Posts

是一种SSRF漏洞 Low 1// 非常单纯, 随便读取 2// http://192.168.32.114/vulnerabilities/fi/?page=../../../../../../etc/passwd 3// The page we wish to display 4$file = $_GET[ 'page' ]; Medium 1// The page we wish to display 2$file = $_GET[ 'page' ]; 3 4// 过滤一部分字符 5// 不允许 HTTP,HTTPS 协议 6// 利用目录结构读取也不行 7 8// 然而没有过滤全 9// http://192.168.32.114/vulnerabilities/fi/?page=/etc/passwd 10 11// Input validation 12$file = str_replace( array( "http://", "https://" ), "", $file ); 13$file = str_replace( array( "../", "..\"" ), "", $file ); High 1// The page we wish to display 2$file = $_GET[ 'page' ]; 3 4// Input validation 5// 对$file 字符串做匹配 6// 只能匹配 file* 的文件路径 7// 还有 include.php 文件路径 8 9// 这个过滤还是八星 10// 利用`本地文件传输协议` 11// http://192.168.32.114/vulnerabilities/fi/?page=file:///etc/passwd 12 13// 或者这样 14// http://192.168.32.114/vulnerabilities/fi/?page=file123123/../../../../../../etc/passwd 15 16if( !fnmatch( "file*", $file ) && $file != "include.php" ) { 17 // This isn't the page we want! 18 echo "ERROR: File not found!"; 19 exit; 20} Impossible 1// The page we wish to display 2$file = $_GET[ 'page' ]; 3 4// Only allow include.php or file{1..3}.php 5// 强匹配 6// 从程序员的角度来说这种代码的维护性极差 7// 从安全的角度上来说这是最安全的方案 8if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) { 9 // This isn't the page we want! 10 echo "ERROR: File not found!"; 11 exit; 12}

LOW 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // Can we move the file to the upload folder? 7 // 完全没做过滤. 8 // 上传一个PHP文件也是可以的. 9 if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { 10 // No 11 echo '<pre>Your image was not uploaded.</pre>'; 12 } 13 else { 14 // Yes! 15 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 16 } 17} Medium 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; 9 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 10 11 // Is it an image? 12 // // 开始做了一些过滤 13 14 // 下面是官方对$_FILES 函数的描述 15 // [name] => MyFile.txt (comes from the browser, so treat as tainted) 16 // [type] => text/plain (not sure where it gets this from - assume the browser, so treat as tainted) 17 // [tmp_name] => /tmp/php/php1h4j1o (could be anywhere on your system, depending on your config settings, but the user has no control, so this isn't tainted) 18 // [error] => UPLOAD_ERR_OK (= 0) 19 // [size] => 123 (the size in bytes) 20 21 // 其中对name和type的description的描述都是 `treat as tainted`(被污染的) 22 // 这意味着它有可能会被修改 unsafe 23 24 // 我们可以尝试上传一个PHP文件，使用一些拦截请求工具，修改即将发出的请求. 25 // 来达到修改`name`中的后缀名和`type`中的媒体类型. 26 if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) && 27 ( $uploaded_size < 100000 ) ) { 28 29 // Can we move the file to the upload folder? 30 if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { 31 // No 32 echo '<pre>Your image was not uploaded.</pre>'; 33 } 34 else { 35 // Yes! 36 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 37 } 38 } 39 else { 40 // Invalid file 41 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 42 } 43} High 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 // jpg 9 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 10 11 // file size 12 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 13 14 // tmp_name 是临时副本的名字 15 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 16 17 // Is it an image? 18 // 和上面的比起来多个一个文件后缀名的判断. 19 // strtolower 转小写 20 // 扩展名只要满足jpeg,png或者jpg就行 21 if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) && 22 ( $uploaded_size < 100000 ) && 23 // getimagesize 获取图像信息 24 // 这个函数保证你穿的一定得是个图像 25 // 可以用图片木马绕过 26 getimagesize( $uploaded_tmp ) ) { 27 28 // Can we move the file to the upload folder? 29 if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { 30 // No 31 echo '<pre>Your image was not uploaded.</pre>'; 32 } 33 else { 34 // Yes! 35 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 36 } 37 } 38 else { 39 // Invalid file 40 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 41 } 42} High 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 9 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 10 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 11 12 // Is it an image? 13 // 对比上面多验证了文件的后缀名 14 if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) && 15 ( $uploaded_size < 100000 ) && 16 17 // 函数会通过读取文件头，返回图片的长、宽等信息，如果没有相关的图片文件头，函数会报错 18 getimagesize( $uploaded_tmp ) ) { 19 20 // 可以看到，High级别的代码读取文件名中最后一个”.”后的字符串，期望通过文件名来限制文件类型 21 // 因此要求上传文件名形式必须是”*.jpg”、”*.jpeg” 、”*.png”之一 22 // 同时，getimagesize函数更是限制了上传文件的文件头必须为图像类型 23 24 // Can we move the file to the upload folder? 25 if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { 26 // No 27 echo '<pre>Your image was not uploaded.