PHP擴展--taint檢測隱藏漏洞

簡介

Taint 可以用來檢測隱藏的XSS code, SQL注入, Shell注入等漏洞, 並且這些漏洞如果要用靜態分析工具去排查, 將會非常困難, 比如對於如下的例子:

<?php
   echo $_GET["name"];
?>

對於請求:

http://localhost/?name=222

靜態分析工具, 往往無能為力, 而Taint卻可以准確無誤的爆出這類型問題.

Warning: Main::test() [function.echo]: Attempt to echo a string that might be tainted in

taint安裝

wget http://pecl.php.net/get/taint-1.2.2.tgz
tar zxvf taint-1.2.2.tgz
cd taint-1.2.2
/usr/local/php/bin/phpize
./configure --with-php-config=/usr/local/php/bin/php-config
make && make install

配置php.ini

[taint]
extension=taint.so
taint.enable=1
taint.error_level=E_WARNING

運行結果

php -i | grep taint
taint
taint support => enabled
taint.enable => On => On
taint.error_level => 2 => 2

###附錄

A. 驗證的字符串
所有來自 GET, ${}_{G}ET,$_POST, $_COOKIE的變量, 都被認為是Tainted String

B. taint檢測的函數/語句列表, 當這些函數使用tainted string參數的時候, taint會給出警告:

1. 輸出函數/語句系列

    echo
    print
    printf
    file_put_contents

2. 文件系統函數

    fopen
    opendir
    basename
    dirname
    file
    pathinfo

3. 數據庫系列函數/方法

    mysql_query
    mysqli_query
    sqlite_query
    sqlite_single_query
    oci_parse
    Mysqli::query
    SqliteDataBase::query
    SqliteDataBase::SingleQuery
    PDO::query
    PDO::prepare

4. 命令行系列

    system
    exec
    proc_open
    passthru
    shell_exec

5. 語法結構

    eval
    include(_once)
    require(_once)

C. 消除tainted信息的函數, 調用這些函數以后, tainted string就會變成合法的string:

escapeshellcmd
htmlspecialchars
escapeshellcmd
addcslashes
addslashes
mysqli_escape_string
mysql_real_escape_string
mysql_escape_string
sqlite_escape_string
PDO::quote
Mysqli::escape_string
Mysql::real_escape_string

D. 調用中保持tainted信息的函數/語句, 調用這些函數/語句時, 如果輸入是tainted string, 則輸出也為tainted string:

=
.
"{$var}
.=
strval
explode
implode
sprintf
vsprintf
trim
rtrim
ltrim

來自為知筆記(Wiz)