Skip to content

Commit a0bc69e

Browse files
author
exploit
committed
bugfix for analyse function
1 parent 2b3ec28 commit a0bc69e

File tree

7 files changed

+47
-49
lines changed

7 files changed

+47
-49
lines changed

‎CFGGenerator.php‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1083,4 +1083,30 @@ public function sinkTracebackBlock($argName,$block,$flowsNum){
10831083
}
10841084
}
10851085

1086+
//扫描漏洞类型
1087+
$scan_type = 'ALL';
1088+
echo "<pre>" ;
1089+
//从用户那接受项目路径
1090+
// $project_path = 'C:/users/xyw55/Desktop/test/simple-log_v1.3.1/upload';
1091+
// $allFiles = FileUtils::getPHPfile($project_path);
1092+
// //初始化
1093+
// $initModule = new InitModule() ;
1094+
// $initModule->init($project_path) ;
1095+
1096+
$cfg = new CFGGenerator() ;
1097+
$visitor = new MyVisitor() ;
1098+
$parser = new PhpParser\Parser(new PhpParser\Lexer\Emulative) ;
1099+
$traverser = new PhpParser\NodeTraverser ;
1100+
$path = CURR_PATH . '/test/test.php';
1101+
$cfg->getFileSummary()->setPath($path);
1102+
$code = file_get_contents($path);
1103+
$stmts = $parser->parse($code) ;
1104+
$traverser->addVisitor($visitor) ;
1105+
$traverser->traverse($stmts) ;
1106+
$nodes = $visitor->getNodes() ;
1107+
$pEntryBlock = new BasicBlock() ;
1108+
$pEntryBlock->is_entry = true ;
1109+
$ret = $cfg->CFGBuilder($nodes, NULL, NULL, NULL) ;
1110+
1111+
10861112
?>

‎analyser/TaintAnalyser.class.php‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -573,10 +573,9 @@ public function isSanitization($type,$var,$saniArr,$encodingArr){
573573
* @param FileSummary 当前文件摘要
574574
*/
575575
public function analysis($block, $node, $argName, $fileSummary){
576-
577576
//传入变量本身就是source
578-
$argName = substr($argName, 0, strpos($argName, '['));
579-
if(in_array($argName, $this->sourcesArr)){
577+
$varName = substr($argName, 0, strpos($argName, '['));
578+
if(in_array($varName, $this->sourcesArr)){
580579
//报告漏洞
581580
$path = $fileSummary->getPath() ;
582581
$type = TypeUtils::getTypeByFuncName(NodeUtils::getNodeFunctionName($node)) ;
@@ -604,12 +603,12 @@ public function analysis($block, $node, $argName, $fileSummary){
604603
* @param string 漏洞的类型
605604
*/
606605
public function report($node_path, $var_path, $node, $var, $type){
607-
// echo "<pre>" ;
608-
// echo "有漏洞=====>". $type ."<br/>" ;
609-
// echo "漏洞变量：<br/>" ;
610-
// print_r($var) ;
611-
// echo "漏洞节点：<br/>" ;
612-
// print_r($node) ;
606+
echo "<pre>" ;
607+
echo "有漏洞=====>". $type ."<br/>" ;
608+
echo "漏洞变量：<br/>" ;
609+
print_r($var) ;
610+
echo "漏洞节点：<br/>" ;
611+
print_r($node) ;
613612

614613
//获取结果集上下文
615614
$resultContext = ResultContext::getInstance() ;

‎context/ClassFinder.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ public function getRequireFileFuncs($path,$require_array){
183183
* @param 函数的信息 $mehod
184184
* @return 函数体
185185
*/
186-
public function getFunction($path,$method){
186+
public function getFunction($path, $method){
187187
//设置code
188188
if (!$path)
189189
return null;

‎data/resultConetxtSerialData/D__MySoftware_wamp_www_code_phpvulhunter_test_test.php‎

Whitespace-only changes.

‎main.php‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,6 @@ function convertResults($resContext){
8484
exit() ;
8585
}
8686

87-
//项目开始时间
88-
$t_start = time();
8987

9088
//1、从web ui中获取并加载项目工程
9189
$project_path = $_POST['path'] ; //扫描的工程路径
@@ -119,22 +117,8 @@ function convertResults($resContext){
119117
load_file($project_path) ;
120118
}elseif (is_dir($project_path)){
121119
$path_list = $mainlFiles;
122-
//$path_list = array('C:/users/xyw55/Desktop/test/simple-log_v1.3.1/upload/admin/admin.php');
123-
//$path_list = array('C:/users/xyw55/Desktop/test/74cms_3.3/plus/ajax_street.php');
124-
// $path_list = array('C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/allTests.php',
125-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/CachingTest.php',
126-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/EventTest.php',
127-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/ExceptionTest.php',
128-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/FilterTest.php',
129-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/InitTest.php',
130-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/MonitorTest.php',
131-
// 'C:/Users/xyw55/Desktop/test/dvwa/external/phpids/0.6/tests/IDS/ReportTest.php');
132-
$path_list = array(
133-
'C:/Users/xyw55/Desktop/test/dvwa/vulnerabilities/upload/source/low.php'
134-
);
135120
foreach ($path_list as $path){
136121
try{
137-
print_r($path.'<br/>');
138122
load_file($path) ;
139123
}catch(Exception $e){
140124
continue ;
@@ -151,10 +135,6 @@ function convertResults($resContext){
151135
file_put_contents($serialPath, serialize($results)) ;
152136
}
153137