</pre>'; 28 } 29 else { 30 // Yes! 31 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 32 } 33 } 34 else { 35 // Invalid file 36 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 37 } 38} Impossible 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Check Anti-CSRF token 3 checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 4 5 // File information 6 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 7 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 8 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 9 $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; 10 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 11 12 // Where are we going to be writing to? 13 $target_path = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/'; 14 //$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-'; 15 16 // MD5 加密 17 $target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; 18 $temp_file = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get( 'upload_tmp_dir' ) ) ); 19 $temp_file .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; 20 21 // Is it an image? 22 if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) && 23 ( $uploaded_size < 100000 ) && 24 ( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) && 25 getimagesize( $uploaded_tmp ) ) { 26 27 // Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD) 28 if( $uploaded_type == 'image/jpeg' ) { 29 $img = imagecreatefromjpeg( $uploaded_tmp ); 30 imagejpeg( $img, $temp_file, 100); 31 } 32 else { 33 $img = imagecreatefrompng( $uploaded_tmp ); 34 imagepng( $img, $temp_file, 9); 35 } 36 imagedestroy( $img ); 37 38 // Can we move the file to the web root from the temp folder? 39 if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) { 40 // Yes! 41 echo "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>"; 42 } 43 else { 44 // No 45 echo '<pre>Your image was not uploaded.</pre>'; 46 } 47 48 // Delete any temp files 49 if( file_exists( $temp_file ) ) 50 unlink( $temp_file ); 51 } 52 else { 53 // Invalid file 54 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 55 } 56} 57 58// Generate Anti-CSRF token 59generateSessionToken(); Extension 00%截断 ...

DVWA File upload 过关秘籍. LOW 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // Can we move the file to the upload folder? 7 // 完全没做过滤. 8 // 上传一个PHP文件也是可以的. 9 if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { 10 // No 11 echo '<pre>Your image was not uploaded.</pre>'; 12 } 13 else { 14 // Yes! 15 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 16 } 17} Medium 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; 9 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 10 11 // Is it an image? 12 // // 开始做了一些过滤 13 14 // 下面是官方对$_FILES 函数的描述 15 // [name] => MyFile.txt (comes from the browser, so treat as tainted) 16 // [type] => text/plain (not sure where it gets this from - assume the browser, so treat as tainted) 17 // [tmp_name] => /tmp/php/php1h4j1o (could be anywhere on your system, depending on your config settings, but the user has no control, so this isn't tainted) 18 // [error] => UPLOAD_ERR_OK (= 0) 19 // [size] => 123 (the size in bytes) 20 21 // 其中对name和type的description的描述都是 `treat as tainted`(被污染的) 22 // 这意味着它有可能会被修改 unsafe 23 24 // 我们可以尝试上传一个PHP文件，使用一些拦截请求工具，修改即将发出的请求. 25 // 来达到修改`name`中的后缀名和`type`中的媒体类型. 26 if( ( $uploaded_type == "image/jpeg" || $uploaded_type == "image/png" ) && 27 ( $uploaded_size < 100000 ) ) { 28 29 // Can we move the file to the upload folder? 30 if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) { 31 // No 32 echo '<pre>Your image was not uploaded.</pre>'; 33 } 34 else { 35 // Yes! 36 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 37 } 38 } 39 else { 40 // Invalid file 41 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 42 } 43} High 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 // jpg 9 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 10 11 // file size 12 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 13 14 // tmp_name 是临时副本的名字 15 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 16 17 // Is it an image? 18 // 和上面的比起来多个一个文件后缀名的判断. 19 // strtolower 转小写 20 // 扩展名只要满足jpeg,png或者jpg就行 21 if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) && 22 ( $uploaded_size < 100000 ) && 23 // getimagesize 获取图像信息 24 // 这个函数保证你穿的一定得是个图像 25 // 可以用图片木马绕过 26 getimagesize( $uploaded_tmp ) ) { 27 28 // Can we move the file to the upload folder? 29 if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { 30 // No 31 echo '<pre>Your image was not uploaded.</pre>'; 32 } 33 else { 34 // Yes! 35 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 36 } 37 } 38 else { 39 // Invalid file 40 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 41 } 42} High 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Where are we going to be writing to? 3 $target_path = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/"; 4 $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] ); 5 6 // File information 7 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 8 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 9 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 10 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 11 12 // Is it an image? 