DVWA之弱會話IDs（Weak Session IDs）

弱會話IDs（Weak Session IDs）

Security Level: low

源碼

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    if (!isset ($_SESSION['last_session_id'])) {
        $_SESSION['last_session_id'] = 0;
    }
    $_SESSION['last_session_id']++;
    $cookie_value = $_SESSION['last_session_id'];
    setcookie("dvwaSession", $cookie_value);
}
?>

           

分析

，清楚一下浏覽器的cookie值，送出後發現直接登入dvwa，繞過密碼驗證：

進行下方的實驗

Security Level: medium

源碼

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    $cookie_value = time();
    setcookie("dvwaSession", $cookie_value);
}
?>

           

分析

通過設定時間戳，可知誘騙受害者在某個時間點基進行點選

進行下方實驗

可以僞造登陸時間了

Security Level: high

源碼

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    if (!isset ($_SESSION['last_session_id_high'])) {
        $_SESSION['last_session_id_high'] = 0;
    }
    $_SESSION['last_session_id_high']++;
    $cookie_value = md5($_SESSION['last_session_id_high']);
    setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], false, false);
}

?> 
           

進行下方實驗

這看着好像md5

下面步驟同low

Security Level: impossible

源碼

<?php

$html = "";

if ($_SERVER['REQUEST_METHOD'] == "POST") {
    $cookie_value = sha1(mt_rand() . time() . "Impossible");
    setcookie("dvwaSession", $cookie_value, time()+3600, "/vulnerabilities/weak_id/", $_SERVER['HTTP_HOST'], true, true);
}
?> 
           

分析

采用随機數+時間戳+固定字元串"Impossible"，再進行sha1運算