如何发布具有超重编码的数据来测试漏洞？ [英] How can I post data with overlong encoding to test for vulnerabilities?

问题描述

我最近了解到，超重编码会导致安全风险没有正确验证。从前面提到的帖子中的答案：

I recently learned that overlong encodings cause a security risk when not properly validated. From the answer in the previously mentioned post:

例如，通常表示为0x3C字节，但
也可以使用超长的UTF-8序列0xC0 0xBC
（或更多冗余的3或4字节序列）来表示。

For example the character < is usually represented as byte 0x3C, but could also be represented using the overlong UTF-8 sequence 0xC0 0xBC (or even more redundant 3- or 4-byte sequences).

And：

如果你接受这个输入并处理它基于Unicode的基于字节的
工具，那么在该工具中使用的任何字符处理步骤都可以避免
。

If you take this input and handle it in a Unicode-oblivious byte-based tool, then any character processing step being used in that tool may be evaded.

这意味着如果我在使用超级编码的字符串上使用 htmlspecialchars ，那么输出仍然可以包含标签。我也假设你可以发布类似的字符（如或; ），这也可以用于SQL注入。

Meaning that if I use htmlspecialchars on a string that uses overlong encoding, then the output could still contain tags. I also assume that you could post similar characters (like " or ;) which could also be used for SQL injections.

也许是我，但我相信这是一个相对较少的人们考虑到甚至知道的安全风险，我已经编码了多年，只有现在找到这个。

Perhaps it is me, but I believe that this is a security risk relatively few people take into account and even know about. I've been coding for years and am only now finding this out.

无论如何，我的问题是：我可以使用什么工具来发送带有超重编码的数据？熟悉的人这个风险：你如何在网站上执行测试？我想在我的网站上发布一堆超长字符，但我不知道该怎么做。

Anyway, my question is: what tools can I use to send data with overlong encodings? People who are familiar with this risk: how do you perform tests on websites? I want to POST a bunch of overlong characters to my sites, but I have no idea how to do this.

我的情况我主要使用PHP和MySQL，但我真正想知道的是测试工具，所以我猜后端情况并不重要。

In my situation I mostly use PHP and MySQL, but what I really want to know are testing tools, so I guess the back-end situation does not matter much.

推荐答案

要测试您的网站是否容易受损，请使用curl使用post来编辑页面，并将编码输入到utf8 long和post utf8长编码信息（您可以使用文本编辑器将文本编辑器设置为utf8长，因此您使用curl发布的文本和php文件很长）

To test if your site is vulnerable use curl to fets your page using post and the encoding to the utf8 long and post utf8 long encoded information(you could use your text editor for this by setting the text editor encoding to utf8 long so the text you post using curl and the php file is in long)

http://php.net/manual/en/function.curl-setopt.php

这篇关于如何发布具有超重编码的数据来测试漏洞？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！