13 // 对比上面多验证了文件的后缀名 14 if( ( strtolower( $uploaded_ext ) == "jpg" || strtolower( $uploaded_ext ) == "jpeg" || strtolower( $uploaded_ext ) == "png" ) && 15 ( $uploaded_size < 100000 ) && 16 17 18 19 // 函数会通过读取文件头，返回图片的长、宽等信息，如果没有相关的图片文件头，函数会报错 20 getimagesize( $uploaded_tmp ) ) { 21 22 // 可以看到，High级别的代码读取文件名中最后一个”.”后的字符串，期望通过文件名来限制文件类型 23 // 因此要求上传文件名形式必须是”*.jpg”、”*.jpeg” 、”*.png”之一 24 // 同时，getimagesize函数更是限制了上传文件的文件头必须为图像类型 25 26 // Can we move the file to the upload folder? 27 if( !move_uploaded_file( $uploaded_tmp, $target_path ) ) { 28 // No 29 echo '<pre>Your image was not uploaded.</pre>'; 30 } 31 else { 32 // Yes! 33 echo "<pre>{$target_path} succesfully uploaded!</pre>"; 34 } 35 } 36 else { 37 // Invalid file 38 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 39 } 40} Impossible 1if( isset( $_POST[ 'Upload' ] ) ) { 2 // Check Anti-CSRF token 3 checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 4 5 // File information 6 $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ]; 7 $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1); 8 $uploaded_size = $_FILES[ 'uploaded' ][ 'size' ]; 9 $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ]; 10 $uploaded_tmp = $_FILES[ 'uploaded' ][ 'tmp_name' ]; 11 12 // Where are we going to be writing to? 13 $target_path = DVWA_WEB_PAGE_TO_ROOT . 'hackable/uploads/'; 14 //$target_file = basename( $uploaded_name, '.' . $uploaded_ext ) . '-'; 15 16 // MD5 加密 17 $target_file = md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; 18 $temp_file = ( ( ini_get( 'upload_tmp_dir' ) == '' ) ? ( sys_get_temp_dir() ) : ( ini_get( 'upload_tmp_dir' ) ) ); 19 $temp_file .= DIRECTORY_SEPARATOR . md5( uniqid() . $uploaded_name ) . '.' . $uploaded_ext; 20 21 // Is it an image? 22 if( ( strtolower( $uploaded_ext ) == 'jpg' || strtolower( $uploaded_ext ) == 'jpeg' || strtolower( $uploaded_ext ) == 'png' ) && 23 ( $uploaded_size < 100000 ) && 24 ( $uploaded_type == 'image/jpeg' || $uploaded_type == 'image/png' ) && 25 getimagesize( $uploaded_tmp ) ) { 26 27 // Strip any metadata, by re-encoding image (Note, using php-Imagick is recommended over php-GD) 28 if( $uploaded_type == 'image/jpeg' ) { 29 $img = imagecreatefromjpeg( $uploaded_tmp ); 30 imagejpeg( $img, $temp_file, 100); 31 } 32 else { 33 $img = imagecreatefrompng( $uploaded_tmp ); 34 imagepng( $img, $temp_file, 9); 35 } 36 imagedestroy( $img ); 37 38 // Can we move the file to the web root from the temp folder? 39 if( rename( $temp_file, ( getcwd() . DIRECTORY_SEPARATOR . $target_path . $target_file ) ) ) { 40 // Yes! 41 echo "<pre><a href='${target_path}${target_file}'>${target_file}</a> succesfully uploaded!</pre>"; 42 } 43 else { 44 // No 45 echo '<pre>Your image was not uploaded.</pre>'; 46 } 47 48 // Delete any temp files 49 if( file_exists( $temp_file ) ) 50 unlink( $temp_file ); 51 } 52 else { 53 // Invalid file 54 echo '<pre>Your image was not uploaded. We can only accept JPEG or PNG images.</pre>'; 55 } 56} 57 58// Generate Anti-CSRF token 59generateSessionToken(); Extension 00%截断 ...

返回的结果集无法看到，只能通过一些页面显示或状态来判断。 像瞎子一样。 Low 1if(isset( $_GET[ 'Submit' ])) { 2 // Get input 3 $id = $_GET[ 'id' ]; 4 5 // Check database 6 $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; 7 // 没有一点点防备 8 // 尝试构造: (由于看不到结果集，所以脱裤子的语句是无效) 9 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,2 # '; 10 // User ID exists in the database. <存在注入漏洞> 11 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,if(length( database())=4,sleep(4),2) # '; 12 13 $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors 14 15 // Get results 16 $num = @mysql_numrows( $result ); // The '@' character suppresses errors 17 if( $num > 0 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // User wasn't found, so the page wasn't! 23 header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); 24 25 // Feedback for end user 26 echo '<pre>User ID is MISSING from the database.</pre>'; 27 } 28 29 mysql_close(); 30} MIEDUM 1if( isset( $_POST[ 'Submit' ] ) ) { 2 // Get input 3 $id = $_POST[ 'id' ]; 4 $id = mysql_real_escape_string( $id ); 5 6 // Check database 7 $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; 8 // 尝试构造: 9 // SELECT first_name, last_name FROM users WHERE user_id = 0 union select 1,2; 10 // 以上判断存在注入漏洞 11 // SELECT first_name, last_name FROM users WHERE user_id = 0 union select 1,if(length(database()) > 4, sleep(3), 2) 12 13 $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors 14 15 // Get results 16 $num = @mysql_numrows( $result ); // The '@' character suppresses errors 17 if( $num > 0 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // Feedback for end user 23 echo '<pre>User ID is MISSING from the database.