Hack Security Pro.pdf - Index of

REMOTE_HOST: Client's host name
CONTENT_TYPE: Type of information transferred
CONTENT_LENGHT: Number of bytes of data sent to the CGI by the client
QUERY_STRING: Saves the data sent by the client if the transfer method is METHOD=GET. If it is
METHOD=POST that is used, data will be read on the standard output.
The difference with PHP lies above all in the way CGI processes the received data. PHP can
recognize and directly use the name of variables defined in the form, something that the CGI program
cannot do. The latter will have to recover everything that is after ? In the form of a character chain to
process it, and so obtain the value of the variables that are sent to it through the form. CGI has to
process arguments in this way because using a form always sends back data in the shape of
variable1=value1&variable2=value2... It can therefore be concluded that it would be entirely possible to
pass the arguments to the program in a different form, by specifying them in the url after the ?, and
naturally only if the program were coded in such way that it could process this information.
Here is an example of code that will recover the information sent back by the client through a form:
char buffer[50];
buffer = getenv("REQUEST_METHOD"); // We recover the method used in the environment
variable REQUEST_METHOD
if (buffer) { // if this operation is successful we continue
if (strcmp(buffer, "POST") == 0) { // If the POST method is used
buffer = getenv("CONTENT_LENGHT"); // we recover the size of data sent back by the form
if(buffer) { // If this operation is successful we continue
length = atoi(buffer); // We put this value in digital form
data = malloc(buffer + 1); // we attribute memory space for the data variable which will
recover data
fread(data, 1, length, stdin); // we copy what arrives on the standard output into buffer
data[length] = '\0'; // we add the '\0' character at the end of the character chain
contained in buffer
}
}
else if (strcmp(buffer, "GET") == 0) { // But if the GET method is used
buffer = getenv("CONTENT_LENGHT");
if(buffer) {
length = atoi(buffer);
data = malloc(buffer + 1);
}
strcpy(data, getenv("QUERY_STRING")); // We copy the data contained in QUERY_STRING into
buffer
data[length] = '\0';
}
}
Once the data sent back to the cgi program, it must be processed, in order to extract the variables'
values: we know that these are separated with the & sign, and the following function could be in
charge of recovering the value of the first variable in a temporary buffer.
The Hackademy DMP -116/209- SYSDREAM