WooYun.org

public function initLogHacker() {
		/*get*/
		foreach($_GET as $key=>$value){
			if (!in_array($key, array('ac','a','c','do'))){//防止控制器和方法命名不规范被过滤
				$this->StopAttack($key,$value,"get",$this->getfilter);
				
				$_GET[$key] = StringUtil::safe_replace($value);
				$_GET[$key] = StringUtil::remove_xss($_GET[$key]);
			}
		}

private function inject_check($sql_str) {      
	  return eregi('select|insert|\'|\/\*|\*|\.\.\/|\.\/|union|into|and|or|load_file|outfile', $sql_str);// 进行过滤      
	}.........
private function StopAttack($StrFiltKey,$StrFiltValue,$method,$ArrFiltReq){
		$StrFiltValue = strtolower($StrFiltValue);
		if(is_array($StrFiltValue)) {
			$StrFiltValue=implode($StrFiltValue);
		}
		if ($this->inject_check($StrFiltValue) || preg_match ( "/" . $ArrFiltReq . "/is", $StrFiltValue ) == 1){
			if ($method == 'cookie') {
				$_COOKIE[$StrFiltKey] = '';
				$this->logAttack($StrFiltValue,$method);
			}
			if ($method == 'get') {
				$_GET[$StrFiltKey] = '';
				$this->logAttack($StrFiltValue,$method);
			}
			if ($method == 'post') {
				$_POST[$StrFiltKey] = '';
				$this->logAttack($StrFiltValue,$method);
			}
		}
	}
	private function logAttack($StrFiltValue,$method) {
		$attackStr = "<br><br>SubmitIP:".$_SERVER["REMOTE_ADDR"]."<br>SubmitTime:".strftime("%Y-%m-%d %H:%M:%S")."<br>SubmitPage:".$_SERVER["REQUEST_URI"]."<br>SubmitMethod:".$_SERVER["REQUEST_METHOD"]."<br>SubmitParams:".NetUtil::get_url()."<br>SubmitData:".$StrFiltValue;
		$mailObj = new Email();
		$this->url = NetUtil::get_url();
		$this->ip = NetUtil::getIp();
		$this->str = $attackStr;
		$this->killip = 0;
		$this->method = $method;
		$this->addtime = time();
		$row = $this->query("select id from ".TABLEPRE."attack where ip='".NetUtil::getIp()."'");
		if (count($row) > 5) {
			$this->id = $row[0]["id"];
			$this->killip = 1;
			$this->update();
		} else {
			$this->save();
		}
		if (Config::get('attackmail') == 1) {
			$mailObj->Subject = "WebSite Attack Notice";
			$mailObj->Body = $attackStr;
			$mailObj->sendMail();
		}
	}
}

public static function safe_replace($string) {
		$string = strtolower($string);
		$string = str_replace("_", '\_', $string); // 把 '_'过滤掉   
    		$string = str_replace("%", '\%', $string); // 把' % '过滤掉
		$string = str_replace('%20', '', $string);
		$string = str_replace('%27', '', $string);
		$string = str_replace('%2527', '', $string);
		$string = str_replace('*', '', $string);
		$string = str_replace('"', '"', $string);
		$string = str_replace("'", '', $string);
		$string = str_replace('"', '', $string);
		$string = str_replace(';', '', $string);
		$string = str_replace('<', '&lt;', $string);
		$string = str_replace('>', '&gt;', $string);
		$string = str_replace("{", '', $string);
		$string = str_replace('}', '', $string);
		$string = str_replace('\\', '', $string);
		$string = str_replace('or', '', $string);
		$string = str_replace('insert', '', $string);
		$string = str_replace('select', '', $string);
		$string = str_replace('delete', '', $string);
		$string = str_replace('and', '', $string);
		$string = str_replace('union', '', $string);
		$string = str_replace('load_file', '', $string);
		$string = str_replace('outfil', '', $string);
		$string = str_replace('truncate', '', $string);
		$string = str_replace('..', '', $string);
		$string = str_replace('//', '/', $string);
		$string = str_replace('http:/', 'http://', $string);
		return $string;
	}