</pre>'; 24 } 25 26 //mysql_close(); 27} High 1if( isset( $_SESSION['id'])){ 2 // Get input 3 $id = $_SESSION[ 'id' ]; 4 5 // Check database 6 $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; 7 // 没有新花样，只限制输出条目是无法拦住我们的 8 // 尝试构造: 9 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,if(length(database()) = 4, sleep(3), 2) # LIMIT 1; 10 $result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' ); 11 12 // Get results 13 $num = mysql_numrows( $result ); 14 $i = 0; 15 while( $i < $num ) { 16 // Get values 17 $first = mysql_result( $result, $i, "first_name" ); 18 $last = mysql_result( $result, $i, "last_name" ); 19 20 // Feedback for end user 21 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 22 23 // Increase loop count 24 $i++; 25 } 26 27 mysql_close(); 28} High 1if( isset( $_GET[ 'Submit' ] ) ) { 2 // Check Anti-CSRF token 3 checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 4 5 // Get input 6 $id = $_GET[ 'id' ]; 7 8 // Was a number entered? 9 if(is_numeric( $id )) { 10 // Check the database 11 // PDO 无法注入 12 $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); 13 $data->bindParam( ':id', $id, PDO::PARAM_INT ); 14 $data->execute(); 15 16 // Get results 17 if( $data->rowCount() == 1 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // User wasn't found, so the page wasn't! 23 header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); 24 25 // Feedback for end user 26 echo '<pre>User ID is MISSING from the database.</pre>'; 27 } 28 } 29} 30 31// Generate Anti-CSRF token 32generateSessionToken();

DVWA SQL Injection 过关秘籍. LOW 1if( isset( $_REQUEST[ 'Submit' ] ) ) { 2 // Get input 3 $id = $_REQUEST[ 'id' ]; 4 5 // Check database 6 $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; 7 // 并没有做什么注入防护 8 // 尝试构造： 9 // select first_name, last_name from from users where user_id = '1' and 1=1; 10 // select first_name, last_name from from users where user_id = '1' and 1=2; 11 // select first_name, last_name from from users where user_id = '1' or 1=1; 12 13 $result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' ); 14 15 // Get results 16 $num = mysql_numrows( $result ); 17 $i = 0; 18 while( $i < $num ) { 19 // Get values 20 $first = mysql_result( $result, $i, "first_name" ); 21 $last = mysql_result( $result, $i, "last_name" ); 22 23 // Feedback for end user 24 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 25 26 // Increase loop count 27 $i++; 28 } 29 30 mysql_close(); 31} Medium 1if( isset( $_POST[ 'Submit' ] ) ) { 2 // Get input 3 4 // 换成了Post 这也太普通了 5 // 使用一些网络请求工具照样改，比如BurpSuite，PostMan，curl. 6 $id = $_POST[ 'id' ]; 7 $id = mysql_real_escape_string( $id ); 8 // mysql_real_escape_string 可以对以下字符进行转义 9 // \x00, \n, \r, \, ', " 和 \x1a. 10 // 值得注意的是 mysql_real_escape_string 函数所在的MYSQL扩展在 11 // PHP 5.5.0 起已废弃，并在自 PHP 7.0.0 开始被移除。 12 13 // Check database 14 $query = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; 15 // 尝试构造: 16 // SELECT first_name, last_name FROM users WHERE user_id = 1 or 1=1; 17 18 $result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' ); 19 20 // Get results 21 $num = mysql_numrows( $result ); 22 $i = 0; 23 while( $i < $num ) { 24 // Display values 25 $first = mysql_result( $result, $i, "first_name" ); 26 $last = mysql_result( $result, $i, "last_name" ); 27 28 // Feedback for end user 29 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 30 31 // Increase loop count 32 $i++; 33 } 34 35 //mysql_close(); 36} High 1if( isset( $_SESSION [ 'id' ] ) ) { 2 // Get input 3 $id = $_SESSION[ 'id' ]; 4 5 // Check database 6 // 看起来做了返回条目限制 7 $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; 8 // 没什么套路 9 // SELECT first_name, last_name FROM users WHERE user_id = '1' or 1=1 # ' LIMIT 1; 10 11 $result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' ); 12 13 // Get results 14 $num = mysql_numrows( $result ); 15 $i = 0; 16 while( $i < $num ) { 17 // Get values 18 $first = mysql_result( $result, $i, "first_name" ); 19 $last = mysql_result( $result, $i, "last_name" ); 20 21 // Feedback for end user 22 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 23 24 // Increase loop count 25 $i++; 26 } 27 28 mysql_close(); 29} impossible 1if( isset( $_GET[ 'Submit' ] ) ) { 2 // Check Anti-CSRF token 3 checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 4 5 // Get input 6 $id = $_GET[ 'id' ]; 7 8 // Was a number entered? 9 if(is_numeric( $id )) { 10 // Check the database 11 // 这是！PDO! 12 // PDO 是一种PHP中比较先进的面向对象形式的数据库访问技术 13 // 不过即使是面向对象它还是事务脚本形式的。 14 // 提供了防SQL注入的功能。 15 $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); 16 // 无法注入 17 18 $data->bindParam( ':id', $id, PDO::PARAM_INT ); 19 $data->execute(); 20 $row = $data->fetch(); 21 22 // Make sure only 1 result is returned 23 if( $data->rowCount() == 1 ) { 24 // Get values 25 $first = $row[ 'first_name' ]; 26 $last = $row[ 'last_name' ]; 27 28 // Feedback for end user 29 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 30 } 31 } 32} 33 34// Generate Anti-CSRF tsoken 35generateSessionToken(); Extension 二次注入: ...

