New answers tagged

5

Your question is very confused. I'll assume that English is not your first language and what you are really asking is "should a DBMS be exposed on the internet?" he does not want the database password in the code That's just the start of your problems. There are things you can do to make the problem less bad than what you are currently proposing, but ...


0

Are you asking how one email service provider can collect and cosolidate mail from other services into one mail box? Well, pretty much the same way you yourself login in most services: no they don't store your password on their end or in cookies. They store session ID or other security token instead. Just like your browser gets such token on login and sends ...


0

Using weak comparison in PHP is almost always a bad idea as it can lead to bugs and vulnerabilities. See here for an interesting example. In your case, it should be mostly ok, although there are some corner-cases, eg "0x000000" == "000", "1e1" == "10", or "0xBEEF" == "48879". Apart from that, there is no way to compromise the server with just the given ...


0

Just a thought - while not really hacking the server, being able to upload a jpg file with embedded self executing js from the exif, which can then cause mayhem on the client machine, would certainly be a security issue from the user's perspective. see: http://blog.trendmicro.com/trendlabs-security-intelligence/jpeg-files-used-for-targeted-attack-malware/


2

I suggest a short-term quarantine of all uploaded files. You can use local systems scanning and AV tools in a temporary jail. This way you could add a routine to scan for malicious files and ignore all the different names of files. This stops the whack-a-mole game. This would add some latency to the application. I know this is not a coding solution but it ...


2

You should never allow redirection to a relative path that can be manipulated on the client side. As you say, it's dangerous as it potentially allows access to files outside of your webroot. A better approach is to "tag" or name the target pages and redirect to them inside your code. For example, when a user triggers a form, let it post redirpage with a ...


1

As Oldskool points out, there are other problems with this strategy. But you might also be vulnerable to header injection. From the changelog of header() PHP manual: 5.1.2: This function now prevents more than one header to be sent at once as a protection against header injection attacks. So on PHP versions before 5.1.2 you could send something ...


2

Disable exec and suexec, enable open_basedir and basically follow every suggestion in this post. You mentioned still there are other ways to... if after reading that post you still have questions or weaknesses, please post them here or in Serverfault


12

Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not possible, store files in a subdirectory and configure your server not to execute any scripts in that directory. Remember to do this for any scripting language that ...


5

Are there any other filetype that I also should block? It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem to be more reliable either. You need to check for file extension in addition to the mimetype check, as it is a lot more reliable, as file names are a lot ...


20

It is not clear from your description why you want block these files exactly. I see the following possibilities: You want to block files that might infect the server itself. Unfortunately this can be about anything: shell, perl, python, awk, ... and of course compiled binaries. But to get these files executed without explicitly calling them with an ...


5

Regardless of the placement of the PHP code [...], the website just shows the image file when I open it after uploading Yes, that is how it should be. The server would be seriously vulnerable if it would interpret .jpg files as .php files depending on the content instead of the extension. So in such a case, what should be done to execute the file ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


2

I don't think that you can do anything with just this code. But that does not mean that this is secure in any way. You give up the control flow of your application to the user, which is not a good idea. For example, if you were to call close on the newly created object, an attacker would gain SSRF: $obj = new $_GET['x']($_GET['y']); $obj->close(); // ...


0

The question seems to fairly generic, there are many third party tools that can be used to measure security of the application, but none of them guarantee security for your application. For example, if you are using WP, you might want to check the latest CVE's w.r.t to WP. What I mean to say is that understanding the point that it somehow becomes important ...


0

simple answer to your question is "yes", its malicious file. This could happen by shell uploading using upload forms bugs or having ftp(or other protocols that give file access) access. but this is very strange! question is if hacker is able to upload files to your website and has access,why does she/he upload this file first? I wonder if they were trying ...


0

Remember that file extensions aren't really worth relying on. Desktop GUIs may use extensions as a hint on how to open or display files based on their extensions (and then again may not because of a user re-defined action on any specific extension) but the OS doesn't take notice of extension when working out what kind of content a file is. Different ...


0

Technically.. No, your provided code for filtering a given extension is working fine and there shouldn't be a way tricking it. You should enable the strict - flag though. Then again... The file formats you provided don't have to be safe. DOCX - Files can embed malicious macros. Your code can be improved though. Your regex catches on too early when having ...


0

However, now I am trying to use "Type in the encryption key when you start up" and to save it in a session cookie (encrypted) but I do not know how to tell the user if his key is correct or not. Is there any reason why you are storing this client-side? The cookie will be sent with every request, and encryption here seems wrong because you will need ...


2

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No Long Anwser: As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content ...


0

The typical answer is: store them in configuration files because code files are often published. A new trend seems to be to store it in environment variables, if you can control those when starting the server. On shared hosting this is not the case, and then configuration files are a fine option. After all, once someone gets to your filesystem, they could ...


0

It is never a good idea to store passwords in source code. Source code has the horrible tendency of becoming public. This can happen by an exposure in your version control system (google aws key github to read some horror stories), you share the source code with someone, a but in your PHP configuration serves your source code, etc... Also, you should be ...


0

Hanky 웃 Panky brings up good points. However, I'd like to add to them: You can mitigate damage by restricting connecting accounts by roles. Let's say you only allow searching on your website. Allowing only SELECT statements for that particular account will prevent anything else from running. This doesn't work if you have an account for each: SELECT, ...


0

No one, except a user who has FTP/SHELL/Admin access to your server can see those username/passwords if you use the code properly (and not pick up username/password from a plain text web accessible file), there is no need to worry about preventing it from being exposed to your web visitors. And there is no point trying to hide it from someone who gets ...


0

After for little research, I can say this extension is not safe because I can simply extract the main key in clear text format by using any type of HEX editor. Hash function is NOT important any more. Linux: Offset: 0x00003158 Using xxd Windows: Unable to compile but believe the develop team using default password 0123456789abcdef0123456789abcdef ...


0

Are PreparedStatements sufficient? PreparedStatements are not sufficient on their own. You should step through your code and ask yourself what is necessary, and what is possible. Step through on both the client and the server side, and see what data gets sent, if it's possible to modify it, and what it does. See what things you can do. I can't see the ...


0

Your code handles the SQL insertion correctly. I have two guesses about the attack: The attacker could have repeated the request several times, and your code doesn't check if it has already downvoted the post. The attacker have sent a lot of downvote requests in a very short period of time, allowing him/her to exploit a time of check / time of use race ...


0

It's a common problem, and using an external login server just shifts the problem elsewhere. One (rather elaborate) solution is to encrypt the password using a public key for each authenticated user and using password protection on the users private key, stored on the machine, where the password supplied by the user may also authenticate access to the ...


5

Generally there are two ways you can upload a shell to a server. Use RFI to execute PHP script that places shell You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways. Use FTP/HTTP/... module of php to download the shell from a ...



Top 50 recent answers are included