php 测试 Web 应用程序中的安全漏洞：最佳实践？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/2351315/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Testing for security vulnerabilities in web applications: Best practices?
提问by Hyman
I'm developing a web application. Like, a proper one, I've used things like Joomla in the past to make awesome stuff but have now finally got my hands dirty with PHP, MySQL and CodeIgniter.
我正在开发一个网络应用程序。就像，一个合适的人，我过去使用过像 Joomla 这样的东西来制作很棒的东西，但现在我终于开始接触 PHP、MySQL 和 CodeIgniter。
When you're making serious web apps that'll handle large amounts of data, what precautions should I take against my data inputs to fully sanitise it? I know there's the obvious trim, escaping, xss cleaning, etc - but what other techniques should I incorporate to stop injections into the database?
当您正在制作将处理大量数据的严肃网络应用程序时，我应该对我的数据输入采取哪些预防措施以对其进行全面清理？我知道有明显的修剪、转义、xss 清理等 - 但是我应该采用哪些其他技术来停止注入数据库？
Not only that, but is there any non-destructive database injection code I can test all my inputs with? As in, it'll inject something visibile, but not actually do any harm to my test database? I'm not exactly a hacker and need a bit of guidance on this.
不仅如此，是否有任何非破坏性的数据库注入代码可以测试我的所有输入？就像，它会注入一些可见的东西，但实际上不会对我的测试数据库造成任何伤害？我不完全是一个黑客，需要一些关于这方面的指导。
What other common methods do hackers use to either destroy or read user's data, and how can I check for this myself? I don't have the money to hire a security consultant since I'm only 16 but have good experience with computers and I'm sure I could pull off a few tricks if given some hints as to what they are.
黑客使用哪些其他常见方法来破坏或读取用户数据，我该如何自己检查？我没有钱聘请安全顾问，因为我只有 16 岁，但我对计算机有很好的经验，我相信如果得到一些关于它们是什么的提示，我可以完成一些技巧。
I know that's a whole load of questions but to summarise, what do you do to make sure everything is 100% secure?
我知道这是一大堆问题，但总而言之，您如何确保一切都是 100% 安全的？
采纳答案by rook
SQL Injection and XSS are the most common mistakes that programmers make. The good news is that they are easiest to automatically test for, as long as you have the right software. When I am on a pentest I use Sitewatchor Wapitifor finding web application vulnerabilities. Acunetix is over priced.
SQL 注入和 XSS 是程序员最常犯的错误。好消息是，只要您拥有正确的软件，它们就最容易自动测试。在进行渗透测试时，我使用Sitewatch或Wapiti来查找 Web 应用程序漏洞。Acunetix 价格过高。
But, you can't just fire off some automated tool and expect everything to work. There are a number of precautions you must take with ANYvulnerability scanner you choose.
但是，您不能只是启动一些自动化工具并期望一切正常。对于您选择的任何漏洞扫描程序，您必须采取许多预防措施。
1) make sure display_errors=On in your php.ini Sql Injection tests rely on being able to see mysql error messages in the response pages! No error, no vulnerability detected!
1) 确保 php.ini Sql 注入测试中的 display_errors=On 依赖于能够在响应页面中看到 mysql 错误消息！没有错误，没有检测到漏洞！
2) Scan the authenticated areas of your application. Create a user account specifically for testing. Acuentix has an easy wizard where you can create a login sequence. If you are using wapiti you can give a cookie to wapiti or give wapiti a post request to fire off but this is kind of tricky.
2) 扫描应用程序的已验证区域。创建一个专门用于测试的用户帐户。Acuentix 有一个简单的向导，您可以在其中创建登录序列。如果你正在使用 wapiti，你可以给 wapiti 一个 cookie 或者给 wapiti 一个发帖请求来触发，但这有点棘手。
AFTERyou have tested your application then test your server for misconfiguration. To test your server then you need to run OpenVASwhich is the new more free version of Nessus which is now a commercial product. Then you should follow this up with PhpSecInfo. These tests will notify you of problems with your configuration or if you are running old vulnerable software.
