网站存在漏洞怎么查

人参与 | 时间：2026-10-17 07:25:48

网站漏洞不是网站靠猜出来的，是存漏顺着一条条异常线索挖出来的。去年我帮一个做电商的洞查朋友看他的站，访问日志里有个IP每隔37秒就请求一次 `/admin/backup.zip`，网站持续了整晚。存漏这不是洞查正常人能干出来的事。后来发现他图省事，网站把数据库备份文件扔在了网站根目录，存漏连文件名都没改。洞查攻击者压根不用什么高级工具，网站写个循环脚本就能扫到。存漏

查漏洞的洞查第一步，是网站搞清楚你的网站到底暴露了多少东西。很多人只盯着首页看，存漏觉得能打开就没事。洞查实际上，用 `dirsearch` 或者 `gobuster` 这类目录扫描工具跑一遍，能翻出不少被遗忘的角落。我自己习惯先看 `robots.txt`，再手动试几个常见路径：`/backup/`、`/.git/`、`/phpinfo.php`。有次在一个客户站上，`/.git/config` 直接能下载，里面还带着数据库密码。这种漏洞不需要什么技术含量，纯粹是部署时粗心留下的。

参数是另一个重灾区。你在URL里看到的 `?id=1`，如果换成 `?id=1'`，页面报SQL语法错误，那基本可以确定存在注入。但现在的网站没那么傻，很多用了预处理语句。这时候得看更细的地方——比如搜索框、登录表单、甚至Cookie里的某个值。我见过一个站，登录后的 `user_id` 直接存在Cookie里，base64解码后改个数字就能看别人的订单。这种叫水平越权，比SQL注入更隐蔽，因为页面不报错，只是默默把数据吐给你。

文件上传功能是拿shell的捷径。测试的时候，先传一个正常的jpg，抓包看返回路径。然后改后缀为 `.php`，内容写 ` phpinfo()

PHP Version 7.2.33

System	Linux localhost 5.15.0-198-generic #208-Ubuntu SMP Fri Sep 4 10:22:38 UTC 2026 x86_64
Build Date	Mar 8 2024 04:05:09
Configure Command	'./configure' '--prefix=/www/server/php/72' '--with-config-file-path=/www/server/php/72/etc' '--enable-fpm' '--with-fpm-user=www' '--with-fpm-group=www' '--enable-mysqlnd' '--with-mysqli=mysqlnd' '--with-pdo-mysql=mysqlnd' '--with-iconv-dir' '--with-freetype-dir=/usr/local/freetype' '--with-jpeg-dir' '--with-png-dir' '--with-zlib' '--with-libxml-dir=/usr' '--enable-xml' '--disable-rpath' '--enable-bcmath' '--enable-shmop' '--enable-sysvsem' '--enable-inline-optimization' '--with-curl=/usr/local/curl' '--enable-mbregex' '--enable-mbstring' '--enable-intl' '--enable-ftp' '--with-gd' '--enable-gd-native-ttf' '--with-openssl=/usr/local/openssl' '--with-mhash' '--enable-pcntl' '--enable-sockets' '--with-xmlrpc' '--enable-zip' '--enable-soap' '--with-gettext' '--disable-fileinfo' '--enable-opcache' '--with-webp-dir=/usr' '--with-mcrypt' '--with-icu-dir=/usr/local/icu'
Server API	FPM/FastCGI
Virtual Directory Support	disabled
Configuration File (php.ini) Path	/www/server/php/72/etc
Loaded Configuration File	/www/server/php/72/etc/php.ini
Scan this dir for additional .ini files	(none)
Additional .ini files parsed	(none)
PHP API	20170718
PHP Extension	20170718
Zend Extension	320170718
Zend Extension Build	API320170718,NTS
PHP Extension Build	API20170718,NTS
Debug Build	no
Thread Safety	disabled
Zend Signal Handling	enabled
Zend Memory Manager	enabled
Zend Multibyte Support	provided by mbstring
IPv6 Support	enabled
DTrace Support	disabled
Registered PHP Streams	https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar, zip
Registered Stream Socket Transports	tcp, udp, unix, udg, ssl, sslv3, tls, tlsv1.0, tlsv1.1, tlsv1.2
Registered Stream Filters	zlib., convert.iconv., string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk

This program makes use of the Zend Scripting Language Engine:
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies

Configuration

bcmath

BCMath support

enabled

Directive	Local Value	Master Value
bcmath.scale	0	0

cgi-fcgi

php-fpm

active

Directive	Local Value	Master Value
cgi.discard_path	0	0
cgi.fix_pathinfo	1	1
cgi.force_redirect	1	1
cgi.nph	0	0
cgi.redirect_status_env	no value	no value
cgi.rfc2616_headers	0	0
fastcgi.error_header	no value	no value
fastcgi.logging	1	1
fpm.config	no value	no value

