PDO::PARAM_STR );
$data->execute();
// Feedback for the end user - success!
echo "<pre>Password Changed.</pre>";
}
else {
// Feedback for the end user - failed!
echo "<pre>Either your current password is incorrect or the new passwords did not match.<br />Please try again.</pre>";
$hide_form = false;
}
}
}
// Generate Anti-CSRF token
generateSessionToken();
?>
代码审计
-
首先,通过检查是否存在名为"Change"的POST请求,来确定用户是否点击了提交按钮。
-
接着,调用checkToken()函数来验证Anti-CSRF(跨站请求伪造)令牌。
-
设置隐藏验证码表单的标志为true。
-
获取用户输入的新密码、确认密码和当前密码,并进行一些处理:
- 使用stripslashes()函数去除输入中的反斜杠。
- 使用mysqli_real_escape_string()函数对密码进行转义,以防止SQL注入攻击。
- 使用md5()函数对密码进行加密,以增强安全性。
-
调用recaptcha_check_answer()函数来验证第三方提供的reCAPTCHA验证码是否正确。
-
如果验证码验证失败,则输出错误消息并将隐藏验证码表单的标志设为false,以便重新显示验证码表单。
-
如果验证码验证通过,则继续执行以下操作:
- 查询数据库,检查当前密码是否正确。
- 检查新密码和确认密码是否相同,并且当前密码是否正确。
- 如果条件都满足,则更新数据库中的密码字段为新密码。
- 输出密码更改成功的提示信息。
-
如果密码更改失败,则输出相应的错误消息并将隐藏验证码表单的标志设为false,以便重新显示验证码表单。
-
最后,调用generateSessionToken()函数生成一个新的防CSRF令牌。
总结
以上为 [网络安全] DVWA之 Insecure CAPTCHA 攻击姿势及解题详析合集 ,考察PHP代码审计
、Burp基本
使用等相关知识。
我是秋说,我们下次见。