浅析CSRF
< p > ToBankId: < input type ="text" name ="toBankId" /> p >
< p > Money: < input type ="text" name ="money" /> p >
< p >< input type ="submit" value =" Transfer " /> p >
form >
phpsession_start ();
if ( isset ( $_REQUEST [ ' toBankId ' ] && isset ( $_REQUEST [ ' money ' ]))
{
buy_stocks( $_REQUEST [ ' toBankId ' ] , $_REQUEST [ ' money ' ]);
}
?>
phpsession_start ();
if ( isset ( $_POST [ ' toBankId ' ] && isset ( $_POST [ ' money ' ]))
{
buy_stocks( $_POST [ ' toBankId ' ] , $_POST [ ' money ' ]);
}
?>
< html > < head >
< script type ="text/javascript" >
function steal()
{
iframe = document.frames[ " steal " ];
iframe.document.Submit( " transfer " );
}
script >
head >
< body onload ="steal()" >
< iframe name ="steal" display ="none" >
< form method ="POST" name ="transfer" action ="http://www.myBank.com/Transfer.php" >
< input type ="hidden" name ="toBankId" value ="11" >
< input type ="hidden" name ="money" value ="1000" >
form >
iframe >
body >
html >
// 构造加密的Cookie信息
$value = “DefenseSCRF”;
setcookie (”cookie” , $value , time () + 3600 );
?>
php $hash = md5 ( $_COOKIE [ ' cookie ' ]);
?>
< form method = ”POST” action = ”transfer . php” >
< input type = ”text” name = ”toBankId” >
< input type = ”text” name = ”money” >
< input type = ”hidden” name = ”hash” value = ” $hash ; ?> ” >
< input type = ”submit” name = ”submit” value = ”Submit” >
form >
phpif ( isset ( $_POST [ ' check ' ])) {
$hash = md5 ( $_COOKIE [ ' cookie ' ]);
if ( $_POST [ ' check ' ] == $hash ) {
doJob();
} else {
//...
}
} else {
//...
}
?>
(2).验证码
php function gen_token() {
//这里我是贪方便，实际上单使用Rand()得出的随机数作为令牌，也是不安全的。
//这个可以参考我写的Findbugs笔记中的《Random object created and used only once》
$token = md5 ( uniqid ( rand () , true ));
return $token ;
}
phpfunction gen_stoken() {
$pToken = "" ;
if( $_SESSION [STOKEN_NAME] == $pToken ){
//没有值，赋新值
$_SESSION [STOKEN_NAME] = gen_token() ;
}
else{
//继续使用旧的值
}
}
?>
function gen_input() {gen_stoken();
echo “ value=\”" . $_SESSION[STOKEN_NAME] . “\”> “;
}
?>
phpsession_start ();
include (”functions . php”);
?>
< form method = ”POST” action = ”transfer . php” >
< input type = ”text” name = ”toBankId” >
< input type = ”text” name = ”money” >
gen_input(); ?>
< input type = ”submit” name = ”submit” value = ”Submit” >
FORM >
本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！