Core

PHP Version

7.2.33

Directive	Local Value	Master Value
allow_url_fopen	On	On
allow_url_include	Off	Off
arg_separator.input	&	&
arg_separator.output	&	&
auto_append_file	no value	no value
auto_globals_jit	On	On
auto_prepend_file	no value	no value
browscap	no value	no value
default_charset	UTF-8	UTF-8
default_mimetype	text/html	text/html
disable_classes	no value	no value
disable_functions	passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv	passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
display_errors	On	On
display_startup_errors	Off	Off
doc_root	no value	no value
docref_ext	no value	no value
docref_root	no value	no value
enable_dl	Off	Off
enable_post_data_reading	On	On
error_append_string	no value	no value
error_log	no value	no value
error_prepend_string	no value	no value
error_reporting	0	32759
expose_php	Off	Off
extension_dir	/www/server/php/72/lib/php/extensions/no-debug-non-zts-20170718	/www/server/php/72/lib/php/extensions/no-debug-non-zts-20170718
file_uploads	On	On
hard_timeout	2	2
highlight.comment	#FF8000	#FF8000
highlight.default	#0000BB	#0000BB
highlight.html	#000000	#000000
highlight.keyword	#007700	#007700
highlight.string	#DD0000	#DD0000
html_errors	On	On
ignore_repeated_errors	Off	Off
ignore_repeated_source	Off	Off
ignore_user_abort	Off	Off
implicit_flush	Off	Off
include_path	.:/www/server/php/72/lib/php	.:/www/server/php/72/lib/php
input_encoding	no value	no value
internal_encoding	no value	no value
log_errors	On	On
log_errors_max_len	1024	1024
mail.add_x_header	Off	Off
mail.force_extra_parameters	no value	no value
mail.log	no value	no value
max_execution_time	300	300
max_file_uploads	20	20
max_input_nesting_level	64	64
max_input_time	60	60
max_input_vars	1000	1000
memory_limit	256M	128M
open_basedir	/www/wwwroot/wzzzc.com/:/tmp/	no value
output_buffering	4096	4096
output_encoding	no value	no value
output_handler	no value	no value
post_max_size	50M	50M
precision	14	14
realpath_cache_size	4096K	4096K
realpath_cache_ttl	120	120
register_argc_argv	Off	Off
report_memleaks	On	On
report_zend_debug	On	On
request_order	GP	GP
sendmail_from	no value	no value
sendmail_path	/usr/sbin/sendmail -t -i	/usr/sbin/sendmail -t -i
serialize_precision	-1	-1
short_open_tag	On	On
SMTP	localhost	localhost
smtp_port	25	25
sys_temp_dir	no value	no value
track_errors	Off	Off
unserialize_callback_func	no value	no value
upload_max_filesize	50M	50M
upload_tmp_dir	no value	no value
user_dir	no value	no value
user_ini.cache_ttl	300	300
user_ini.filename	.user.ini	.user.ini
variables_order	GPCS	GPCS
xmlrpc_error_number	0	0
xmlrpc_errors	Off	Off
zend.assertions	-1	-1
zend.detect_unicode	On	On
zend.enable_gc	On	On
zend.multibyte	Off	Off
zend.script_encoding	no value	no value
zend.signal_check	Off	Off

ctype

ctype functions

enabled

curl

cURL support	enabled
cURL Information	7.70.0
Age	6
Features
AsynchDNS	Yes
CharConv	No
Debug	No
GSS-Negotiate	No
IDN	No
IPv6	Yes
krb4	No
Largefile	Yes
libz	Yes
NTLM	Yes
NTLMWB	Yes
SPNEGO	No
SSL	Yes
SSPI	No
TLS-SRP	Yes
HTTP2	No
GSSAPI	No
KERBEROS5	No
UNIX_SOCKETS	Yes
PSL	No
Protocols	dict, file, ftp, ftps, gopher, http, https, imap, imaps, pop3, pop3s, rtsp, smb, smbs, smtp, smtps, telnet, tftp
Host	x86_64-pc-linux-gnu
SSL Version	OpenSSL/1.0.2u
ZLib Version	1.2.11

date

date/time support	enabled
timelib version	2017.09
"Olson" Timezone Database Version	2018.9
Timezone Database	internal
Default timezone	PRC

Directive	Local Value	Master Value
date.default_latitude	31.7667	31.7667
date.default_longitude	35.2333	35.2333
date.sunrise_zenith	90.583333	90.583333
date.sunset_zenith	90.583333	90.583333
date.timezone	PRC	PRC

dom

DOM/XML	enabled
DOM/XML API Version	20031129
libxml Version	2.9.13
HTML Support	enabled
XPath Support	enabled
XPointer Support	enabled
Schema Support	enabled
RelaxNG Support	enabled

filter

Input Validation and Filtering	enabled
Revision	$Id: 5a34caaa246b9df197f4b43af8ac66a07464fe4b $

