Pass-01：前端驗證繞過
<script type="text/javascript">
function checkFile() {
var file = document.getElementsByName('upload_file')[0].value;
if (file == null || file == "") {
alert("請選擇要上傳的檔案!");
return false;
}
//定義允許上傳的檔案型別
var allow_ext = ".jpg|.png|.gif";
//提取上傳檔案的型別
var ext_name = file.substring(file.lastIndexOf("."));
//判斷上傳檔案型別是否允許上傳
if (allow_ext.indexOf(ext_name) == -1) {
var errMsg = "該檔案不允許上傳，請上傳" + allow_ext + "型別的檔案,當前檔案型別為：" + ext_name;
alert(errMsg);
return false;
}
}
</script>
js前端驗證，使用禁用js之類的插件，或修改當前頁面js代碼，或先上傳一個圖片馬然后抓包修改為后綴名php都可
Pass-02：Content-Type繞過
$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
if (file_exists(UPLOAD_PATH)) {
if (($_FILES['upload_file']['type'] == 'image/jpeg') || ($_FILES['upload_file']['type'] == 'image/png') || ($_FILES['upload_file']['type'] == 'image/gif')) {
$temp_file = $_FILES['upload_file']['tmp_name'];
$img_path = UPLOAD_PATH . '/' . $_FILES['upload_file']['name'];
if (move_uploaded_file($temp_file, $img_path)) {
$is_upload = true;
} else {
$msg = '上傳出錯！';
}
} else {
$msg = '檔案型別不正確，請重新上傳！';
}
} else {
$msg = UPLOAD_PATH.'檔案夾不存在,請手工創建！';
}
}
只對Content-Type進行了驗證，并沒有對檔案的后綴名進行驗證,因此上傳1.php抓包修改content-type為圖片型別：image/jpeg、image/png、image/gif
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/211673.html
標籤：python
上一篇：JQuery第一天案列總結
下一篇：原生JS實作彈幕的簡單操作速成