1

I'm working on a website which was built few years ago in PHP and its riddled with vulnerabilities all over the place. Someone has already gained access to the admin panel and we want to secure the websites, and prevent future break-ins.

Simplest, but tedious solution is to go through each file manually and replace all mysql queries with prepared queries and sanitize all inputs. However, I want to know if there's a simpler solution which could act as a layer between user input (GET, POST, COOKIE, SERVER) and the website logic, and filter out all suspicious looking input data.

I did some research and came across PHPIDS, but I couldn't figure out if it had ability to sanitize the inputs too. Is PHPIDS ideal for this task? Is there something better that suits this purpose?

Improve this question

5 Answers 5

Reset to default
2

There are web application firewalls out there that do the type of thing you are talking about.

IMHO, who ever owns this website needs to bite the bullet and make an effort to actually secure the website instead of taking another half assed approach.

If dropping big bucks on hiring a security consultant to perform a security audit on the site is not a realistic option, it is possible for a committed web developer to perform a security audit on a site and fix any vulnerabilities found. Obviously a professional would be a better option, but if that isn't realistic, many developers can do a descent job given the proper guidance.

If this is a route you are willing to go, I would suggest getting a copy of The Web Application Hacker's Handbook (there are many other good books, but I personally liked this one). In addition to going into detail on how the various attacks work and how to protect against them, it also provides a systematic approach to finding all security vulnerabilities on a web site in the chapter titled, "A Web Application Hacker's Methodology".

Reading this book and performing a security audit will increase your security awareness/knowledge significantly. A must for any serious web developer.

Improve this answer
1

This is not a good position to be in - and recovering fom here will take a lot of effort. But you're starting in the wrong place.

The first thing you need to do is:

1) ensure that only designated directories are writeable (disable the php engine for these, eve if outside the document root)

2) block access to the admin panel except for a whitelist of IP addersses / ranges

This is mitigation only.

sanitize all inputs

No:

Validate inputs, sanitize outputs

This is why there is no magic layer which protect you from badly written software. However you can cut down on the noise by scanning the inputs from scripting and SQL (via an auto-prepend file) then feed the results into fail2ban. But this is still just mitigation.

Improve this answer
4
  • Agreed that sanitizing inputs is the wrong idea. But output should be encoded (escaped and even neutered are other terms that describe the intent reasonably well in my opinion). To sanitize outputs suggests a process restricted to selective excision.
    – weir
    Apr 8, 2014 at 21:22
  • Yes, I may have traded clarity for impact there. By sanitize I mean transform the data into a suitable representation for the medium it is being sent to (html, url, database, email....).
    – symcbean
    Apr 8, 2014 at 21:43
  • If you are going for impact, in the future do consider neutered. ;)
    – weir
    Apr 18, 2014 at 13:55
  • Too often I have come across silly roadblocks caused by misperceptions like "to make user-entered text safe for storage in an RDBMS, characters such as ' and - must be stripped and/or disallowed via validation rules." And a greater concern is the danger should a developer believe such a measure would be sufficient to render untrusted data safe for any execution context. Case in point: @Deepak Mittal suggests he will use prepared queries (for SQL context) but doesn't mention encoding for HTML etc. He won't solve XSS vulns by "filtering...suspicious looking input".
    – weir
    Apr 18, 2014 at 14:18
0

PHPIDS doesn't sanitize user's input. It only prevents different attacks. It can be good temporary solution, but it is not ideal. There are ways to bypass PHPIDS, so vulnerabilities must be fixed.

Improve this answer
0

What you are looking for is a web application firewall: https://www.owasp.org/index.php/Web_Application_Firewall

However like the other posters have answered, I too highly recommend you take the time to fix your code even if you implement a firewall such as this one.

Improve this answer
0

You can use a tool called OSE Security Suite, there is a silent mode, turn it on, and it will sanitize all inputs. In your case, as far as I understand, you do not need to use the Block mode or 403 error mode as all you want is to sanitize all inputs. This is the product page, http://www.opensource-excellence.com/shop/item/389-ose-security-suite.html, I would suggest you contact the support before purchasing the product to be 100% sure they can sanitize the input. Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .