Are sessions in PHP safe? _php tips
I have been doing PHP development for so long and I have never really paid attention to security issues. I always focus on completing the project. Recently I saw an article about security on the Internet. After reading it, I noticed that I had previously All the projects had big security vulnerabilities, so I picked one project and tested it, and found that it was easy to get caught. Here I will share a test example I wrote to illustrate how the session in PHP is unsafe and how to strengthen its security in the project.
Regarding the principle and mechanism of session, there are many good articles on the Internet to introduce it, and we can check it by ourselves. Let’s share examples for testing directly.
The example of this test is mainly a login page. After successful login, you can change the password. It is such a simple function.
The interface is as follows
First, use the function session_start() at the project entrance to open the session. In this way, when the client initiates a request, an identity identifier, namely SessionID, will be generated. It is saved on the client through a cookie. Each communication between the client and the server relies on this SessionID for identification.
After successful login, the user ID and user name will be stored in the session
$_SESSION[‘userid'] = 用户id $_SESSION[‘uname'] = 用户名
All future operations will check whether the user is logged in by judging whether $_SESSION['userid'] exists. The code is as follows:
if(isset($_SESSION['userid'])) return true;
The call to the password modification interface transmits data to the server through ajax post.
$.post("接口*******",
{
oldpass:oldpass,
newpass:newpass,
userid:uid,
},
function(data){
data = eval('(' +data+ ')');
$('.grant_info').html(infos[data.info]).show();
}
);
Note that I have written this code in the html page, so if you see the html code, you will know the interface address.
The interface for changing the password is implemented in this way. First, it is judged whether the user is logged in. If the user is logged in, the password modification operation will be performed.
The implementation idea of the test example is roughly as described above.
Using SessionID Attack
1. The first is to obtain the SessionID. Of course, there are many ways for attackers to obtain this ID. Due to my limited level, I will not introduce how to obtain it here. We can simulate it by first accessing this project normally, and then checking the SessionID through the browser to get a legal user ID. This ID can be seen in the request header
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Connection: keep-alive Cookie: Hm_lvt_bf1154ec41057869fceed66e9b3af5e7=1450428827,1450678226,1450851291,1450851486; PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7; Host: ****** Referer: ****** User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:41.0) Gecko/20100101 Firefox/41.0
After getting the session ID, if the user logs in successfully, then the user's information will be in the session on the server side.
2. After obtaining the SessionID, if the attacker already knows the interface for changing the password, he can directly change the user's password. If the attacker has not yet obtained the interface address, he or she can find out the interface address by looking at the page code. You can use the following command
#curl --cookie "PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7" 页面地址
As we said above, in this example the ajax code is written in the html page, so the interface address can be viewed on this page
Part of the html code is as follows
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
……
var uid = $(".userid").val();
$.post("/User/User/modifypass_do",
{
oldpass:oldpass,
newpass:newpass,
userid:uid,
},
function(data){
data = eval('(' +data+ ')');
$('.grant_info').html(infos[data.info]).show();
}
);
……
<span><input type="password" name="oldpass" id="textfield_o" placeholder="原密码"></span>
<span><input type="password" name="newpass" id="textfield_n" placeholder="新密码"></span>
<span><input type="password" name="confirmpass" id="textfield_c" placeholder="确认密码"></span>
<input type="button" class="btn_ok" value="确认修改" />
3. After getting the interface, you can use curl to simulate post to send data to change the password
The command is as follows
# curl --cookie "PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7" -d oldpass=111111 -d newpass=000000 -d userid=用户id 接口地址
If this user is already logged in, the attacker can change the user's password by executing the above command.
Solution
For the above attacks, we can enhance its security by complicating the verification method. One way is to use the User-Agent item in the request header to enhance its security
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Connection: keep-alive Cookie: Hm_lvt_bf1154ec41057869fceed66e9b3af5e7=1450428827,1450678226,1450851291,1450851486; PHPSESSID=2eiq9hcpu3ksri4r587ckt9jt7; Host: ****** Referer: ****** User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:41.0) Gecko/20100101 Firefox/41.0
At the beginning of the project, we just used the session_start() function to start the session. Now we can add this code below session_start()
$_SESSION[‘User_Agent'] = md5($_SERVER[‘HTTP_USER_AGENT']);
Then every time when judging whether to log in, add the following judgment conditions
If(isset($_SESSION[‘userid']) && $_SESSION[‘User_Agent'] == md5($_SERVER[‘HTTP_USER_AGENT'])){
return true;
}
This way you can avoid the simple attacks mentioned above.
Summary:
Of course, the actual attack is far from that simple. First, it is difficult to obtain the SessionID. Then, the code interacting with the server must be encrypted as much as possible to avoid the above situation. After we modify the code for the second time, we can increase the complexity of the attack, but it cannot eliminate the attack. There are many ways to attack. This is just a simple way and only provides one idea, but the principle is the same. In actual situations, the security of our code can be enhanced according to the actual situation.
Here I am just sharing the problems I encountered at work, and I hope everyone can learn more in depth.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
PHP 8.4 Installation and Upgrade guide for Ubuntu and Debian
Dec 24, 2024 pm 04:42 PM
PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals. This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati
How To Set Up Visual Studio Code (VS Code) for PHP Development
Dec 20, 2024 am 11:31 AM
Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems. With a large collection of extensions for many programming languages, VS Code can be c
Explain JSON Web Tokens (JWT) and their use case in PHP APIs.
Apr 05, 2025 am 12:04 AM
JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,
PHP Program to Count Vowels in a String
Feb 07, 2025 pm 12:12 PM
A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase. What is a vowel? Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase: a, e, i, o, u Example 1 Input: String = "Tutorialspoint" Output: 6 explain The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total
How do you parse and process HTML/XML in PHP?
Feb 07, 2025 am 11:57 AM
This tutorial demonstrates how to efficiently process XML documents using PHP. XML (eXtensible Markup Language) is a versatile text-based markup language designed for both human readability and machine parsing. It's commonly used for data storage an
Explain late static binding in PHP (static::).
Apr 03, 2025 am 12:04 AM
Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases?
Apr 03, 2025 am 12:03 AM
What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.
PHP and Python: Comparing Two Popular Programming Languages
Apr 14, 2025 am 12:13 AM
PHP and Python each have their own advantages, and choose according to project requirements. 1.PHP is suitable for web development, especially for rapid development and maintenance of websites. 2. Python is suitable for data science, machine learning and artificial intelligence, with concise syntax and suitable for beginners.
