VULNS MITIGATION

1. File Upload Vulns - Only allow safe files to be updated.

2. Code Execution Vulns:

  • Don't use dangerous functions.
  • Filter use input before execution.

3. File inclusion:

  • Disable allow_url_fopen & allow_url_include.

Ethical Hacking - Web Penetration Testing(7)_php

  • Use static file inclusion.

Suggest using Hard Code Style, not using any variables, which is much more secure.

index.php?page=news.php

index.php
code:
include($_GET('page'));

index.php
code:
include('page.php');

 

相信未来 - 该面对的绝不逃避，该执著的永不怨悔，该舍弃的不再留念，该珍惜的好好把握。