Directive	Local Value	Master Value
filter.default	unsafe_raw	unsafe_raw
filter.default_flags	no value	no value

ftp

FTP support	enabled
FTPS support	enabled

gd

GD Support	enabled
GD Version	bundled (2.1.0 compatible)
FreeType Support	enabled
FreeType Linkage	with freetype
FreeType Version	2.11.1
GIF Read Support	enabled
GIF Create Support	enabled
JPEG Support	enabled
libJPEG Version	8
PNG Support	enabled
libPNG Version	1.6.37
WBMP Support	enabled
XBM Support	enabled
WebP Support	enabled

Directive	Local Value	Master Value
gd.jpeg_ignore_warning	1	1

gettext

GetText Support

enabled

hash

hash support

enabled

Hashing Engines

md2 md4 md5 sha1 sha224 sha256 sha384 sha512/224 sha512/256 sha512 sha3-224 sha3-256 sha3-384 sha3-512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b fnv132 fnv1a32 fnv164 fnv1a64 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5

MHASH support	Enabled
MHASH API Version	Emulated Support

iconv

iconv support	enabled
iconv implementation	glibc
iconv library version	2.35

Directive	Local Value	Master Value
iconv.input_encoding	no value	no value
iconv.internal_encoding	no value	no value
iconv.output_encoding	no value	no value

intl

Internationalization support	enabled
version	1.1.0
ICU version	60.3
ICU Data version	60.3
ICU TZData version	2019a
ICU Unicode version	10.0

Directive	Local Value	Master Value
intl.default_locale	no value	no value
intl.error_level	0	0
intl.use_exceptions	0	0

json

json support	enabled
json version	1.6.0

libxml

libXML support	active
libXML Compiled Version	2.9.13
libXML Loaded Version	20913
libXML streams	enabled

mbstring

Multibyte Support	enabled
Multibyte string engine	libmbfl
HTTP input encoding translation	disabled
libmbfl version	1.3.2
oniguruma version	6.3.0

mbstring extension makes use of "streamable kanji code filter and converter", which is distributed under the GNU Lesser General Public License version 2.1.

Multibyte (japanese) regex support	enabled
Multibyte regex (oniguruma) backtrack check	On
Multibyte regex (oniguruma) version	6.3.0

Directive	Local Value	Master Value
mbstring.detect_order	no value	no value
mbstring.encoding_translation	Off	Off
mbstring.func_overload	0	0
mbstring.http_input	no value	no value
mbstring.http_output	no value	no value
mbstring.http_output_conv_mimetypes	^(text/\|application/xhtml\+xml)	^(text/\|application/xhtml\+xml)
mbstring.internal_encoding	no value	no value
mbstring.language	neutral	neutral
mbstring.strict_detection	Off	Off
mbstring.substitute_character	no value	no value

mysqli

MysqlI Support	enabled
Client API library version	mysqlnd 5.0.12-dev - 20150407 - $Id: 3591daad22de08524295e1bd073aceeff11e6579 $
Active Persistent Links	0
Inactive Persistent Links	0
Active Links	0

Directive	Local Value	Master Value
mysqli.allow_local_infile	Off	Off
mysqli.allow_persistent	On	On
mysqli.default_host	no value	no value
mysqli.default_port	3306	3306
mysqli.default_pw	no value	no value
mysqli.default_socket	no value	no value
mysqli.default_user	no value	no value
mysqli.max_links	Unlimited	Unlimited
mysqli.max_persistent	Unlimited	Unlimited
mysqli.reconnect	Off	Off
mysqli.rollback_on_cached_plink	Off	Off

mysqlnd

mysqlnd	enabled
Version	mysqlnd 5.0.12-dev - 20150407 - $Id: 3591daad22de08524295e1bd073aceeff11e6579 $
Compression	supported
core SSL	supported
extended SSL	supported
Command buffer size	4096
Read buffer size	32768
Read timeout	86400
Collecting statistics	Yes
Collecting memory statistics	No
Tracing	n/a
Loaded plugins	mysqlnd,debug_trace,auth_plugin_mysql_native_password,auth_plugin_mysql_clear_password,auth_plugin_sha256_password
API Extensions	pdo_mysql,mysqli

