網頁

顯示具有 Windowd Server 標籤的文章。 顯示所有文章
顯示具有 Windowd Server 標籤的文章。 顯示所有文章

2013年8月15日 星期四

WampServer Security Scanner

如何修復網站與作業系統常見之漏洞與弱點


AppScan偵測之漏洞: XSS Scripting 跨網站 Scripting

原程式加上php 提供之 function: htmlentities(),修改後之login_submit.php 內容: echo "您輸入的帳號: " . htmlentities($_POST['login']) . " 錯誤!";..


解決方法:
  

$password =  htmlentities($_POST['password']);  //Preventing XSS Scripting  Attacks

AppScan偵測之漏洞: SQL Injection SQL 注入

解決方法:
/etc/php.ini 有個參數: ; Magic quotes for incoming GET/POST/Cookie data. magic_quotes_gpc = On wamp/bin/php/php5.4.12/php.ini
; scheduled for removal in PHP 6.
; Default Value: On
; Development Value: Off
; Production Value: Off
; http://php.net/magic-quotes-gpc
magic_quotes_gpc = On ;LINE 750


當啟用 magic_quotes_gpc 參數後,對於GET/POST 中使用者輸入之特殊字元,如單引號(')雙引號( " )、反斜線( \ ), 前面會自動再加上反斜線( \ ),此時即視同為字元。當 magic_quotes_gpc 功能開啟後,SQL 執行之語法已改變為: SELECT * FROM admin where login='davis' and passwd='\' or \'a\'=\'a'

防止SQL注入攻擊 (mysql_real_escape_string) (轉)


AppScan偵測之漏洞:目錄清單瀏覽
需修改/etc/httpd/conf/httpd.conf 將 Options 中 Indexes 字串移除:
 

Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
 

2013年7月14日 星期日

LDAP PHP

PHPLDAP - Manual


ldap Attribute 利用Directory Explorer查找 注意要改全小寫



ldap_bind ldap_bind($ldapconn, "{$ldapuser}@{$ldapserver}", $ldappass);

ldap_search

 

header("Content-Type:text/html; charset=utf-8");



 // connect 
 $ldapconn = ldap_connect($ldapserver) or die("Could not connect to LDAP server.");

 if($ldapconn) {
 
  //If you have problems with national characters or UTF8 encoding/decoding, set protocol to version 3:
    ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
  // binding to ldap server
  //$ldapbind = ldap_bind($ldapconn, $ldapuser, $ldappass) or die ("Error trying to bind: ".ldap_error($ldapconn));
 
     // binding to ldap server
  $ldapbind = ldap_bind($ldapconn, "{$ldapuser}@{$ldapserver}", $ldappass);

  // verify binding
  if ($ldapbind) {
   //echo "LDAP bind successful...

";
   
   //$result = ldap_search($ldapconn,$ldaptree, "( cn=".$myusername.")") or die ("Error in search query: ".ldap_error($ldapconn));
   
   
   $filter= "( userPrincipalName=".$myusername."@".$ldapserver.")";
   $result = ldap_search($ldapconn,$ldaptree, $filter) or die ("Error in search query: ".ldap_error($ldapconn));
   
   
   $data = ldap_get_entries($ldapconn, $result);

   for ($i=0; $i<$data["count"]; $i++) {
    echo "dn is: ". $data[$i]["dn"] ."
";
    //syntax must be DirectoryString
    
    // echo "givenname: ". $data[$i]["givenname"][0] ."
";
    // echo "User: ". $data[$i]["cn"][0] ."
";
        //echo "title: ". $data[$i]["title"][0] ."
";
    // echo "telephonenumber: ". $data[$i]["telephonenumber"][0] ."
";
    // echo "mobile: ". $data[$i]["mobile"][0] ."
";
    $telephonenumber =  $data[$i]["telephonenumber"][0];
     
    // echo "memberof: ". $data[$i]["memberof"][0] ."
";
     $memberof_cn = explode(",", $data[$i]["memberof"][0]);
     $memberof_cn_value = explode("=", $memberof_cn[0]); //cn=value
     //echo  $memberof_cn_value[1] ."
"; //value
     
    $ldap_team_name = $memberof_cn_value[1];
    $db_team_id = dbquery_team_id($ldap_team_name);
    echo "db_team_id is: ". $db_team_id ."
";
    check_db_person_exit($ldapuser,$db_team_id,$telephonenumber);
    
    
   }
   // print number of entries found
   echo "Number of entries found: " . ldap_count_entries($ldapconn, $result);
  } else {
   echo "LDAP bind failed...";
  }

Beware of the case sensitivity in php and LDAP/AD connections!



