PHPUG Presentation

PHPUG Presentation

• 1.
  Securing PHP WebApplications Web Applications Damon P. Cortesi, CISSP Directory @ Alchemy Security Stats Nut | Security Geek | Builder of Tools
• 2.
  $ whoami SecurityConsultant Part-time Web Dev (PHP, Django, Rails) Destroyer of Web Apps and Dual-Cores
• 3.
  <?=presoinfo();?> Typical webapplication vulnerabilities SQL Injection Cross-Site Scripting What to watch out for How to secure your PHP apps
• 4.
  SQL Injection $sql = “SELECT * FROM users WHERE username = ‘“ . $_POST[‘username’] . “‘ AND password = ‘“ . $_POST[‘password’] . “‘“; What if username is: “dpc’ or ‘a’=’a” ? ... username = ‘ dpc’ or ‘a’=’a ‘ ...
• 5.
  http://www.flickr.com/photos/tekalpha/94105897/
• 6.
  SQL Injection Username: dpc SELECT * FROM users WHERE username = ‘dpc‘ AND password = ‘apassword’; Username: dpc’ OR ‘A’=’A SELECT * FROM users WHERE username = ‘dpc ’ OR ‘A’=’A ‘ AND password = ‘apassword’;
• 7.
  Cross-Site Scripting Userinput re-displayed in browser and interpreted as HTML or ... JavaScript My name is Damon”><script>alert(‘hi’)</script> Why is this bad? Phishing Cookie stealing Arbitrary JavaScript execution...
• 8.
  XSS Example Abilityto spoof an entire site by including JavaScript from elsewhere http://realsite.com/projects/search?q=test ”><script src=” http://badsite.com/evilphishingpage.js ”></script>... JavaScript can rewrite any DOM element...
• 9.
  Real-world Dangers Welive in an interactive web
• 10.
  So what? Irun a blog ... XSS me all day long ... I DON’T CARE! Fair enough. Importance of security is directly proportional to level of risk. Blog != Payment Gateway.
• 11.
  Coder for Hire?Are you willing to put your company reputation at stake? What type of apps are you building? Where _might_ your code be used? Themes? Plugins? include(‘wp_story’);
• 12.
  Common Mitigations “Increaseyour security by 80%, by fixing 20% of the problems.” Input Sanitization and Validation Data Encoding and Escaping
• 13.
  Sanitization/Encoding SQL: mysql_real_escape_string()HTML/XSS: htmlentities() “ <b>Damon</b> >> &quot;&lt;b&gt;Damon&lt;/b&gt; Beware encoding
• 14.
  Input Sanitization Failexec(mysql_escape_string($_GET[‘var’])) Problem #1: mysql_escape_string is deprecated. Problem #2: MySQL escape does not make it safe for exec(). ?? preg_match(&quot;/.jpe?g$/i&quot;, $var) exec ( &quot;convert '&quot; . mysql_escape_string ( $path ) . &quot;' /tmp/'&quot; . mysql_escape_string ( basename ( $path )). &quot;'.png&quot; );
• 15.
  Better? Instead ofdynamically constructing SQL queries...use a framework. CodeIgniter, CakePHP, Zend Or build a db.inc.php (but not a db.inc). Use an output library that automatically escapes.
• 16.
  Server-Side Checks Client-sidecode can be modified HTTP Proxies Toolbars Super-hack “save to disk” & modify Validate all user input with server-side code
• 17.
  Bug Hunting DataInputs $_GET, $_POST, $_REQUEST $_SERVER[‘QUERY_STRING’] $_SERVER[‘PHP_SELF’] $_COOKIE Shell commands: exec()
• 18.
  Cross-Site Request ForgeryLet’s Google for “javascript are you sure?” First result (circa 2006) is susceptible to CSRF (and probably SQL Injection). What is this CSRF?
• 19.
  GET CSRF delete.php?id=123An action that modifies data called via HTTP GET (against HTTP specs). <img src=” http://x.com/delete.php?id=123” />
• 20.
  POST CSRF Onlydifference: JavaScript required to automate attack. <form name=”csrf” action=” http://x.com/delete.php ” method=”POST”> <input type=”hidden” name=”id” value=”123”> </form> <script>document.csrf.submit()</script>
• 21.
  CSRF in Action
• 22.
  Fixing CSRF Donot modify data using GET Use tokens on all form POSTs per-session per-form Up to you - convenience vs. security
• 23.
  Other Protections SecureCookie Flag Restricts transmission of cookies set via HTTPS HTTPOnly Cookie Flag Can’t be accessed using <script> Use innerText, not innerHTML
• 24.
  3rd Party PluginsNeed a plugin or specific function? Google. Download. Hackhack. It works! Is that code secure? (See prev. CSRF)
• 25.
  Server Config Notalways some über-technical sploit... /phpMyAdmin unprotected? demo/demo password Email on confirmation page
• 26.
  Location: $references ChrisShiflett: http://shiflett.org / Essential PHP Security PHP Manual: http://www.php.net/manual/en/security.php Disable register_globals Disabled by default in PHP > 4.2.0 http://www.owasp.org/index.php/PHP_Top_5 http://startupsecurity.info
• 27.
  Thanks [email_address] http://xkcd.com/327/