php - 如何在不使用 API 的情况下访问 HTML 登录中的不安全凭据？

Question

我正在上一门本科生安全课程来模拟恶意软件攻击。我无法弄清楚如何实施 Broken Authentication 漏洞。我选择模拟如何从一个简单的 HTML/PHP 登录页面访问凭据，但我喜欢的几乎每个示例都使用 API。有人可以帮我编码吗？我想保持简单，因为它是为了上课。

<form action = "validate.php" method= "POST">
<table border = "0" padding = "5" cols = "2" >
<tr>
<td colspan = "2"><input name="usr" type = "text" placeholder = "Email" title = "Please enter your username here (e.g. [e-mail])" value = "<?php echo $_SESSION['usr']; ?>" class="auto-width" required/><?php echo $_SESSION['usrerr']; ?></td>
</tr>
<tr>
<td colspan = "2"><input name="pw" type = "password" placeholder = "********" title = "Please enter your password " value = "" class = "auto-width" required/>
</td>
</tr>
<tr>
<td><label style='font-size: 50%;'>Remember Me</label></td>
<td><input name="remember" type="checkbox" title="Remember Me for ONE Minute" value="yes" class="auto-width"/></td>
</tr>
<tr>
<td><input type = "submit" value = "Send Info" name = "lgn_submit"/></td>
<td><input type = "reset" value = "Clear"/></td>
<td><?php echo $_SESSION['err'] ?></td>
</tr>
</table>
</form>

标签： phphtml