Unable to secure my site [closed]

Question

I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database if I have enabled both Catpcha and CSRF Tokens.

Answer 1

In addition to what others have said, your question demonstrates a category mistake. You're talking about "securing your site" and you listed two countermeasures.

CAPTCHA is meant to deter automated submissions - to prevent automated programs from submitting data to your application. This doesn't prevent a human being from inserting malicious/garbage data.

CSRF tokens are meant to prevent your website from falling prey to Cross-Site Request Forgery. That's something that happens when another site is infected with XSS, and that injected JavaScript is performing actions on your site. It also has little or nothing to do with garbage input getting into your database (unless that malicious script on the other site is injecting it, but that would be incidental and not relevant to how to prevent it.)

Neither of these have anything to do with bad data getting into your database (except incidentally). The only way to prevent bad data from getting into the database is to filter input, which is done via a combination of input form validation, and proper SQL Injection prevention techniques (not contencating strings, using parameterized stored procedures or prepared statements if the language supports them, etc.

In your case, the most relevant is input validation. And I strongly recommend a white-list approach if feasible.

No offense, but your question indicates that your level of familiarity with basic secure web development principles is on the beginner end of the scale. (And I really mean no offense! It took years for me to understand as much as I do now, and I'm STILL not an expert!)

Actually securing your site (at least making it as secure as humanly possible requires an understanding of all the threats and potential attack surfaces of your website, as well as an understanding of the strengths and weaknesses of your platform and even programming language.

I'd strongly recommend spending some time at the OWASP site, starting out in the OWASP Top 10. This is an excellent research for learning about the various threats out there, and how to best protect yourself against them. Even if you don't find specific code samples for your language/platform of choice, you'll gain enough knowledge to perform more intelligent Google searches, and better find specific advice applicable to your chosen tool-set.

There are other good resources, but at a minimum, every web developer needs to understand the OWASP Top 10 threats, and how to defend against them. Even if your site doesn't host sensitive data, if someone can perform an SQL Injection, they can inject JavaScript on your site to perform a CSRF attack on other sites.

Learning secure web development principles simply isn't optional, it's a must.

Answer 2

You're probably falling victim to SQL injection, which neither CSRF tokens or a CAPTCHA will prevent. If you're using mysql_query, that's your problem - it's possible to inject values and query language into variables passed by the user. Switch to parameterised queries, using MySQLi or PDO.

Answer 3

Try to find out how is the junk data inserted. First check which tables and which fields in the database are affected. After you make a list with these fields, check your code and see where they are referenced. This may help you detect the vulnerable code, by analyzing the respective functions.

If the problem you have is on inputs that are publicly available (contact forms) for non-authenticated users and the only way to prevent automated attacks is through CAPTCHAs, take into account that the CAPTCHA implementation may be faulty. I've seen numerous websites where the same question is displayed every time (e.g. 2+3=?).

There are many ways in which a CAPTCHA library can fail. What CAPTCHA library are you using?