我认为我的 PHP 应用程序被会话劫持了？
我有一个 php 站点，允许注册用户登录（使用有效密码）并根据他们的 UserID 设置会话。但是我很确定这是被劫持的，并且我在我的服务器上发现了我没有放在那里的“新”文件。我的网站清除了 SQL 注入和 XSS 的所有用户输入，但这种情况不断发生。有谁对如何解决这个问题有任何想法？
I have a php site that lets registered users login (with a valid passord) and sets up a session based on their UserID. However I'm pretty sure thisis being hijacked and I've found "new" files on my server I didn't put there. My site cleans all user input for SQL injections and XSS but this keeps happening. Has anyone got any ideas on how to solve this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
会话 cookie 劫持不应允许攻击者在您的服务器上创建新文件。它所能做的就是授予对经过身份验证的用户会话的访问权限。这取决于您的代码和/或服务器的配置是否允许将任意文件上传到站点的 webroot。
要检查远程妥协命中，请获取可疑文件（searches.php、7.php.jpg）等的文件创建时间，然后梳理服务器日志以查看该时间段内发生的情况。如果您将会话 ID 与其余的命中一起记录，您可以轻松地查看会话是否被劫持，因为在会话的生命周期中它将被两个或多个不同的 IP 使用。如果原始用户从一个 ISP 登录，然后突然跳到另一个完全不同的 ISP，情况会尤其明显。
当然，您的会议是如何实施的？曲奇饼？ PHP trans_sid（在隐藏表单字段和查询字符串中传递会话）？ trans_sid 特别容易受到劫持，因为仅共享指向您网站的链接的行为也会传输会话 ID，并且您网站上的任何外部链接都会在 HTTP 引荐来源网址中显示会话 ID。
A session cookie hijacking should NOT allow an attacker to create new files on your server. All it could do is given access to an authenticated user's session. It'd be up to your code, and/or the server's configuration that would allow uploading arbitrary files to the site's webroot.
To check for remote compromise hits, get the file creation times of the suspicious files (searches.php, 7.php.jpg) etc..., then comb through your server's logs to see what was happening around that time. If you're logging the session ID along with the rest of the hit, you could trivially see if the session was hijacked, as it would be used from two or more different IPs during the session's lifetime. It'd be especially obviously if the original user logged in from one ISP, then suddenly appeared to jump to a completely different ISP.
And of course, how are your sessions implemented? Cookies? PHP trans_sid (passing the session in hidden form fields and query strings)? trans_sid is especially vulnerable to hijacking, as the mere act of sharing a link to something your site also transmits the session ID, and any external links on your site will have the session ID show up in the HTTP referer.
PHP 专家提出的解决方案是在每次提交表单时使用唯一的密钥/令牌，看看 net-tutes 的想法。
不要忘记查看 PHP 安全指南。。它涵盖的主题包括 XSS、表单欺骗、SQL 注入、会话劫持、会话固定等。
请记住，始终在查询中使用正确的数据类型，例如在数字前使用
int或intval函数，并在字符串值中使用mysql_real_escape_string函数。示例：您还可以在查询中使用前置语句。
保护 PHP 应用程序安全的热门项目：
The solution that PHP experts have come up with is to use unique keys/tokens with each submission of the forms, have a look at the idea here at net-tutes.
Don't forget have a look at the PHP Security Guide.. It covers topics including XSS, Form Spoofing, SQL Injection, session hijacking, session fixation and more.
Remember, always use proper data types in your queries, for example use the
intorintvalfunction before numbers andmysql_real_escape_stringfunction for the string values. Example:You may also use the prepend statements for your queries.
Popular Project To Secure PHP Applications:
我之前就说过，你的“cookie”很容易猜到。
有些网站，当用户登录时，只创建一个 cookie，并且身份验证代码仅检查 cookie 是否存在。
现在，如果我注册并登录到您的网站，然后打开您的 cookie，并注意到您只存储了我的用户 ID，那么我可以将该值操纵为其他用户 ID，瞧！
你明白了。
I'll have ago and say that your 'cookie' is easy to guess.
Some sites, when the user logs, just create a cookie and the authentication code just checks for the EXISTENCE of a cookie.
Now, if I register and login to your site and then cut your cookie open and notice that you just store my user id then I can manipulate the value to some other user id and voila!
You get the idea.