奇淫巧计-绕过filter_var和parse_url

使用特定的过滤器过滤一个变量但是可用如下方式绕过，如下图二三：http://localhost/index.php?url=http://demo.com@sec-redclub.comhttp://localhost/index.php?url=http://demo.com&sec-redclub.comhttp://localhost/index.php?url=http://demo.com?sec-redclub.comhttp://localhost/index.php?url=http://demo.com/sec-redclub.comhttp://localhost/index.php?url=demo://demo.com,sec-redclub.comhttp://localhost/index.php?url=demo://demo.com:80;sec-redclub.com:80/http://localhost/index.php?url=http://demo.com#sec-redclub.comPS:最后一个payload的#符号，请换成对应的url编码 %23

解析 URL，返回其组成部分

<?php$url = $_GET['url'];//$url $_GET传入url参数if(isset($url) && filter_var($url, FILTER_VALIDATE_URL)){//如果存在和filter_var过滤url,但是可以http://[email protected]绕过    $site_info = parse_url($url);//$site_info parse_url函数分解$url    if(preg_match('/sec-redclub.com$/',$site_info['host'])){//preg_match判定如果$site_info的host末尾含sec-redclub.com        exec('ping "'.$site_info['host'].'"', $result);//执行curl $site_info['host']，并返回结果        echo "<center><h1>You have curl {$site_info['host']} successfully!</h1></center>              <center><textarea rows='20' cols='90'>";//输出curl成功        echo implode(' ', $result);//将数组数据implode连接并输出的结果    }    else{        die("<center><h1>Error: Host not allowed</h1></center>");//否则输出错误    }
}else{    echo "<center><h1>Just curl sec-redclub.com!</h1></center><br>//否则输出只能访问sec-redclub.com          <center><h3>For example:?url=http://sec-redclub.com</h3></center>";}
?>