Tag Info

New answers tagged

3

Yes, regarding to above answers, I don't want to share same information, but real event that happened to my organization. We had a web server (Front end of which clients can see their internet account information, ability to recharge, etc). The developer uploaded a BigDump to backup the triple A server data, in that while, an attacker reviewed the ...


3

To add to Adnan's answer, some PHP frameworks, like PyroCMS, solve this problem by using a combination of .htaccess files and having an index file, named something like index.php, in each and every directory. An .htaccess file is like an extension to your server configuration in files like php.config, but can be included directly in the site folders, ...


9

To add to the answers of @adnan and @william-calvin: It "may" be a problem ;) It does reveal names of files that are only accessible by, for example, authenticated users (Think "change_settings.php" for logged-in users). Now this in itself is not a problem. If his website is well written, then he will perform proper authorization checks before loading ...


31

What you're describing is normal directory listing In itself, directory listing is not a security issue. If the security of your system is compromised after figuring out the structure of your files and directories, then you're relying on security through obscurity, which is bad. Examples of this bad practice include: Using secret directory names to ...


6

Yes.. This is definitely an issue. If I know your structure, I will be able to get better understanding of your system which makes me easier to attack your system. It is recommended to turn off your directory listing (See this tutorial if you are on CPanel) The less hackers know, the harder they need to think..


0

Yes, you should obfuscate those IDs, since you're leaking information. If your application is perfectly secure, the only information (ab)users may learn is a guesstimate of the number of users through the use of something called the Doomsday Argument‡. Also, if they learn the IDs of several users, they'll know who signed up first and can guess how ...


0

for as long as i know, aslong as your PHP scripts (i.e. forms) use the filter for htmlspecialchars() and strip things like weird symbols and backslashes, there wouldnt be a security risk, atleast from my perspective. forcing a charset to be used by the clien is an option for us paranoid people though, along with the basic stuff i just named.


3

I've created a few systems that either do or don't use the primary key (or other identifier) in the URL. Which we use is totally dependant on the harm-factor -- for instance, for a site that is data driven read only, we use the primary key in the URL; we don't care if someone goes through the products sequentially. For systems that have security ...


13

One easy way would be to use the method youtube and other websites use. This is hashids (http://hashids.org). With this method you can give links like: http://www.example.org/user/fce7db/edit while fce7db would equal to a number e.g.: 12 This has the advantage of performance in contrary to generating another random hash in the database, because you only ...


0

You don't provide enough information about the application to know whether you should obscure it or not. As such, this part of your question isn't answerable. However, if you have to ask, then the answer is probably yes, and even if it isn't then going above and beyond the call of duty provides more protection than the alternative. Rather than hiding or ...


4

No. One way or another, you need to identify the specific record with a unique identifier in the URL. That can be the primary key or something else. If you need to hide the order or sequence you can use a second column with a random and unique string like Z2wDKo0ubb1D2VngFh4N. If you want more security, use SSL. This doesn't prevent the user from seeing ...


24

The only piece of information that you could hope to "hide" is the sequence: since a database will allocate primary key values with a counter, people who see they key can make a guess as to when the corresponding user account was created. Apart from that, there is no other information that any obscuring scheme may actually hide. The attacker already knows ...


2

In this particular example there's very little you could do, even if you hadn't magic_quotes. That's because a SQL injection normally can only add to the query string. Since the string is an INSERT command, you can only INSERT something. In theory, if the SQL server behind supported "chained commands", you could transform a command in two: INSERT INTO ... ...


1

That SQL injection don’t work on your server may be due to magic quotes, which escape certain characters in incoming data with backslash escape sequences: […] all ' (single-quote), " (double quote), \ (backslash) and NULL characters are escaped with a backslash automatically. This is identical to what addslashes() does. These are exactly the characters ...


1

Further to Kevin Li's answer, testing your session IDs for randomness is covered here: How to test session identifier strength with OWASP WebScarab You need to request loads of session tokens and perform a statistical analysis on them to determine if they appear to exhibit the desired level of randomness. 10^4 session IDs would be a good minimal starting ...


1

You can't actually determine how random a number is, because it's the nature of randomness. However, if you had a series of values, you could perform statistical randomness tests on the values and possibly find patterns/weaknesses in the random number generator. Certain patterns may give away what random generator was used. But even supposing the numbers ...


8

The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc. Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL ...


1

I agree that the plugins and themes can be problematic, but want to add three more suggestions relating to the use of plugins: You should make sure you're running the latest version of WordPress AND plugins. Go through your plugins and delete anything you really don't need. Try and replace plugins with code wherever possible. Be more choosy about ...


2

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates). One of the huge ...


3

I wouldn't say that the root cause of the problem is Wordpress, but rather the fact that: There is so many themes/plugins for Wordpress available from 3rd party developers, and people usually don't audit them before installing them. Since the entry barrier for PHP is very low, a lot of those 3rd party developers have no/poor IT security knowledge I think ...


1

I might be not as good in explaining the concept of an hash collision as good as this external doc so if it becomes not clear you can have a look at it. In principle the POST and GET data is using a key-value structure. When receiving the data in a request and when accessing $_POST then php will need to convert the list given as a string which could look ...


0

Zend Framework offers an Escaper component to escape output and defend from XSS Symfony provides an automatic output escaping feature CakePHP before version 2.4 provided a sanitization class I recommend you the following lectures for further information: Secure Application Development with Zend framework


0

These kind of scans are more or less normal nowadays. I sometimes get dozens of them a day. Just make sure your server is hardened, especially the php installation. If you want to be on the safe side you may want to use a web application firewall like http://www.modsecurity.org/


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


0

Based on existing comments, answers, and some more elaboration from you, I'd say your scenario is something that Microsoft tried to create a solution to with Next-Generation Secure Computing Base (NGSCB) which was also formerly known as Palladium. Without encrypting everything (code, memory, data in the processor, data traveling on the bus, data moving ...


0

I know I am three years late to the party, but I like to point out something I missed in the answers for those finding this in Google. Most "leaks" from hacked websites are the result of SQL Injection, and much less from a root-ed server where the hacker has full access to the raw database files. SQL injection is an attack technique where the hacker can ...


3

What is the best method for securing PHP scripts that contain database passwords? One common approach is to put these sort of details into an own file, which is not directly accessible through the webserver, e.g. something like a config directory outside the webserver's document root. You can always include this file whereever it is needed. If for ...


0

Private exploits exist for many famous software out there, and the fact that a software is open-source, popular or many years old doesn't change a thing. A vanilla Wordpress installation without additional modules is less likely to be exposed, but again, it is very possible that exploits exist for it. Now, the question is more: does your friend have the ...



Top 50 recent answers are included