Crack explanation:
php is one section the programming language which widely uses, may with do by the nesting in html the web procedure development. phpinfo() is uses for to demonstrate that the current php environment a function, many stands and the procedure can place phpinfo in own stand or demonstrated in the procedure, but in phpinfo has some security problems, causes the careful structoral data to be possible to have a cross station script crack, may use for to carry on the attack.
Crack origin: the phpinfo page has made the detailed filtration to the input parameter, but has not carried on charset to the output assigning, but in some browsers like in IE7, you may let its automatic selection code or assigns the code through a iframe page to it, like this may forgive phpinfo the filtration to have a cross station script crack.
Crack origin: http://www.80sec.com/release/phpinfo-xss.txt
Crack use: Is as follows using the code:
<html>
<head>
<META HTTP-EQUIV= " CONTENT-TYPE " CONTENT= " text/html; charset=UTF-7 " >
</head>
<body>
<iframe src= " http://www.80sec.com/phpinfo.php?+ADw-SCRIPT+AD4-alert(document.domain);+ADw-/SCRIPT+AD4-=1 " >
The above code 5.2.6 tests successfully in IE7+php. phpinfo page's xss even compares other pages to be more dangerous, if because has the phpinfo existence, the malicious aggressor may use phpinfo output bypass like httponly and some foundation authentication.
Crack influence: Affects all editions php and browser IE7
Crack patching: The suggestion deletes the stand the phpinfo page to avoid temporarily by the person use.
|
You are here: hacking technology
> crack analyzes
> Content
Category: Home
> crack analyzes