返回的结果集无法看到，只能通过一些页面显示或状态来判断。 像瞎子一样。 DVWA SQL Injection blind 过关秘籍. Low 1if(isset( $_GET[ 'Submit' ])) { 2 // Get input 3 $id = $_GET[ 'id' ]; 4 5 // Check database 6 $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; 7 // 没有一点点防备 8 // 尝试构造: (由于看不到结果集，所以脱裤子的语句是无效) 9 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,2 # '; 10 // User ID exists in the database. <存在注入漏洞> 11 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,if(length( database())=4,sleep(4),2) # '; 12 13 $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors 14 15 // Get results 16 $num = @mysql_numrows( $result ); // The '@' character suppresses errors 17 if( $num > 0 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // User wasn't found, so the page wasn't! 23 header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); 24 25 // Feedback for end user 26 echo '<pre>User ID is MISSING from the database.</pre>'; 27 } 28 29 mysql_close(); 30} MIEDUM 1if( isset( $_POST[ 'Submit' ] ) ) { 2 // Get input 3 $id = $_POST[ 'id' ]; 4 $id = mysql_real_escape_string( $id ); 5 6 // Check database 7 $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; 8 // 尝试构造: 9 // SELECT first_name, last_name FROM users WHERE user_id = 0 union select 1,2; 10 // 以上判断存在注入漏洞 11 // SELECT first_name, last_name FROM users WHERE user_id = 0 union select 1,if(length(database()) > 4, sleep(3), 2) 12 13 $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors 14 15 // Get results 16 $num = @mysql_numrows( $result ); // The '@' character suppresses errors 17 if( $num > 0 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // Feedback for end user 23 echo '<pre>User ID is MISSING from the database.</pre>'; 24 } 25 26 //mysql_close(); 27} High 1if( isset( $_SESSION['id'])){ 2 // Get input 3 $id = $_SESSION[ 'id' ]; 4 5 // Check database 6 $query = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; 7 // 没有新花样，只限制输出条目是无法拦住我们的 8 // 尝试构造: 9 // SELECT first_name, last_name FROM users WHERE user_id = '0' union select 1,if(length(database()) = 4, sleep(3), 2) # LIMIT 1; 10 $result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' ); 11 12 // Get results 13 $num = mysql_numrows( $result ); 14 $i = 0; 15 while( $i < $num ) { 16 // Get values 17 $first = mysql_result( $result, $i, "first_name" ); 18 $last = mysql_result( $result, $i, "last_name" ); 19 20 // Feedback for end user 21 echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 22 23 // Increase loop count 24 $i++; 25 } 26 27 mysql_close(); 28} High 1if( isset( $_GET[ 'Submit' ] ) ) { 2 // Check Anti-CSRF token 3 checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 4 5 // Get input 6 $id = $_GET[ 'id' ]; 7 8 // Was a number entered? 9 if(is_numeric( $id )) { 10 // Check the database 11 // PDO 无法注入 12 $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); 13 $data->bindParam( ':id', $id, PDO::PARAM_INT ); 14 $data->execute(); 15 16 // Get results 17 if( $data->rowCount() == 1 ) { 18 // Feedback for end user 19 echo '<pre>User ID exists in the database.</pre>'; 20 } 21 else { 22 // User wasn't found, so the page wasn't! 23 header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); 24 25 // Feedback for end user 26 echo '<pre>User ID is MISSING from the database.</pre>'; 27 } 28 } 29} 30 31// Generate Anti-CSRF token 32generateSessionToken();

十多天前, 我创建了 GCR 这个项目, 原因比较纯粹, 我是个命令行工具爱好者, 我认为命令行能带来更好的工作效率以及收益, 我平时编码, 也是遵守 Git 提交规范的, 使用Node.js平台上的git-cz工具来格式化我的提交信息, 不过由于它属于Node.js这个平台, 不可避免, 你需要安装 Node.js 的 runtime 环境. ...

