0

If I use software like WAMP to test and develop my PHP websites, can someone access my computer and steal data or view my in-development websites, or even hack my computer?

  • 1
    The important question is if the local server is also accessible from the internet or if those inside your local network are considered threats. – schroeder Jan 21 at 9:23
  • By local development do you mean localhost-bound server running on your computer that sits behind ADSL in your home network. Or are you in LAN with 100 other machines connected and WAMP server listening for your IP address? In general, you can hardly ever be sure to be 100% safe, but you can minimize the risks to acceptable levels. WAMP is using apache2 if I recall correctly. Should be ok with proper configuration, but personally I run those in separate (virtual) instances, just to make extra level of protection. – Vladimir M Jan 21 at 13:40
  • @VladimirM So does that mean that using WAMP with the default configuration is dangerous? – zinnks Jan 21 at 13:52
  • @zinks , 1) you did not answer to schroeder's comment. this is an important question, because if there are no threats, you can accept more risks. 2) i don't know the version, running modules, or the configuration, so no answer there. If the default means "I don't know the actual config" then it is a danger. – Vladimir M Jan 21 at 15:58
  • You can run LAMP in a virtual machine. VirtualBox has something called "Host-only networking". It basically blocks direct access from the internet or intranet, while allowing two way communication between the host and the guest or between two guests. You can use the web browser on your Windows machine, type the VM's IP into the URL box (as if it were a second machine on the local network) but someone on a different computer won't be able to access the same VM using their browser. The VM can be headless. Bonus: You can change dev PCs without reconfiguring + you can undo mistakes using snapshots – Future Security Jan 21 at 22:47
1

Yes, it is possible as long as you are connected to the internet, check your network configuration that could possibly expose the machine you're using which has WAMP installed.

Let's say for example your router is configured to port forward all ports to the IP of your machine and you also have a vulnerable version of WordPress installed inside your WAMP, the attacker can use that to run code on your machine and install anything on it.

0

If you are running MS Windows then you are already probably exposing a lot of your computer to your local network. To what extent that is then exposed to a potential hacker depends on how your network is configured.

Mysql/PHP is a really easy environment to configure, develop for and deploy code to - this is one of the reasons it is so popular, unfortunately learning how to do this securely is a lot more involved.

Setting up a (another) server on your computer running immature code will leave it a lot more exposed. As long as you restrict it to just the loopback interface should address most (>99%) of the threats.

  • But since there is a firewall, I am safe right? Or it doesn't really matter? And what I also don't understand is the fact that since it is a localserver why there are risks? – zinnks Jan 20 at 22:40
  • And isn't Wamp configured to only allow local connections? Or do I need to do this? – zinnks Jan 20 at 22:56
  • 1
    If you don't know how it is configured OR you don't know how to configure it, then it is not secure. (if by "like WAMP" you really mean "only listens on loopback" you should have said so) – symcbean Jan 21 at 12:40
0

I found a series of vulnerabilities in MAMP that makes it possible to trigger remote code execution through CSRF. When you visit the attacker's site, that site performs a request to localhost:8888 where your local Apache runs a vulnerable web application, triggering the remote code execution. So I would say it is a real possibility that you get hacked through your development setup.

-1

So if I use a software like Wamp to test and develop my PHP websites, can someone access my computer and steal data or view my in-development websites, or even hack my computer?

Your local WAMP PHP development environment is not going to let attacker gain remote shell, unless there is backdoor in the WAMP install. Install WAMP from reliable source and verify your download.

You should be worried about how you connect to the internet, that can lead to gain access. For example, sites your browse. If you are not using MS, take a look at Qubes OS, which creates isolated working environments.

  • "unless there is some backdoor" -- isn't a natural vulnerability or a poorly coded front end or poor passwords or unpatched services enough to be exploited? Why does there have to be a backdoor? Are you saying that a development machine that is not used to browse but just hosts in-development sites cannot be exploited? – schroeder Jan 21 at 9:13
  • WAMP implies Windows, but even if you use Qubes, a poorly coded website will expose sites, and data. – schroeder Jan 21 at 9:17
  • A local WAMP site is available only locally. – BountySite Jan 21 at 9:19
  • 1
    Please explain that. WAMP can be used to host production sites to the Internet. – schroeder Jan 21 at 9:19
  • 1
    Yes, you assume the web server is not accessible by the network, and that assumption needs to be mentioned. As it stands, your answer is factually false without this condition. – schroeder Jan 21 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.