PHP通过url进行攻击
我的网站最近遭到攻击，在日志中我发现了一些请求，例如：
我在根目录中发现了一些可疑文件和文件夹，并且有人在主页上写道“您被黑客攻击了”。
其中一个文件夹是“lentenfish” 具有诸如“sql.php”、“cof.pl”、“.htaccess”、“jen.jeen”之类的文件
mysite.com/view_news.php?id=-999.9 UNION ALL SELECT 0x31303235343830303536,0x31303235343830303536,0x31303235343830 303536,0x31303235343830303536,0x31303235343830303536--
和
/?<'IMG SRC="javascript:alert(cross_site_scripting.nasl);">
和
/?ho+{COMPLETE_VERSION}
和
/admin/ ?email=../admin/noop.cgi?foo=bar&test=blah
和
/admin/?password=../../../../../../../../windows/win.ini
还有更多:(
我不知道不知道问题出在哪里以及如何解决。
我的网站是用 php 编写的，后端是 MySql，
所以请帮我解决这个问题
。
my website was recently attacked and in the log i found some requests like :
I found some suspicious files and folders in my root directory and someone has written on home page that "you are hacked".
one of the folder is "lentenfish"
having files like "sql.php" , "cof.pl" , ".htaccess" ,"jen.jeen"
mysite.com/view_news.php?id=-999.9 UNION ALL SELECT 0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536--
and
/?<'IMG SRC="javascript:alert(cross_site_scripting.nasl);">
and
/?ho+{COMPLETE_VERSION}
and
/admin/?email=../admin/noop.cgi?foo=bar&test=blah
and
/admin/?password=../../../../../../../../windows/win.ini
and many more :(
i don't know where the problem is and how to solve.
My website is written in php and the backend is MySql.
So Please help me out in solving this.
Thanks !
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
第一个是尝试 SQL 注入
第二个是窥探XSS（跨站点脚本）漏洞。
不确定第三个，但其他看起来像是在窥探管理员密码。
您可能只想阅读服务器和浏览器安全性。这可能是自动攻击，但了解这些问题很重要。
The first one is an attempt at SQL injection
The second is snooping for XSS (Cross-Site-Scripting) vulnerability.
Not sure about the third, but the others look like snooping for admin passwords.
You might want to just read up server and browser securty. This could be an automated attack, but it's important to be aware of these issues.
黑客使用一种称为远程文件包含的技术将代码注入到页面的动态包含中。您的 view_news.php 文件可能有一个包含内容，它不会“排除”您不希望人们查看的任何内容。列出允许包含在 view_news.php 中的所有页面，如果使用其他内容，则不执行任何操作。
The hacker has injected code into a dynamic include in your page using a technique called Remote File Inclusion. Its likely your view_news.php file has an include that doesn't 'exclude' anything that you don't want people to view. Make a list of all the pages allowed to be included in view_news.php and simply do nothing if anything else is used.
这并不能说明问题。它表明自动扫描程序正在尝试使用标准安装位置的 PHP 应用程序中的众所周知的错误来查找问题。是什么让你认为有问题？
This doesn't show a problem. It shows that an automated scanner is trying to find a problem using well-known bugs in PHP apps at standard install locations. What makes you think there's a problem?
你知道是否造成了实际损害吗？
对我来说，这似乎是所谓的模糊测试，攻击者使用脚本自动扫描可能存在的漏洞，以期获得幸运。如果是这种情况，即使您应该使用安全代码实践来避免成功的攻击，您也不必真正担心任何具体问题。
剧本是你自己写的吗？如果不是，请尝试升级到最新版本。如果是，请了解不同类型的漏洞以保护自己免受攻击。
Do you know if there was any actual damage done?
To me that seems to be so-called fuzzing, where an attacker uses a script to automatically scan for vulnerabilities that might be there in the hopes of getting lucky. If this is the case you don't really have anything specific worry about, even though you should use safe code practices to avoid a successful attack.
Did you write the script yourself? If no, try to upgrade to the latest version. If yes, learn about different kinds of vulnerabilities to protect yourself from attacks.
您首先需要找出哪些请求实际上导致您的网站被黑客攻击。脚本小子使用自动化程序尝试利用已知漏洞侵入网站。因此，在日志中看到此类请求是很常见的。如果您遭到黑客攻击，那么您需要找出哪些请求是负责的，哪些请求只是未成功的自动化测试。
You first need to find out which of those requests actually caused your website to be hacked. Script kiddies use automated programs to try to break into websites using known vulnerabilities. Therefor, it is very common to see these kinds of requests in your log. If you were hacked then you need to find out what request is responsible and which requests are just automated tests that did not succeed.