*获取源码

*网站结构

*入口文件

*配置文件

*过滤功能

审计方法-通读全文法

disable_functions

disable_classes

safe_mode=off

safe_mode_exec_dir=/var/www/html

file_uploads=on

upload_max_filesize=8M

文件上传目录

upload_tmp_dir=

用户访问目录限制

open_basedir=

display_error=on

error_reporting=E_ALL

error_log=

log_errors=on

log_errors_max_length=1024

magic_quotes_gpc=On

magic_quotes_runtime=Off

allow_url_fopen = on

allow_url_include = Off

常见危险函数及特殊函数

eval()

assert()

preg_replace()

preg_replace("/test/e",$_GET['h'],"just test");

?h=phpinfo(),phpinfo()将会执行

create_function()

call_user_func()

call_func_array()

require

include

require_once

include_once

命令执行函数

exec()

passthru()

proc_open()

shell_exec()

system()

popen()

文件操作函数

copy

file_get_contents

file_put_contents

file

fopen

move_uploaded_file

readfile

rename

rmdir

unlink & delete

特殊函数

phpinfo()

symlink()

getenv()

putenv()

dl()

配置相关

ini_get()

ini_set

ini_alter

ini_restore

数字判断

is_numeric

数组相关

in_array

变量覆盖

parse_str()

mb_parse_str

extract()

import_request_variables()

列目录

glob

无参数获取信息

get_defined_vars

get_defined_constants

get_defined_functions

get_includes_files

error_reporting(E_ALL);

print_r($_GET);

print_r($_POST);

echo "The var \$test is ".(isset($test)?"defined :\$test=$test":"undefined");

$tag_var = 'short tags';

?>

= $tag_var?>

print_r(scandir(dirname(__FILE__)));

echo "\r\n";

print_r(scandir(dirname(__FILE__)."/../"));

@eval('echo "test"');

echo "\r\n";

echo 'test';

assert('system("whoami");');

preg_replace("/test/e", "phpinfo();", "just test");

$cfunc = create_function('$v', 'return system($v);');

$cfunc('whoami');

$sfunc = 'sys'.'tem';

$sfunc('whoami');

function test($var){

echo 'callable test '.$var;

}

call_user_func('test','amu');

call_user_func('system','whoami');

?>

/*

echo "\r\n
allow_url_include=".(ini_get('allow_url_include')?'On':'Off');

echo "\r\n
allow_url_fopen=".(ini_get('allow_url_fopen')?'On':'Off');

echo "\r\n";

include($_GET['v']);

*/

/*

echo shell_exec('ping 127.0.0.1');

echo shell_exec('ping '.$_GET["v"]);//?v=127.0.0.1 | whoami

*/

/*

file_put_contents('fpc.test', 'test');

file_put_contents('fpc.test', file_get_contents("http://www.baidu.com"));

unlink('fpc.test');

*/

/*

var_dump(getenv('test'));

putenv('test=123');

echo "\r\ntest=".getenv('test');

*/

/*

echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off');

ini_set("display_errors", 0);

echo "\r\n
display_errors=".(ini_get('display_errors')?'On':'Off');

*/

/*

echo "is_numeric :";

var_dump(is_numeric($_GET["v"]));//?v=127' ?v=0e1 ?v=0x123

echo "\r\n";

echo "output :".$_GET["v"];

echo "\r\n";

echo "intval :".intval($_GET["v"]);

*/

/*

$v = 1;

var_dump(in_array($v, array("1",2,3)));

echo "\r\n";;

$a = '1abc'; // '1abc' == 1

in_array($a, array(1,2,3));//in_array($a, array(1,2,3),true);

in_array($a, array("2",2,3));

*/

/*

$str = "first=value&arr[]=foobar&arr[]=baz";

echo "

";

parse_str($str,$array);

print_r($array);

var_dump(isset($first));

parse_str($str);

var_dump(isset($first));

echo "\$arr[0]=$arr[0]";

echo "\$arr[1]=$arr[1]";

*/

/*

echo "

";

print_r(glob("t*.php"));

*/

echo "

";

$test = 'test';

print_r(get_defined_vars());

define("TEST", 'test');

echo "

";

print_r(get_defined_constants(true));

function abc(){}

print_r(get_defined_functions());

?>

$password = 'sfdsfsdfsdfdffdfdf';

if (isset($_POST['passwd'])) {

$pass = $_POST['passwd'];

if ($pass === $_POST['passwd']) {

webshell();

} else {

echo "password is error";

}

} else {

echo '

';

exit;

}

function webshell(){

echo "this is a test";

}

Xdebug的配置PHP.ini

xdebug.auto_trace = 1

xdebug.trace_format = 0

xdebug.trace_output_dir="D:\phpStudy\tmp\xdebug"

xdebug.trace_options = 0

xdebug.collect_params = 4

xdebug.collect_return = 1

xdebug.collect_vars = 1

xdebug.collect_assignments = 1

xdebug.profiler_append = 0

xdebug.profiler_enable = 1

xdebug.profiler_enable_trigger = 0

xdebug.profiler_output_dir="D:\phpStudy\tmp\xdebug"

xdebug.profiler_output_name = "cache.out.%t-%s"

xdebug.remote_enable = 1

xdebug.remote_handler = "dbgp"

xdebug.remote_host = "127.0.0.1"

zend_extension="D:\phpStudy\php\php-5.4.45\ext\php_xdebug.dll"