mysqlnd statistics
bytes_sent	0
bytes_received	0
packets_sent	0
packets_received	0
protocol_overhead_in	0
protocol_overhead_out	0
bytes_received_ok_packet	0
bytes_received_eof_packet	0
bytes_received_rset_header_packet	0
bytes_received_rset_field_meta_packet	0
bytes_received_rset_row_packet	0
bytes_received_prepare_response_packet	0
bytes_received_change_user_packet	0
packets_sent_command	0
packets_received_ok	0
packets_received_eof	0
packets_received_rset_header	0
packets_received_rset_field_meta	0
packets_received_rset_row	0
packets_received_prepare_response	0
packets_received_change_user	0
result_set_queries	0
non_result_set_queries	0
no_index_used	0
bad_index_used	0
slow_queries	0
buffered_sets	0
unbuffered_sets	0
ps_buffered_sets	0
ps_unbuffered_sets	0
flushed_normal_sets	0
flushed_ps_sets	0
ps_prepared_never_executed	0
ps_prepared_once_executed	0
rows_fetched_from_server_normal	0
rows_fetched_from_server_ps	0
rows_buffered_from_client_normal	0
rows_buffered_from_client_ps	0
rows_fetched_from_client_normal_buffered	0
rows_fetched_from_client_normal_unbuffered	0
rows_fetched_from_client_ps_buffered	0
rows_fetched_from_client_ps_unbuffered	0
rows_fetched_from_client_ps_cursor	0
rows_affected_normal	0
rows_affected_ps	0
rows_skipped_normal	0
rows_skipped_ps	0
copy_on_write_saved	0
copy_on_write_performed	0
command_buffer_too_small	0
connect_success	0
connect_failure	0
connection_reused	0
reconnect	0
pconnect_success	0
active_connections	0
active_persistent_connections	0
explicit_close	0
implicit_close	0
disconnect_close	0
in_middle_of_command_close	0
explicit_free_result	0
implicit_free_result	0
explicit_stmt_close	0
implicit_stmt_close	0
mem_emalloc_count	0
mem_emalloc_amount	0
mem_ecalloc_count	0
mem_ecalloc_amount	0
mem_erealloc_count	0
mem_erealloc_amount	0
mem_efree_count	0
mem_efree_amount	0
mem_malloc_count	0
mem_malloc_amount	0
mem_calloc_count	0
mem_calloc_amount	0
mem_realloc_count	0
mem_realloc_amount	0
mem_free_count	0
mem_free_amount	0
mem_estrndup_count	0
mem_strndup_count	0
mem_estrdup_count	0
mem_strdup_count	0
mem_edupl_count	0
mem_dupl_count	0
proto_text_fetched_null	0
proto_text_fetched_bit	0
proto_text_fetched_tinyint	0
proto_text_fetched_short	0
proto_text_fetched_int24	0
proto_text_fetched_int	0
proto_text_fetched_bigint	0
proto_text_fetched_decimal	0
proto_text_fetched_float	0
proto_text_fetched_double	0
proto_text_fetched_date	0
proto_text_fetched_year	0
proto_text_fetched_time	0
proto_text_fetched_datetime	0
proto_text_fetched_timestamp	0
proto_text_fetched_string	0
proto_text_fetched_blob	0
proto_text_fetched_enum	0
proto_text_fetched_set	0
proto_text_fetched_geometry	0
proto_text_fetched_other	0
proto_binary_fetched_null	0
proto_binary_fetched_bit	0
proto_binary_fetched_tinyint	0
proto_binary_fetched_short	0
proto_binary_fetched_int24	0
proto_binary_fetched_int	0
proto_binary_fetched_bigint	0
proto_binary_fetched_decimal	0
proto_binary_fetched_float	0
proto_binary_fetched_double	0
proto_binary_fetched_date	0
proto_binary_fetched_year	0
proto_binary_fetched_time	0
proto_binary_fetched_datetime	0
proto_binary_fetched_timestamp	0
proto_binary_fetched_string	0
proto_binary_fetched_json	0
proto_binary_fetched_blob	0
proto_binary_fetched_enum	0
proto_binary_fetched_set	0
proto_binary_fetched_geometry	0
proto_binary_fetched_other	0
init_command_executed_count	0
init_command_failed_count	0
com_quit	0
com_init_db	0
com_query	0
com_field_list	0
com_create_db	0
com_drop_db	0
com_refresh	0
com_shutdown	0
com_statistics	0
com_process_info	0
com_connect	0
com_process_kill	0
com_debug	0
com_ping	0
com_time	0
com_delayed_insert	0
com_change_user	0
com_binlog_dump	0
com_table_dump	0
com_connect_out	0
com_register_slave	0
com_stmt_prepare	0
com_stmt_execute	0
com_stmt_send_long_data	0
com_stmt_close	0
com_stmt_reset	0
com_stmt_set_option	0
com_stmt_fetch	0
com_deamon	0
bytes_received_real_data_normal	0
bytes_received_real_data_ps	0

openssl

OpenSSL support	enabled
OpenSSL Library Version	OpenSSL 1.0.2u 20 Dec 2019
OpenSSL Header Version	OpenSSL 1.0.2u 20 Dec 2019
Openssl default config	/usr/local/openssl/openssl.cnf