154-
//项目结束时间
155-
$t_end = time();
156-
$t = $t_end - $t_start;
157-
print_r($t);
158138

159139

160140
//5、处理results 传给template

‎test/test.php‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,5 @@
11
<?php
22
$id = $_GET['id'] ;
3-
if($id){
4-
echo $id ;
5-
}else{
6-
echo false;
7-
}
8-
9-
$sql = "xxx". $id ;
10-
mysql_query($sql) ;
11-
3+
$id.="xxxx";
4+
echo $id ;
125
?>

‎views/template_c/ec4feeb21b21903d6f3d0b9b7aad22aa8062f668_0.file.navigation.html.php‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,29 @@
1-
<?php /* Smarty version 3.1.23, created on 2015-05-21 13:34:13
1+
<?php /* Smarty version 3.1.23, created on 2015-05-23 15:14:40
22
compiled from "views/template/navigation.html" */ ?>
33
<?php
4-
/*%%SmartyHeaderCode:4125555dc2b56e4564_89075330%%*/
4+
/*%%SmartyHeaderCode:1621955607d40c52a77_64501409%%*/
55
if(!defined('SMARTY_DIR')) exit('no direct access allowed');
66
$_valid = $_smarty_tpl->decodeProperties(array (
77
'file_dependency' =>
88
array (
99
'ec4feeb21b21903d6f3d0b9b7aad22aa8062f668' =>
1010
array (
1111
0 => 'views/template/navigation.html',
12-
1 => 1432208001,
12+
1 => 1432386176,
1313
2 => 'file',
1414
),
1515
),
16-
'nocache_hash' => '4125555dc2b56e4564_89075330',
16+
'nocache_hash' => '1621955607d40c52a77_64501409',
1717
'has_nocache_code' => false,
1818
'version' => '3.1.23',
19-
'unifunc' => 'content_555dc2b56e83e1_70260282',
19+
'unifunc' => 'content_55607d411042e5_00553795',
2020
),false);
2121
/*/%%SmartyHeaderCode%%*/
22-
if ($_valid && !is_callable('content_555dc2b56e83e1_70260282')) {
23-
function content_555dc2b56e83e1_70260282 ($_smarty_tpl) {
22+
if ($_valid && !is_callable('content_55607d411042e5_00553795')) {
23+
function content_55607d411042e5_00553795 ($_smarty_tpl) {
2424
?>
2525
<?php
26-
$_smarty_tpl->properties['nocache_hash'] = '4125555dc2b56e4564_89075330';
26+
$_smarty_tpl->properties['nocache_hash'] = '1621955607d40c52a77_64501409';
2727
?>
2828
<div class="menu">
2929
<div class="logo">
@@ -60,11 +60,11 @@ function content_555dc2b56e83e1_70260282 ($_smarty_tpl) {
6060
'ldap' => '- LDAP Injection',
6161
'database' => '- SQL Injection',
6262
'xpath' => '- XPath Injection',
63+
'unserialize' => '- Unserialize / POP'
6364
'other' => '- other',
6465
'client' => 'All client-side',
6566
'xss' => '- Cross-Site Scripting',
6667
'httpheader' => '- HTTP Response Splitting',
67-
'unserialize' => 'Unserialize / POP'
6868
//'crypto' => 'Crypto hints'
6969
);
7070

@@ -86,11 +86,11 @@ function content_555dc2b56e83e1_70260282 ($_smarty_tpl) {
8686
<option value="ldap" >- LDAP Injection</option>
8787
<option value="sqli" >- SQL Injection</option>
8888
<option value="xpath" >- XPath Injection</option>
89+
<option value="unserialize">- Unserialize / POP</option>
8990
<!-- <option value="other" >- other</option> -->
9091
<option value="client" >All client-side</option>
9192
<option value="xss" >- Cross-Site Scripting</option>
9293
<option value="httpheader" >- HTTP Response Splitting</option>
93-
<option value="unserialize" >Unserialize / POP</option>
9494
</select>
9595
<a href="javascript:;" class="select-btn"><em>︿</em></a>
9696
</div>

0 commit comments

Comments
 (0)