nginx,php 常见网站漏洞修复

1、xss host头攻击

nginx里修改配置，增加如下

 

server {

listen 80 default;

return 403;

}

server {

listen 443 default;

ssl_certificate cert/7723673_www.a.pem

ssl_certificate_key cert/7723673_www.a.key

ssl_session_timeout 5m;

#ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

ssl_ciphers HIGH:!ADH:!MD5;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

return 403;

}

　　

2、

SetCookie 未配置 SameSite 属性

location ^/abc/ {
proxy_cookie_path / "/; secure; SameSite=None";
}

 nginx里配置了好像没啥用

php里设置如下

setcookie('sessionKey', $sessionKey, $expired, '/; secure; SameSite=none;');

 

一、漏扫出现问题
检测到目标X-Content-Type-Options响应头缺失

add_header 'Referrer-Policy' 'origin';
1
检测到错误页面web应用服务器版本信息泄露 修改404页面及500页面，不要出现apache、nginx等字样

检测到目标Referrer-Policy响应头缺失

add_header 'Referrer-Policy' 'origin';
1
检测到目标X-XSS-Protection响应头缺失

add_header X-Xss-header “1;mode=block”;
1
检测到目标X-Download-Options响应头缺失

add_header X-Download-Options "noopen" always;
1
检测到目标Strict-Transport-Security响应头缺失

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
1
检测到目标Content-Security-Policy响应头缺失

add_header X-Frame-Options SAMEORIGIN;
1
检测到目标X-Permitted-Cross-Domain-Policies响应头缺失

header("X-Permitted-Cross-Domain-Policies:'master-only';");
1
点击劫持：X-Frame-Options未配置

add_header X-Frame-Options SAMEORIGIN;
1
二、nginx.conf
http当中添加server_tokens off;
替换对应的站点域名；

#user nobody;
worker_processes 4;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
events {
worker_connections 40960;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;

server_tokens off;

server {
listen 8080;
server_name *.demo.com;
root "/www/demo";

location / {
index index.php index.html error/index.html;
error_page 400 /error/400.html;
error_page 403 /error/403.html;
error_page 404 /error/404.html;
error_page 500 /error/500.html;
error_page 501 /error/501.html;
error_page 502 /error/502.html;
error_page 503 /error/503.html;
error_page 504 /error/504.html;
error_page 505 /error/505.html;
error_page 506 /error/506.html;
error_page 507 /error/507.html;
error_page 509 /error/509.html;
error_page 510 /error/510.html;
include D:/phpstudy_pro/WWW/8100ktc/nginx.htaccess;
autoindex off;
}
location ~ \.php(.*)$ {
fastcgi_pass 127.0.0.1:9007;
fastcgi_index index.php;
fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
include fastcgi_params;
}
add_header X-Content-Type-Options nosniff;
add_header 'Referrer-Policy' 'origin';
add_header X-Download-Options "noopen" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header X-Permitted-Cross-Domain-Policies "master-only";
add_header X-Frame-Options SAMEORIGIN;
add_header Content-Security-Policy "default-src 'self' data: *.xxx.com 'unsafe-inline' 'unsafe-eval' mediastream: ";
add_header X-Content-Type-Options: nosniff;
add_header X-XSS-Protection "1; mode=block";
# proxy_hide_header X-Powered-By;
}
}