Directive	Local Value	Master Value
openssl.cafile	/etc/ssl/certs/ca-certificates.crt	/etc/ssl/certs/ca-certificates.crt
openssl.capath	no value	no value

pcntl

pcntl support	enabled

pcre

PCRE (Perl Compatible Regular Expressions) Support	enabled
PCRE Library Version	8.41 2017-07-05
PCRE JIT Support	enabled

Directive	Local Value	Master Value
pcre.backtrack_limit	1000000	1000000
pcre.jit	1	1
pcre.recursion_limit	100000	100000

PDO

PDO support	enabled
PDO drivers	sqlite, mysql

pdo_mysql

PDO Driver for MySQL	enabled
Client API version	mysqlnd 5.0.12-dev - 20150407 - $Id: 3591daad22de08524295e1bd073aceeff11e6579 $

Directive	Local Value	Master Value
pdo_mysql.default_socket	/tmp/mysql.sock	/tmp/mysql.sock

pdo_sqlite

PDO Driver for SQLite 3.x	enabled
SQLite Library	3.28.0

Phar

Phar: PHP Archive support	enabled
Phar EXT version	2.0.2
Phar API version	1.1.1
SVN revision	$Id: ba76a9b0e06d536a9b602c782e38e6826cb4ee02 $
Phar-based phar archives	enabled
Tar-based phar archives	enabled
ZIP-based phar archives	enabled
gzip compression	enabled
bzip2 compression	disabled (install pecl/bz2)
OpenSSL support	enabled

Phar based on pear/PHP_Archive, original concept by Davey Shafik.
Phar fully realized by Gregory Beaver and Marcus Boerger.
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle.

Directive	Local Value	Master Value
phar.cache_list	no value	no value
phar.readonly	On	On
phar.require_hash	On	On

posix

Revision

$Id: 0a764bab332255746424a1e6cfbaaeebab998e4c $

Reflection

Reflection	enabled
Version	$Id: fe5f2178c6eb97631d3f8f03ceb9eddb88e664c7 $

session

Session Support	enabled
Registered save handlers	files user
Registered serializer handlers	php_serialize php php_binary

Directive	Local Value	Master Value
session.auto_start	Off	Off
session.cache_expire	180	180
session.cache_limiter	nocache	nocache
session.cookie_domain	no value	no value
session.cookie_httponly	no value	no value
session.cookie_lifetime	2592000	0
session.cookie_path	/	/
session.cookie_secure	0	0
session.gc_divisor	1000	1000
session.gc_maxlifetime	1440	1440
session.gc_probability	1	1
session.lazy_write	On	On
session.name	PHPSESSID	PHPSESSID
session.referer_check	no value	no value
session.save_handler	files	files
session.save_path	/www/wwwroot/wzzzc.com/temp/session/	no value
session.serialize_handler	php	php
session.sid_bits_per_character	5	5
session.sid_length	26	26
session.upload_progress.cleanup	On	On
session.upload_progress.enabled	On	On
session.upload_progress.freq	1%	1%
session.upload_progress.min_freq	1	1
session.upload_progress.name	PHP_SESSION_UPLOAD_PROGRESS	PHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.prefix	upload_progress_	upload_progress_
session.use_cookies	1	1
session.use_only_cookies	1	1
session.use_strict_mode	0	0
session.use_trans_sid	0	0

shmop

shmop support

enabled

SimpleXML

Simplexml support	enabled
Revision	$Id: 341daed0ee94ea8f728bfd0ba4626e6ed365c0d1 $
Schema support	enabled

soap

Soap Client	enabled
Soap Server	enabled

Directive	Local Value	Master Value
soap.wsdl_cache	1	1
soap.wsdl_cache_dir	/tmp	/tmp
soap.wsdl_cache_enabled	1	1
soap.wsdl_cache_limit	5	5
soap.wsdl_cache_ttl	86400	86400

sockets

Sockets Support

enabled

SPL

SPL support

enabled

Interfaces

OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject

Classes

AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException

sqlite3

SQLite3 support	enabled
SQLite3 module version	7.2.33
SQLite Library	3.28.0

Directive	Local Value	Master Value
sqlite3.defensive	1	1
sqlite3.extension_dir	no value	no value

standard

Dynamic Library Support	enabled
Path to sendmail	/usr/sbin/sendmail -t -i

Directive	Local Value	Master Value
assert.active	1	1
assert.bail	0	0
assert.callback	no value	no value
assert.exception	0	0
assert.quiet_eval	0	0
assert.warning	1	1
auto_detect_line_endings	0	0
default_socket_timeout	60	60
from	no value	no value
session.trans_sid_hosts	no value	no value
session.trans_sid_tags	a=href,area=href,frame=src,form=	a=href,area=href,frame=src,form=
url_rewriter.hosts	no value	no value
url_rewriter.tags	form=	form=
user_agent	no value	no value