Appveyor 也是一款线上 CICD 工具。 Support Contexts: Windows (Default) Ubuntu MacOS Support Languages: Node.js io.js Xamarin Python Ruby C++ Go Ruby 1version: 1.0.{build}-{branch} 2 3skip_commits: 4 files: 5 - "azure-pipelines.yml" 6 - "README.md" 7 8install: 9 - set PATH=C:\Ruby26-x64\bin;%PATH% 10 - bundle install 11 12build: off 13 14before_test: 15 - ruby -v 16 - gem -v 17 - bundle -v 18 19test_script: 20 - rails db:migrate RAILS_ENV=test Appveyor.yml Reference 1# Notes: 2# - Minimal appveyor.yml file is an empty file. All sections are optional. 3# - Indent each level of configuration with 2 spaces. Do not use tabs! 4# - All section names are case-sensitive. 5# - Section names should be unique on each level. 6 7#---------------------------------# 8# general configuration # 9#---------------------------------# 10 11# version format 12version: 1.0.{build} 13 14# you can use {branch} name in version format too 15# version: 1.0.{build}-{branch} 16 17# branches to build 18branches: 19 # whitelist 20 only: 21 - master 22 - production 23 24 # blacklist 25 except: 26 - gh-pages 27 28# Do not build on tags (GitHub, Bitbucket, GitLab, Gitea) 29skip_tags: true 30 31# Start builds on tags only (GitHub, BitBucket, GitLab, Gitea) 32skip_non_tags: true 33 34# Skipping commits with particular message or from specific user 35skip_commits: 36 message: /Created.*\.(png|jpg|jpeg|bmp|gif)/ # Regex for matching commit message 37 author: John # Commit author's username, name, email or regexp maching one of these. 38 39# Including commits with particular message or from specific user 40only_commits: 41 message: /build/ # Start a new build if message contains 'build' 42 author: jack@company.com # Start a new build for commit of user with email jack@company.com 43 44# Skipping commits affecting specific files (GitHub only). More details here: /docs/appveyor-yml 45#skip_commits: 46# files: 47# - docs/* 48# - '**/*.html' 49 50# Including commits affecting specific files (GitHub only). More details here: /docs/appveyor-yml 51#only_commits: 52# files: 53# - Project-A/ 54# - Project-B/ 55 56# Do not build feature branch with open Pull Requests 57skip_branch_with_pr: true 58 59# Maximum number of concurrent jobs for the project 60max_jobs: 1 61 62#---------------------------------# 63# environment configuration # 64#---------------------------------# 65 66# Build worker image (VM template) 67image: Visual Studio 2015 68 69# scripts that are called at very beginning, before repo cloning 70init: 71 - git config --global core.autocrlf input 72 73# clone directory 74clone_folder: c:\projects\myproject 75 76# fetch repository as zip archive 77shallow_clone: true # default is "false" 78 79# set clone depth 80clone_depth: 5 # clone entire repository history if not defined 81 82# setting up etc\hosts file 83hosts: 84 queue-server: 127.0.0.1 85 db.server.com: 127.0.0.2 86 87# environment variables 88environment: 89 my_var1: value1 90 my_var2: value2 91 # this is how to set encrypted variable. Go to "Settings" -> "Encrypt YAML" page in account menu to encrypt data. 92 my_secure_var1: 93 secure: FW3tJ3fMncxvs58/ifSP7w== 94 95# environment: 96# global: 97# connection_string: server=12;password=13; 98# service_url: https://127.0.0.1:8090 99# 100# matrix: 101# - db: mysql 102# provider: mysql 103# 104# - db: mssql 105# provider: mssql 106# password: 107# secure: $#(JFDA)jQ@#$ 108 109# this is how to allow failing jobs in the matrix 110matrix: 111 fast_finish: true # set this flag to immediately finish build once one of the jobs fails. 112 allow_failures: 113 - platform: x86 114 configuration: Debug 115 - platform: x64 116 configuration: Release 117 118 # exclude configuration from the matrix. Works similarly to 'allow_failures' but build not even being started for excluded combination. 119 exclude: 120 - platform: x86 121 configuration: Debug 122 123# build cache to preserve files/folders between builds 124cache: 125 - packages -> **\packages.config # preserve "packages" directory in the root of build folder but will reset it if packages.config is modified 126 - projectA\libs 127 - node_modules # local npm modules 128 - '%LocalAppData%\NuGet\Cache' # NuGet < v3 129 - '%LocalAppData%\NuGet\v3-cache' # NuGet v3 130 131# enable service required for build/tests 132services: 133 - mssql2014 # start SQL Server 2014 Express 134 - mssql2014rs # start SQL Server 2014 Express and Reporting Services 135 - mssql2012sp1 # start SQL Server 2012 SP1 Express 136 - mssql2012sp1rs # start SQL Server 2012 SP1 Express and Reporting Services 137 - mssql2008r2sp2 # start SQL Server 2008 R2 SP2 Express 138 - mssql2008r2sp2rs # start SQL Server 2008 R2 SP2 Express and Reporting Services 139 - mysql # start MySQL 5.6 service 140 - postgresql # start PostgreSQL 9.5 service 141 - iis # start IIS 142 - msmq # start Queuing services 143 - mongodb # start MongoDB 144 145# scripts that run after cloning repository 146install: 147 # by default, all script lines are interpreted as batch 148 - echo This is batch 149 # to run script as a PowerShell command prepend it with ps: 150 - ps: Write-Host 'This is PowerShell' 151 # batch commands start from cmd: 152 - cmd: echo This is batch again 153 - cmd: set MY_VAR=12345 154 155# enable patching of AssemblyInfo.