OWASP-文件上传

后缀名：黑名单、白名单文件类型：MIME信息文件头：内容头信息

黑名单：明确不能上传的后缀，php，jsp，asp等白名单：明确能够上传的后缀，jpg，png，gif等等

塒NG：png的文件头xFFxD8：jpg的文件头GIF89a：gif的文件头

{".3gp",    "video/3gpp"},  {".apk",    "application/vnd.android.package-archive"},  {".asf",    "video/x-ms-asf"},  {".avi",    "video/x-msvideo"},  {".bin",    "application/octet-stream"},  {".bmp",    "image/bmp"},  {".c",  "text/plain"},  {".class",  "application/octet-stream"},  {".conf",   "text/plain"},  {".cpp",    "text/plain"},  {".doc",    "application/msword"},  {".docx",   "application/vnd.openxmlformats-officedocument.wordprocessingml.document"},  {".xls",    "application/vnd.ms-excel"},   {".xlsx",   "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},  {".exe",    "application/octet-stream"},  {".gif",    "image/gif"},  {".gtar",   "application/x-gtar"},  {".gz", "application/x-gzip"},  {".h",  "text/plain"},  {".htm",    "text/html"},  {".html",   "text/html"},  {".jar",    "application/java-archive"},  {".java",   "text/plain"},  {".jpeg",   "image/jpeg"},  {".jpg",    "image/jpeg"},  {".js", "application/x-javascript"},  {".log",    "text/plain"},  {".m3u",    "audio/x-mpegurl"},  {".m4a",    "audio/mp4a-latm"},  {".m4b",    "audio/mp4a-latm"},  {".m4p",    "audio/mp4a-latm"},  {".m4u",    "video/vnd.mpegurl"},  {".m4v",    "video/x-m4v"},   {".mov",    "video/quicktime"},  {".mp2",    "audio/x-mpeg"},  {".mp3",    "audio/x-mpeg"},  {".mp4",    "video/mp4"},  {".mpc",    "application/vnd.mpohun.certificate"},         {".mpe",    "video/mpeg"},    {".mpeg",   "video/mpeg"},    {".mpg",    "video/mpeg"},    {".mpg4",   "video/mp4"},     {".mpga",   "audio/mpeg"},  {".msg",    "application/vnd.ms-outlook"},  {".ogg",    "audio/ogg"},  {".pdf",    "application/pdf"},  {".png",    "image/png"},  {".pps",    "application/vnd.ms-powerpoint"},  {".ppt",    "application/vnd.ms-powerpoint"},  {".pptx",   "application/vnd.openxmlformats-officedocument.presentationml.presentation"},  {".prop",   "text/plain"},  {".rc", "text/plain"},  {".rmvb",   "audio/x-pn-realaudio"},  {".rtf",    "application/rtf"},  {".sh", "text/plain"},  {".tar",    "application/x-tar"},     {".tgz",    "application/x-compressed"},   {".txt",    "text/plain"},   {".wav",    "audio/x-wav"},  {".wma",    "audio/x-ms-wma"},  {".wmv",    "audio/x-ms-wmv"},  {".wps",    "application/vnd.ms-works"},  {".xml",    "text/plain"},  {".z",  "application/x-compress"},  {".zip",    "application/x-zip-compressed"},  {"",        "*/*"}  

塒NG：png的文件头xFFxD8：jpg的文件头GIF89a：gif的文件头

#$_FILES函数$_FILES[‘upfile’][‘name’]; //客户端上传文件的原名称，不包含路径$_FILES[‘upfile’][‘type’]; //上传文件的MIME类型$_FILES[‘upfile’][‘tmp_name’]; //已上传文件在服务器端保存的临时文件名，包含路径$_FILES[‘upfile’][‘error’]; //上传文件出现的错误号，为一个整数$_FILES[‘upfile’][‘size’]; //已上传文件的大小，单位为字节

移除字符串两侧的空白字符或其他预定义字符。windiws系统下，对文件名中空格会被作为空处理，程序中的检验代码却不能自动删除空格。从而绕过黑名单

windows系统下，文件后缀名最后一个点会被自动去除，如果在上传中，没把末尾的.去除则会绕过。例如 windows下新建一个1.php. 文件，会自动更正为1.php

1、只有apache具有此文件2、 .htaccess文件(分布式配置文件)是针对每个目录改变配置的方法，就是把.htaccess文件放在一个目录中，其中里面的指令作用于此目录及其所有子目录。3、上传漏洞指令：<FilesMatch "myqf"SetHandler application/x-httpd-php</FilesMatch123

1、服务器脚本语言为PHP2、服务器使用CGI／FastCGI模式3、上传目录下要有可执行的php文件.user.ini作用:所有的php文件都自动包含jpg文件

在window的时候如果文件名+"::$DATA"会把::$DATA之后的数据当成文件流处理,不会检测后缀名，且保持::$DATA之前的文件名，他的目的就是不检查后缀名例如:"phpinfo.php::$DATA“Windows会自动去掉末尾的::$DATA变成"phpinfo.php”

作用：将字符串里的php替换为空一次过滤：1.php --> 1.[空]1.phphpp --> 1.php循环过滤(递归过滤)1.php --> 1.[空]1.phphpp --> 1.[空]

前提：php的版本要小于5.3.4并且魔术引号必须关闭%00：主要针对地址上的截断 (url)0x00截断：主要针对文件命名上的截断0x：16进制表示00：表示00x00：就是代表16进制的0有的函数在处理这个字符时，会当做结束符%00 和 00 是一样的，只是在get提交时，经过url编码后，00就成了%00get会自动解码一次，而post方式不行，需要手动解码

服务端优先接收get 方式提交的参数案例：get url: /upload/1.php%00post : /upload/1.php解码后的%00把目录截断成1.php post 的内容自动转到1.php 里