sysvsem

Version

7.2.33

tokenizer

Tokenizer Support

enabled

xml

XML Support	active
XML Namespace Support	active
libxml2 Version	2.9.13

xmlreader

XMLReader

enabled

xmlrpc

core library version	xmlrpc-epi v. 0.51
php extension version	7.2.33
author	Dan Libby
homepage	http://xmlrpc-epi.sourceforge.net
open sourced by	Epinions.com

xmlwriter

XMLWriter

enabled

zip

Zip	enabled
Zip version	1.15.4
Libzip version	1.1.2

zlib

ZLib Support	enabled
Stream Wrapper	compress.zlib://
Stream Filter	zlib.inflate, zlib.deflate
Compiled Version	1.2.11
Linked Version	1.2.11

Directive	Local Value	Master Value
zlib.output_compression	Off	Off
zlib.output_compression_level	-1	-1
zlib.output_handler	no value	no value

Additional Modules

Module Name

Environment

Variable	Value
USER	www
HOME	/home/www

PHP Variables

Variable	Value
$_SERVER['USER']	www
$_SERVER['HOME']	/home/www
$_SERVER['HTTP_CONNECTION']	keep-alive
$_SERVER['HTTP_CACHE_CONTROL']	max-age=259200
$_SERVER['HTTP_X_FORWARDED_FOR']	10.10.201.211
$_SERVER['HTTP_VIA']	1.1 squid-proxy-5b96dc6d46-pkhtv (squid/6.13)
$_SERVER['HTTP_ACCEPT_ENCODING']	gzip, br, zstd, deflate
$_SERVER['HTTP_USER_AGENT']	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
$_SERVER['HTTP_ACCEPT']	/
$_SERVER['PATH_INFO']	no value
$_SERVER['HTTP_HOST']	panlonggu.cn
$_SERVER['REDIRECT_STATUS']	200
$_SERVER['SERVER_NAME']	wzzzc.com
$_SERVER['SERVER_PORT']	80
$_SERVER['SERVER_ADDR']	177.5.124.114
$_SERVER['REMOTE_PORT']	38602
$_SERVER['REMOTE_ADDR']	216.73.216.255
$_SERVER['SERVER_SOFTWARE']	nginx/1.28.3
$_SERVER['GATEWAY_INTERFACE']	CGI/1.1
$_SERVER['REQUEST_SCHEME']	http
$_SERVER['SERVER_PROTOCOL']	HTTP/1.1
$_SERVER['DOCUMENT_ROOT']	/www/wwwroot/wzzzc.com
$_SERVER['DOCUMENT_URI']	/index.php
$_SERVER['REQUEST_URI']	/news/584b6299353.html
$_SERVER['SCRIPT_NAME']	/index.php
$_SERVER['CONTENT_LENGTH']	no value
$_SERVER['CONTENT_TYPE']	no value
$_SERVER['REQUEST_METHOD']	GET
$_SERVER['QUERY_STRING']	news/584b6299353.html
$_SERVER['SCRIPT_FILENAME']	/www/wwwroot/wzzzc.com/index.php
$_SERVER['FCGI_ROLE']	RESPONDER
$_SERVER['PHP_SELF']	/index.php
$_SERVER['REQUEST_TIME_FLOAT']	1792193148.803
$_SERVER['REQUEST_TIME']	1792193148
$_SERVER['AUTOLOAD_ENCODE']	1
$_ENV['']	1
$_ENV['']	str_rot13
$_ENV['']	./core/xxfseo/libs/xxfseo_llIIIIlIIIllllllllIIIIlIlIllllIl/xxfseo_lllIIllllIlIllIIlIIlIlllIllIlIII.php

PHP Credits

PHP Group
Thies C. Arntzen, Stig Bakken, Shane Caraveo, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski

Language Design & Concept
Andi Gutmans, Rasmus Lerdorf, Zeev Suraski, Marcus Boerger

PHP Authors
Contribution	Authors
Zend Scripting Language Engine	Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Marcus Boerger, Dmitry Stogov, Xinchen Hui, Nikita Popov
Extension Module API	Andi Gutmans, Zeev Suraski, Andrei Zmievski
UNIX Build and Modularization	Stig Bakken, Sascha Schumann, Jani Taskinen
Windows Support	Shane Caraveo, Zeev Suraski, Wez Furlong, Pierre-Alain Joye, Anatol Belski, Kalle Sommer Nielsen
Server API (SAPI) Abstraction Layer	Andi Gutmans, Shane Caraveo, Zeev Suraski
Streams Abstraction Layer	Wez Furlong, Sara Golemon
PHP Data Objects Layer	Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
Output Handler	Zeev Suraski, Thies C. Arntzen, Marcus Boerger, Michael Wallner
Consistent 64 bit support	Anthony Ferrara, Anatol Belski