* files 156assembly_info: 157 patch: true 158 file: AssemblyInfo.* 159 assembly_version: "2.2.{build}" 160 assembly_file_version: "{version}" 161 assembly_informational_version: "{version}" 162 163# Automatically register private account and/or project AppVeyor NuGet feeds. 164nuget: 165 account_feed: true 166 project_feed: true 167 disable_publish_on_pr: true # disable publishing of .nupkg artifacts to account/project feeds for pull request builds 168 publish_wap_octopus: true # disable publishing of Octopus Deploy .nupkg artifacts to account/project feeds 169 170#---------------------------------# 171# build configuration # 172#---------------------------------# 173 174# build platform, i.e. x86, x64, Any CPU. This setting is optional. 175platform: Any CPU 176 177# to add several platforms to build matrix: 178#platform: 179# - x86 180# - Any CPU 181 182# build Configuration, i.e. Debug, Release, etc. 183configuration: Release 184 185# to add several configurations to build matrix: 186#configuration: 187# - Debug 188# - Release 189 190# Build settings, not to be confused with "before_build" and "after_build". 191# "project" is relative to the original build directory and not influenced by directory changes in "before_build". 192build: 193 parallel: true # enable MSBuild parallel builds 194 project: MyTestAzureCS.sln # path to Visual Studio solution or project 195 publish_wap: true # package Web Application Projects (WAP) for Web Deploy 196 publish_wap_xcopy: true # package Web Application Projects (WAP) for XCopy deployment 197 publish_wap_beanstalk: true # Package Web Applications for AWS Elastic Beanstalk deployment 198 publish_wap_octopus: true # Package Web Applications for Octopus deployment 199 publish_azure_webjob: true # Package Azure WebJobs for Zip Push deployment 200 publish_azure: true # package Azure Cloud Service projects and push to artifacts 201 publish_aspnet_core: true # Package ASP.NET Core projects 202 publish_core_console: true # Package .NET Core console projects 203 publish_nuget: true # package projects with .nuspec files and push to artifacts 204 publish_nuget_symbols: true # generate and publish NuGet symbol packages 205 include_nuget_references: true # add -IncludeReferencedProjects option while packaging NuGet artifacts 206 207 # MSBuild verbosity level 208 verbosity: quiet|minimal|normal|detailed 209 210# scripts to run before build 211before_build: 212 213# to run your custom scripts instead of automatic MSBuild 214build_script: 215 216# scripts to run after build (working directory and environment changes are persisted from the previous steps) 217after_build: 218 219# scripts to run *after* solution is built and *before* automatic packaging occurs (web apps, NuGet packages, Azure Cloud Services) 220before_package: 221 222# to disable automatic builds 223#build: off 224 225#---------------------------------# 226# tests configuration # 227#---------------------------------# 228 229# to run tests against only selected assemblies and/or categories 230test: 231 assemblies: 232 only: 233 - asm1.dll 234 - asm2.dll 235 236 categories: 237 only: 238 - UI 239 - E2E 240 241# to run tests against all except selected assemblies and/or categories 242#test: 243# assemblies: 244# except: 245# - asm1.dll 246# - asm2.dll 247# 248# categories: 249# except: 250# - UI 251# - E2E 252 253# to run tests from different categories as separate jobs in parallel 254#test: 255# categories: 256# - A # A category common for all jobs 257# - [UI] # 1st job 258# - [DAL, BL] # 2nd job 259 260# scripts to run before tests (working directory and environment changes are persisted from the previous steps such as "before_build") 261before_test: 262 - echo script1 263 - ps: Write-Host "script1" 264 265# to run your custom scripts instead of automatic tests 266test_script: 267 - echo This is my custom test script 268 269# scripts to run after tests 270after_test: 271 272# to disable automatic tests 273#test: off 274 275#---------------------------------# 276# artifacts configuration # 277#---------------------------------# 278 279artifacts: 280 # pushing a single file 281 - path: test.zip 282 283 # pushing a single file with environment variable in path and "Deployment name" specified 284 - path: MyProject\bin\$(configuration) 285 name: myapp 286 287 # pushing entire folder as a zip archive 288 - path: logs 289 290 # pushing all *.nupkg files in build directory recursively 291 - path: '**\*.nupkg' 292 293#---------------------------------# 294# deployment configuration # 295#---------------------------------# 296 297# providers: Local, FTP, WebDeploy, AzureCS, AzureBlob, S3, NuGet, Environment 298# provider names are case-sensitive! 