Einführung
Taint is an extension, which is used for detecting XSS codes(tainted string). And also can be used to spot sql injection vulnerabilities, and shell inject, etc.
When taint is enabled, if you pass a tainted string (comes from $_GET, $_POST or $_COOKIE) to some functions, taint will warn you about that.
Beispiel #1 Taint()example
<?php
$a = trim($_GET['a']);
$file_name = '/tmp' . $a;
$output = "Welcome, {$a} !!!";
$var = "output";
$sql = "Select * from " . $a;
$sql .= "ooxx";
echo $output;
print $$var;
include($file_name);
mysql_query($sql);
?>
Das oben gezeigte Beispiel erzeugt eine ähnliche Ausgabe wie:
Warning: main() [function.echo]: Attempt to echo a string that might be tainted Warning: main() [function.echo]: Attempt to print a string that might be tainted Warning: include() [function.include]: File path contains data that might be tainted Warning: mysql_query() [function.mysql-query]: SQL statement contains data that might be tainted
Hier Kannst Du einen Kommentar verfassen
Es sind noch keine Kommentare vorhanden.