新增使用者資訊

#設定 吳怡君 通訊錄
dn: cn=li,ou=user,dc=xiang,dc=com
cn: li
sn: N/A
objectclass: person
objectclass: inetOrgPerson
givenName: 吳怡君
mail: c293831287@l-penguin.idv.tw
telephoneNumber: 02-29587572
mobile: 0939689593
postalAddress: 台北縣中和市景平路1號
postalCode: 235
ou: 人力資源部
title: 辦事員

2013年7月8日 星期一

WAMP Server

有一個解除封鎖Apache的動作沒有做,80Port沒開啟,伺服器會無法外連。
解決方法:控制台→開啟「Windows防火牆」→例外→查看有沒有「Apache HTTP Server」。

Apache_HTTP_Server

Window Server 2012






新增完成之後重新開機(不是重開Apache,要重開機)。


Apache 從 2.2 換至 2.4 httpd.conf 的調整筆記 (windows 環境)


Listen 的設定調整
以 443 為例,不可以只設定 Listen 443
會出現以下錯誤
(OS 10048)一次只能用一個通訊端位址(通訊協定/網路位址/連接埠)。  : AH00072: make_sock: could not bind to address [::]:443
(OS 10048)一次只能用一個通訊端位址(通訊協定/網路位址/連接埠)。  : AH00072: make_sock: could not bind to address 0.0.0.0:443
AH00451: no listening sockets available, shutting down
AH00015: Unable to open logs
因此需指定監聽的 IP ,可設定多個
例如:
Listen 192.168.2.1:443
Listen 127.0.0.1:443


打開 conf/httpd.conf

找到

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80

ServerName 192.168.xxx.xxx <-- 改成你的IP (虛擬IP)

如果沒有可以用 127.0.0.1

不要用 0.0.0.0:80

之後重啟 apache


#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#

ServerName localhost:80  IP address


手動升級(非 *.msi 封裝)Apache 2.4.3 於 Windows 成功紀要


如果在 Apache 錯誤記錄中,有類似「Asynchronous AcceptEx failed」的訊息,
那麼您可以在 httpd.conf 新增底下三行:

代碼: 選擇全部
AcceptFilter http none 
EnableSendfile off 
EnableMMAP off

2013年7月1日 星期一

web call client exe



解決方案,Registering an Application to a URL Protocol

練習例:
Office

Microsoft Lync Basic 2013 (64 位元)

Lync 2010 HTML URL Protocols for HREF tags

Command-Line Parameter Examples

InstanceResults
Tel:+14255550101Opens a phone-only view with +14255550101.
Callto:tel:+ 14255550101Opens a phone-only view with +14255550101.
Callto:sip:kazuto@litwareinc.comOpens a phone-only view with kazuto@litwareinc.com.
sip:kazuto@litwareinc.comOpens a Conversation window with kazuto@litwareinc.com.

