CSRF代码分析、漏洞讲解与post实战
一、csrf代码分析
index.php
<!DOCTYPE html>
<html>
<head>
<title>Login</title>
</head>
<body>
<form action="" method="GET">
<p>name: <input type="text" name="name" /></p>
<p>pass: <input type="text" name="pass" /></p>
<p><input type="submit" value="Login" /></p>
</form>
</body>
</html>
<?php
$name=$_GET['name'];
$pass=$_GET['pass'];
if (isset($name) && isset($pass)) {
if ($name == "admin" && $pass == "123456") {
setcookie("csrf","admin123456cookie");
header("Location:http://127.0.0.1/8-12/main.php");
}
else{
header("Location:http://127.0.0.1/8-12/index.php");
}
}
?>
main.php
<!DOCTYPE html>
<html>
<head>
<title>CSRF</title>
</head>
<body>
<form action="get.php" method="GET">
<p>ID: <input type="text" name="inputid" /></p>
<p>Money: <input type="text" name="inputmoney" /></p>
<p><input type="submit" /></p>
</form>
</body>
</html>
get.php
<?php
$cookie = $_COOKIE['csrf'];
if (!isset($cookie)) {
exit();
}
if ($cookie != 'admin123456cookie') {
echo "exit";
exit();
}
$id = $_GET['inputid'];
$money = $_GET['inputmoney'];
if (isset($id) && isset($money)) {
echo "买".$id."花费".$money;
}
else{
echo "please input your etc";
}
$money = 100 - $money;
$sql = 'update goods set price = '.$money.' where name = "'.$id.'"';
/*Connect to a MySQL server 连接数据库*/
$link = mysqli_connect(
'127.0.0.1',//数据库链接地址
'root',//数据库用户名
'123456',//数据库密码
'test');//数据库名称
if (!$link) {
printf("Can't connect to Mysql Server.Errorcode: %s",mysqli_connect_error());
exit;
}else{
echo "数据库连接上了!"."<br/>";
}
if ($result = mysql_query($link,$sql)) {
//返回查询结果
while ($row = mysql_fetch_assoc($result)) {
echo $row['name'].$row['price']," ","<br/>";
}
mysql_free_result(result);
}
?>
二、csrf漏洞讲解
csrf:攻击者盗用你的身份,以你的名义发送恶意请求
xss csrf
跨站脚本 跨站请求伪造
有javascript参与 不需要javascript参与
直接盗取会话 身份认证后请求
由目标网站同域发出 请求跨域出发
<link herf=””>
<img src=””>
<iframe src=””>
<script src=””>
admin admin
三、csrf post实战
后续操作请持续关注哦!!!
了解更多请关注下列公众号:
😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗
😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