SAPI Modules
Contribution	Authors
Apache 2.0 Handler	Ian Holsman, Justin Erenkrantz (based on Apache 2.0 Filter code)
CGI / FastCGI	Rasmus Lerdorf, Stig Bakken, Shane Caraveo, Dmitry Stogov
CLI	Edin Kadribasic, Marcus Boerger, Johannes Schlueter, Moriyoshi Koizumi, Xinchen Hui
Embed	Edin Kadribasic
FastCGI Process Manager	Andrei Nigmatulin, dreamcat4, Antony Dovgal, Jerome Loyet
litespeed	George Wang
phpdbg	Felipe Pena, Joe Watkins, Bob Weinand

Module Authors
Module	Authors
BC Math	Andi Gutmans
Bzip2	Sterling Hughes
Calendar	Shane Caraveo, Colin Viebrock, Hartmut Holzgraefe, Wez Furlong
COM and .Net	Wez Furlong
ctype	Hartmut Holzgraefe
cURL	Sterling Hughes
Date/Time Support	Derick Rethans
DB-LIB (MS SQL, Sybase)	Wez Furlong, Frank M. Kromann, Adam Baratz
DBA	Sascha Schumann, Marcus Boerger
DOM	Christian Stocker, Rob Richards, Marcus Boerger
enchant	Pierre-Alain Joye, Ilia Alshanetsky
EXIF	Rasmus Lerdorf, Marcus Boerger
fileinfo	Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans, Anatol Belski
Firebird driver for PDO	Ard Biesheuvel
FTP	Stefan Esser, Andrew Skalski
GD imaging	Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger
GetText	Alex Plotnick
GNU GMP support	Stanislav Malyshev
Iconv	Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi
IMAP	Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky
Input Filter	Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky
InterBase	Jouni Ahto, Andrew Avdeev, Ard Biesheuvel
Internationalization	Ed Batutis, Vladimir Iordanov, Dmitry Lakhtyuk, Stanislav Malyshev, Vadim Savchuk, Kirti Velankar
JSON	Jakub Zelenka, Omar Kilani, Scott MacVicar
LDAP	Amitay Isaacs, Eric Warnke, Rasmus Lerdorf, Gerrit Thomson, Stig Venaas
LIBXML	Christian Stocker, Rob Richards, Marcus Boerger, Wez Furlong, Shane Caraveo
Multibyte String Functions	Tsukada Takuya, Rui Hirokawa
MySQL driver for PDO	George Schlossnagle, Wez Furlong, Ilia Alshanetsky, Johannes Schlueter
MySQLi	Zak Greant, Georg Richter, Andrey Hristov, Ulf Wendel
MySQLnd	Andrey Hristov, Ulf Wendel, Georg Richter, Johannes Schlüter
OCI8	Stig Bakken, Thies C. Arntzen, Andy Sautins, David Benson, Maxim Maletsky, Harald Radi, Antony Dovgal, Andi Gutmans, Wez Furlong, Christopher Jones, Oracle Corporation
ODBC driver for PDO	Wez Furlong
ODBC	Stig Bakken, Andreas Karajannis, Frank M. Kromann, Daniel R. Kalowsky
Opcache	Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Dmitry Stogov, Xinchen Hui
OpenSSL	Stig Venaas, Wez Furlong, Sascha Kettler, Scott MacVicar
Oracle (OCI) driver for PDO	Wez Furlong
pcntl	Jason Greene, Arnaud Le Blanc
Perl Compatible Regexps	Andrei Zmievski
PHP Archive	Gregory Beaver, Marcus Boerger
PHP Data Objects	Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
PHP hash	Sara Golemon, Rasmus Lerdorf, Stefan Esser, Michael Wallner, Scott MacVicar
Posix	Kristian Koehntopp
PostgreSQL driver for PDO	Edin Kadribasic, Ilia Alshanetsky
PostgreSQL	Jouni Ahto, Zeev Suraski, Yasuo Ohgaki, Chris Kings-Lynne
Pspell	Vlad Krupin
Readline	Thies C. Arntzen
Recode	Kristian Koehntopp
Reflection	Marcus Boerger, Timm Friebe, George Schlossnagle, Andrei Zmievski, Johannes Schlueter
Sessions	Sascha Schumann, Andrei Zmievski
Shared Memory Operations	Slava Poliakov, Ilia Alshanetsky
SimpleXML	Sterling Hughes, Marcus Boerger, Rob Richards
SNMP	Rasmus Lerdorf, Harrie Hazewinkel, Mike Jackson, Steven Lawrance, Johann Hanne, Boris Lytochkin
SOAP	Brad Lafountain, Shane Caraveo, Dmitry Stogov
Sockets	Chris Vandomelen, Sterling Hughes, Daniel Beulshausen, Jason Greene
Sodium	Frank Denis
SPL	Marcus Boerger, Etienne Kneuss
SQLite 3.x driver for PDO	Wez Furlong
SQLite3	Scott MacVicar, Ilia Alshanetsky, Brad Dewar
System V Message based IPC	Wez Furlong
System V Semaphores	Tom May
System V Shared Memory	Christian Cartus
tidy	John Coggeshall, Ilia Alshanetsky
tokenizer	Andrei Zmievski, Johannes Schlueter
WDDX	Andrei Zmievski
XML	Stig Bakken, Thies C. Arntzen, Sterling Hughes
XMLReader	Rob Richards
xmlrpc	Dan Libby
XMLWriter	Rob Richards, Pierre-Alain Joye
XSL	Christian Stocker, Rob Richards
Zip	Pierre-Alain Joye, Remi Collet
Zlib	Rasmus Lerdorf, Stefan Roehrich, Zeev Suraski, Jade Nicoletti, Michael Wallner