在您测试了您的应用程序之后，请测试您的服务器是否配置错误。要测试您的服务器，您需要运行OpenVAS，它是 Nessus 的新免费版本，现在是商业产品。然后你应该用PhpSecInfo 跟进。这些测试将通知您配置问题或您是否正在运行旧的易受攻击的软件。
Nothing will ever be 100% secure, EVER. No matter what you do there are vulnerabilities that will slip though the cracks. There are vulnerabilities in all development platforms that lead a compromises that no tool can test for. There are also bugs in the testing tools you use. There are false posties and false negatives and some tests that just don't work, a good example i have never seen an automated CSRF tool that actually finds legit vulnerabilities. Acunetix's CSRF test is a complete waste of time.
没有什么是 100% 安全的， 永远。无论您做什么，都有漏洞会从裂缝中滑落。所有开发平台中都存在漏洞，导致任何工具都无法测试的妥协。您使用的测试工具中也存在错误。有假邮递和假阴性以及一些不起作用的测试，这是一个很好的例子，我从未见过真正发现合法漏洞的自动化 CSRF 工具。Acunetix 的 CSRF 测试完全是在浪费时间。
There is also the OWASP testing guidewhich goes into greater detail. This is not to be confused with the OWASP Top 10which is also an excellent resource. The PHP Security Guideis also a great resource for php programmers.
还有 更详细的OWASP 测试指南。不要将这与OWASP Top 10混淆，后者也是一个很好的资源。在PHP安全指南也是PHP程序员一个很好的资源。
回答by Rakesh Juyal
I don't have the money to hire a security consultant since I'm only 16You are 16 doesn't mean you don't have money to hire :D .
You don't need to hire anybody. There are many free online tools which you can use to test the vulnerability of your web application.
I don't have the money to hire a security consultant since I'm only 16你 16 岁并不意味着你没有钱雇用 :D。
你不需要雇佣任何人。您可以使用许多免费的在线工具来测试 Web 应用程序的漏洞。
Try using http://www.zubrag.com/tools/sql-injection-test.phpto test SQL Injection vulnerability
http://www.parosproxy.org: web traffic recorder, web spider, hash calculator, and a scanner for testing common web application attacks such as SQL injection and cross-site scripting
HP WebInspect software[ not free ] tests common web attacks such as parameter injection, cross-site scripting, directory traversal, [ try googling it ]
http://portswigger.net/suite/: Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.
尝试使用http://www.zubrag.com/tools/sql-injection-test.php测试 SQL 注入漏洞
http://www.parosproxy.org：网络流量记录器、网络蜘蛛、哈希计算器和扫描仪，用于测试常见的网络应用程序攻击，如 SQL 注入和跨站点脚本
HP WebInspect 软件[非免费] 测试常见的 Web 攻击，例如参数注入、跨站点脚本、目录遍历，[尝试使用谷歌搜索]
http://portswigger.net/suite/：打嗝套件是用于攻击Web应用程序的集成平台。它包含所有 Burp 工具，它们之间有许多接口，旨在促进和加速攻击应用程序的过程。所有工具共享相同的强大框架，用于处理 HTTP 请求、持久性、身份验证、上游代理、日志记录、警报和可扩展性。
回答by anonymous
Use WebCruiser Web Vulnerability Scanner to scan SQL Injection Vulnerabilities, WebCruiser is not only a Web Security Scanning Tool, but also an automatic SQL Injection Tool, an XPath Injection Tool, a XSS Tool.
使用WebCruiser Web Vulnerability Scanner 扫描SQL 注入漏洞，WebCruiser 不仅是Web 安全扫描工具，还是自动SQL 注入工具、XPath 注入工具、XSS 工具。