Hey, that looks the same as our list of protocols available, and they give examples to boot!
 For example the behavior of callto: in this example:
<a href=”callto:sip:ootycorp@microsoft.com”>Click Here to Call</a>
Results in the contact to be pulled up like this:






以下為舊方法:(IE only)

Web下呼叫client端執行檔

    

    function runSCCMEXE()
    {
        var WshShell = new ActiveXObject("Wscript.Shell");
        WshShell.Run("D:\\SCCM_REMOTE.EXE"); // 執行檔案
        WshShell.Quit;
        
    }
    function runLync()
    {
        var WshShell = new ActiveXObject("Wscript.Shell");
        WshShell.Run("lync"); 
        WshShell.Quit;
        
    }
    function runIE()
    {
        var WshShell = new ActiveXObject("Wscript.Shell");
        WshShell.Run("explorer http://www.google.com"); // 開啟IE,連線至Google
        WshShell.Quit; 
     }
 
Click here to Execute your file


使用ActiveX還有一個安全性的問題,通常都會被瀏覽器擋掉。
必須開啟瀏覽器設定安全性。
以IE9設定為例:
開啟IE→網際網路選項→安全性→信任的網站→自訂等級
自訂等級:

將未標示成安全的ActiveX控制項初始化並執行指令碼→"提示"或"啟用"
使用"啟用"不會出現提示視窗,會直接載入ActiveX,至於安全性就請各位自行衡量。

2013年6月26日 星期三

Windows Server 2012



在 Windows Server 2012 版本上設定基礎環境,準備作為安裝 SQL Server 2012 版本之用


Net Framework 安裝



Windows Server 2012 建立 Active Directory 網域


Windows Server 2012快速上手-30天(14)
安裝Active Directory Domain Service(AD DS)

2013年3月18日 星期一

Enable PHP Inside HTML Pages


How to Enable PHP Inside HTML Pages



php code can be embedded within html pages within the tags:
<?php echo "my php code"; ?>

However, and depending on the server that you are using, this must be enabled. On apache2, you can edit the .htaccess file to include:
AddType application/x-httpd-php .htm .html

 added this line to the .htaccess on my website's root directory.

PHP coding in HTML file help (WAMP server)?

An HTML file still sits on the web server. You simply have to tell the web server how to parse the file. 

Your have to configure Apache server to parse the HTML files through the PHP engine. In httpd.conf, you probably have a line like this:

AddType application/x-httpd-php .php

This assumes you have the PHP module loaded (which you do). This way, it only parses PHP files.

You would have to change it to this:
AddType application/x-httpd-php .php .html .htm

Now apache will send all those file types to the PHP module for parsing.

Check the setup of Apache to fix this.


or 設定 httpd.conf  in conf/apache/httpd.conf 設定完記得重啓Server
AddType application/x-httpd-php .php .phtml .htm .html

2013年3月10日 星期日

wamp server #1045


WAMP的mysql密碼設定






C:\wamp\apps\phpmyadmin3.5.1\config.inc.php
/* Server: localhost [1] */
$i++;
$cfg['Servers'][$i]['verbose'] = 'localhost';
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['port'] = '';
$cfg['Servers'][$i]['socket'] = '';
$cfg['Servers'][$i]['connect_type'] = 'tcp';
$cfg['Servers'][$i]['extension'] = 'mysqli';
$cfg['Servers'][$i]['auth_type'] = 'cookie'; //config
$cfg['Servers'][$i]['user'] = 'root';
$cfg['Servers'][$i]['password'] = 'yourdbpassword';
$cfg['Servers'][$i]['AllowNoPassword'] = true;

2013年2月24日 星期日

Windows Server 2012

Windows Server 2012 website Open 80 PORT

 

 PHP PDO installed on your server.


php.ini


Warning: session_write_close() [function.session-write-close]: open(D:/PC_websever/phproot/session\sess_17064d421eed05a3386f958e07a06ab6, O_RDWR)failed: No such file or directory(2) in D:\PC_websever\phproot\phpmyadmin\index.php on line 44
Warning: session_write_close() [function.session-write-close]: Failed to write session data (files). Please verify that the current setting ofsession.save_pathis correct (D:/PC_websever/phproot/session) in D:\PC_websever\phproot\phpmyadmin\index.php on line 44

在Windows下PHP中的session不能正常使用的解决方法




首先打开PHP的配置文件php.ini,找到session.save_path = /tmp这一行,这是PHP在linux下的配置,Windows下PHP无法读写session文件导致session无法使用,把它改成一个绝对路径就可以了,例如:session.save_path = C:\windows\temp 然後重新啓動apache