Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've tried to secure all information going to the server to make sure there are no SQL injections.

However there are new folders on my server with weird names. One of our online services is such that with certain inputs, directories are made with that name, but only after using mysql_real_escape_string.

These are the kind of folder names now on my server:

<script>alert(42873)<

\'\"

%27

!(()

\r\n SomeCustomInjectedHeader:injected_by_wvs

\0dir\0

&dir

�\'

What kind of injection was the hacker trying to make? Are they the kind of thing to expect from SQL injections? Or javascript injections?

This is the code I'm using to create folders:

$path = "designs_".$design->getDesignerType()."/product".$design->getProductID()."/template".$design->getTemplateID()."/".$design->getID();
if(!is_dir($path))
    { mkdir($path, 0777, TRUE); }

I actually AM using exec, but not to create folders. I'm using it for other things like creating PDFs using a binary source file, like this:

 exec("prince /home/zeejfl6/public_html/printshop/".$filename.".html /home/zeejfl6/public_html/printshop/".$filename.".pdf");

and making images, like this:

$cmdi = "convert -density 300 -resize $io /home/zeejfl6/public_html/printshop/$filename.pdf  -quality 100 -flatten /home/zeejfl6/public_html/printshop/$filename.jpg";
exec ($cmdi);
share|improve this question

2 Answers 2

up vote 3 down vote accepted

Let's take a step by step explanation on what the hackerScript kiddy was trying to do:

  1. <script>alert(42873)<: This is a XSS attack.
  2. \'\": Testing if your website is vulnerable to SQL injection.
  3. %27: This is urlencoded, so decoding it gives ', which is the same intention as in (2).
  4. !((): Same as (2).
  5. \r\n SomeCustomInjectedHeader:injected_by_wvs: not sure what's going on here.
  6. \0dir\0: \0 means NULL.
  7. &dir : Nonsense unless you're using it.
  8. �\': Same as (2).

Remarks:

  • Your code about creating directories, you're creating it dynamically which is easy for you but may cause several security problems. The best would be to store in the DB the dirname provided by the client and a hashed version of it. The hashed version, you'll use it for creating directories. So you'll be using your DB to "translate" the input/output.

  • About mkdir(): You're using 777 while I think you meant 0777, note that there is a huge difference since it's not decimal but octal. Take a look at chmod() and this answer about a possible security flaw.

  • About exec(): This is a huge security hole if $filename is not highly controlled and safe. Which means if a user named his file something like ";rm -rf ../../../../ that would mean you can say goodbye to your OS, ofcourse this is possible only if PHP has enough privilege.

Advice:

As stated by munkeyoto this attack is performed using an automatic hacking tool, I also see that you're lately posting several times about hacking attemps you're undergoing. I highly suggest you to hire a professional to audit and test your website (or even improve it's security). If you can't or don't want to, then please learn more about security and best practice. There are ton of tutorials, books, and courses available. It's a bit tiring for us (and for you) that you're posting every once an easy hacking attempt by some skiddies that can easily be avoided as I mentioned above.

share|improve this answer
1  
Thank you very much for the info! I am trying to learn, I am reading up on security articles and this forum is in fact one of the places that I'm learning a lot. My boss actually did enlist the help of a "professional hacker" but they didn't offer me any advice that I hadn't already learned online, apart from telling me to disable the cgi-guestbook. –  user961627 May 29 '13 at 13:17
    
@user961627 you're welcome, may god help you ... –  HamZa May 29 '13 at 13:22

injected_by_wvs is used by Acunetix Web (w) Vulnerability (v) Scanner (s) (wvs). This is a Cross (x) Site (s) Script (s) - XSS - which is being inserted into a parameter (usually a form: name, date, time, age, etc). SQL based injections will contain a portion of a SQL statement (SELECT * FROM, INSERT INTO *), which are visible most of the times but can be obfuscated. That answers what kind of attack this is.

You may want to look into using escapeshellcmd() versus exec() to prevent someone from trying to insert characters. I disagree with the statement HamZa DzCyberDeV made with regards to exec(). It is not that serious if you take the time to sanitize input.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.