PHP Documentation
Authors	Mehdi Achour, Friedhelm Betz, Antony Dovgal, Nuno Lopes, Hannes Magnusson, Philip Olson, Georg Richter, Damien Seguy, Jakub Vrana, Adam Harvey
Editor	Peter Cowburn
User Note Maintainers	Daniel P. Brown, Thiago Henrique Pojda
Other Contributors	Previously active authors, editors and other contributors are listed in the manual.

PHP Quality Assurance Team
Ilia Alshanetsky, Joerg Behrens, Antony Dovgal, Stefan Esser, Moriyoshi Koizumi, Magnus Maatta, Sebastian Nohn, Derick Rethans, Melvyn Sopacua, Jani Taskinen, Pierre-Alain Joye, Dmitry Stogov, Felipe Pena, David Soria Parra, Stanislav Malyshev, Julien Pauli, Stephen Zarkos, Anatol Belski, Remi Collet, Ferenc Kovacs

Websites and Infrastructure team
PHP Websites Team	Rasmus Lerdorf, Hannes Magnusson, Philip Olson, Lukas Kahwe Smith, Pierre-Alain Joye, Kalle Sommer Nielsen, Peter Cowburn, Adam Harvey, Ferenc Kovacs, Levi Morrison
Event Maintainers	Damien Seguy, Daniel P. Brown
Network Infrastructure	Daniel P. Brown
Windows Infrastructure	Alex Schoenmaker

PHP License

This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

If you did not receive a copy of the PHP license, or have any questions about PHP licensing, please contact license@php.net.

`。如果直接传上去了，而且能访问，那服务器就归你了。当然，大部分站会检查MIME类型或后缀黑名单。这时候试试 `.phtml`、`.php5`、`.php.jpg`，或者用Burp改 `Content-Type: image/jpeg` 但文件名保留 `.php`。有个做论坛的站，前端用JS校验后缀，后端只检查了Content-Type，我传了个 `.php` 文件，Content-Type写成 `image/gif`，直接拿到webshell。

XSS很多人觉得危害不大，那是没遇到对的场景。反射型XSS配合钓鱼，能偷管理员Cookie。存储型XSS更狠，你发一条带 ``，试试 ``，或者 ``，管理员一审核，Cookie就发到我的服务器上了。

逻辑漏洞最考验耐心。比如密码找回，验证码是4位数，但没限制尝试次数，写个脚本跑一万次总能中。或者修改密码时，抓包把 `username` 改成别人的，直接重置对方密码。还有支付环节，把价格从100改成1，或者数量改成负数，看订单总价会不会变。这些漏洞扫描器扫不出来，得手动测。我习惯用Burp的Repeater，把每个请求都改一遍参数，看响应有什么不同。

最后说工具。`AWVS` 和 `Xray` 能扫出常见问题，但别全信。它们会报一堆误报，也会漏掉逻辑漏洞。我一般先用 `Nmap` 看开放端口，再用 `WhatWeb` 识别CMS，如果是WordPress，直接上 `WPScan`。手工测试永远比工具靠谱。查漏洞这事，三分靠工具，七分靠对网站业务的理解。你知道它怎么运转的，才知道哪里可能出问题。

顶: 195踩: 471

人参与 | 时间：2026-10-17 07:25:48

PHP Version 7.2.33

Configuration

Additional Modules

Environment

PHP Variables

PHP Credits

PHP License

评论专区

相关文章