php代码审计笔记

strcmp漏洞

https://www.cnblogs.com/zhengna/p/12342124.html

数组绕过

md5加密漏洞

https://blog.csdn.net/qq_19980431/article/details/83018232

变量覆盖漏洞

extract()和parser_str()

https://www.jianshu.com/p/a4d782e91852

弱类型匹配

同md5加密文章

preg_replace绕过

http://d1iv3.me/2017/03/01/PHP%E6%AD%A3%E5%88%99%E7%BB%8F%E5%85%B8%E6%BC%8F%E6%B4%9E/

json绕过

http://blog.merl1ng.cc/2017/08/13/php%E5%BC%B1%E5%8C%B9%E9%85%8D%E5%92%8Cjson/

assert

https://chybeta.github.io/2017/08/08/php%E4%BB%A3%E7%A0%81-%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/

call_user_func

https://pplsec.github.io/2019/01/17/PHP%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C&%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/

反序列化

绕过_wakeup

https://www.cnblogs.com/Mrsm1th/p/6835592.html

注入对象

当目标对象被private，protected修饰时，我们可以使用%00*%00和%00A%00进行绕过

同名方法调用利用

session反序列化漏洞