299deploy: 300 # FTP deployment provider settings 301 - provider: FTP 302 protocol: ftp|ftps|sftp 303 host: ftp.myserver.com 304 username: admin 305 password: 306 secure: eYKZKFkkEvFYWX6NfjZIVw== 307 folder: 308 application: 309 active_mode: false 310 beta: true # enable alternative FTP library for 'ftp' and 'ftps' modes 311 debug: true # show complete FTP log 312 313 # Amazon S3 deployment provider settings 314 - provider: S3 315 access_key_id: 316 secure: ABcd== 317 secret_access_key: 318 secure: ABcd== 319 bucket: my_bucket 320 folder: 321 artifact: 322 set_public: false 323 324 # Azure Blob storage deployment provider settings 325 - provider: AzureBlob 326 storage_account_name: 327 secure: ABcd== 328 storage_access_key: 329 secure: ABcd== 330 container: my_container 331 folder: 332 artifact: 333 334 # Web Deploy deployment provider settings 335 - provider: WebDeploy 336 server: http://www.deploy.com/myendpoint 337 website: mywebsite 338 username: user 339 password: 340 secure: eYKZKFkkEvFYWX6NfjZIVw== 341 ntlm: false 342 remove_files: false 343 app_offline: false 344 do_not_use_checksum: true # do not use check sum for comparing source and destination files. By default checksums are used. 345 sync_retry_attempts: 2 # sync attempts, max 346 sync_retry_interval: 2000 # timeout between sync attempts, milliseconds 347 aspnet_core: true # artifact zip contains ASP.NET Core application 348 aspnet_core_force_restart: true # poke app's web.config before deploy to force application restart 349 skip_dirs: \\App_Data 350 skip_files: web.config 351 on: 352 branch: release 353 platform: x86 354 configuration: debug 355 356 # Deploying to Azure Cloud Service 357 - provider: AzureCS 358 subscription_id: 359 secure: fjZIVw== 360 subscription_certificate: 361 secure: eYKZKFkkEv...FYWX6NfjZIVw== 362 storage_account_name: my_storage 363 storage_access_key: 364 secure: ABcd== 365 service: my_service 366 slot: Production 367 target_profile: Cloud 368 artifact: MyPackage.cspkg 369 370 # Deploying to NuGet feed 371 - provider: NuGet 372 server: https://my.nuget.server/feed 373 api_key: 374 secure: FYWX6NfjZIVw== 375 skip_symbols: false 376 symbol_server: https://your.symbol.server/feed 377 artifact: MyPackage.nupkg 378 379 # Deploy to GitHub Releases 380 - provider: GitHub 381 artifact: /.*\.nupkg/ # upload all NuGet packages to release assets 382 draft: false 383 prerelease: false 384 on: 385 branch: master # release from master branch only 386 APPVEYOR_REPO_TAG: true # deploy on tag push only 387 388 # Deploying to a named environment 389 - provider: Environment 390 name: staging 391 on: 392 branch: staging 393 env_var1: value1 394 env_var2: value2 395 396# scripts to run before deployment 397before_deploy: 398 399# scripts to run after deployment 400after_deploy: 401 402# to run your custom scripts instead of provider deployments 403deploy_script: 404 405# to disable deployment 406#deploy: off 407 408#---------------------------------# 409# global handlers # 410#---------------------------------# 411 412# on successful build 413on_success: 414 - do something 415 416# on build failure 417on_failure: 418 - do something 419 420# after build failure or success 421on_finish: 422 - do something 423 424#---------------------------------# 425# notifications # 426#---------------------------------# 427 428notifications: 429 # Email 430 - provider: Email 431 to: 432 - user1@email.com 433 - user2@email.com 434 subject: "Build {{status}}" # optional 435 message: "{{message}}, {{commitId}}, ..." # optional 436 on_build_status_changed: true 437 438 # HipChat 439 - provider: HipChat 440 auth_token: 441 secure: RbOnSMSFKYzxzFRrxM1+XA== 442 room: ProjectA 443 template: "{message}, {commitId}, ..." 444 445 # Slack 446 - provider: Slack 447 incoming_webhook: http://incoming-webhook-url 448 449 # ...or using auth token 450 451 - provider: Slack 452 auth_token: 453 secure: kBl9BlxvRMr9liHmnBs14A== 454 channel: development 455 template: "{message}, {commitId}, ..." 456 457 # Campfire 458 - provider: Campfire 459 account: appveyor 460 auth_token: 461 secure: RifLRG8Vfyol+sNhj9u2JA== 462 room: ProjectA 463 template: "{message}, {commitId}, ..." 464 465 # Webhook 466 - provider: Webhook 467 url: http://www.myhook2.com 468 headers: 469 User-Agent: myapp 1.0 470 Authorization: 471 secure: GhD+5xhLz/tkYY6AO3fcfQ== 472 on_build_success: false 473 on_build_failure: true 474 on_build_status_changed: true

Azure Pipelines是一种云服务，可用于自动构建和测试您的代码项目并将其提供给其他用户。它几乎适用于任何语言或项目类型。 Azure Pipelines将持续集成（CI）和持续交付（CD）相结合，以持续不断地测试和构建您的代码并将其交付给任何目标。 ...

之前刚学的时候对这个玩意音响没那么深刻，现在再学，感觉很不一样了。 CS为代码段寄存器，IP为指令指针寄存器。 设CS = M, IP = N, 8086CPU将从 M × 16 + N 处读取指令并进行。 也可以这样表述： 8086CPU中，任意时刻，CPU都会将CS:IP指向的内容做为执行指令. ...