FUDforum
Fast Uncompromising Discussions. FUDforum will get your users talking.

Home » Imported messages » comp.lang.php » Help with Security Have I coded this correctly?
Show: Today's Messages :: Unread Messages :: Show Polls :: Message Navigator
| Subscribe to topic | Bookmark topic 
Switch to threaded view of this topic Create a new topic Submit Reply
Help with Security Have I coded this correctly? [message #182069] Wed, 03 July 2013 02:50 Go to next message
chirag sharma is currently offline  chirag sharma
Messages: 2
Registered: September 2013
Karma: 0
Junior Member
add to buddy list
ignore all messages by this user
I have created an online PHP code executor at http://web.guru99.com

Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
Re: Help with Security Have I coded this correctly? [message #182070 is a reply to message #182069] Wed, 03 July 2013 11:05 Go to previous messageGo to next message
Arno Welzel is currently offline  Arno Welzel
Messages: 317
Registered: October 2011
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
Am 03.07.2013 08:50, schrieb chirag sharma:

> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?

Since you did not publish any code - how should one check your site for
flaws?

JFTR: When I try to run the script with the "Run" button an animated
progress indicator is displayed - but nothing else happens.


--
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
Re: Help with Security Have I coded this correctly? [message #182071 is a reply to message #182069] Wed, 03 July 2013 12:31 Go to previous messageGo to next message
bill is currently offline  bill
Messages: 310
Registered: October 2010
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
On 2013-07-03 2:50 AM, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>

Pretty good site, actually, the parts I looked at. Like the plain
language used.

Same result as Arno on the test. IE 10; too bad he didn't menation his
browser; it could be browser specific.
Re: Help with Security Have I coded this correctly? [message #182072 is a reply to message #182069] Wed, 03 July 2013 13:42 Go to previous messageGo to next message
Timothy is currently offline  Timothy
Messages: 3
Registered: June 2013
Karma: 0
Junior Member
add to buddy list
ignore all messages by this user
On Tue, 02 Jul 2013 23:50:44 -0700, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com

Wow! That site looks very neat!

> Though I have checked all security aspects … do you experts see any
> major flaw that I need to care of?

I would only whitelist allowable patterns/functions. I it very plausible
to miss an attack/harmful function in a blacklist.

For example I could partially read your source code by running:
<?php
readfile("exec.php");
?>

I could not test your script reliably, because sometimes 'exec.php'
throws an Apache 403 Forbidden error.


Be sure to disable include/require and the *_once variant, because they
might include a remote script.


Timothy
Re: Help with Security Have I coded this correctly? [message #182073 is a reply to message #182069] Wed, 03 July 2013 13:52 Go to previous messageGo to next message
Christoph Michael Bec is currently offline  Christoph Michael Bec
Messages: 207
Registered: June 2013
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any
> major flaw that I need to care of?

You should take care for the (arbitrary?) code execution
vulnerability[1] of your script.

[1] <http://en.wikipedia.org/wiki/Arbitrary_code_execution>

--
Christoph M. Becker
Re: Help with Security Have I coded this correctly? [message #182074 is a reply to message #182069] Wed, 03 July 2013 14:12 Go to previous messageGo to next message
Daniel Pitts is currently offline  Daniel Pitts
Messages: 68
Registered: May 2012
Karma: 0
Member
add to buddy list
ignore all messages by this user
On 7/2/13 11:50 PM, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>
I get a 403 forbidden on the AJAX request in both Chrome and Firefox.

I don't know what you've done to protect against attack. Are you safe
against the following type of attack? Are you just scrubbing the input,
or have you actually locked-down and hardened the PHP itself?

<?php
$foo = "scan";
$foo .= "dir";

var_dump($foo('.'));
?>
Re: Help with Security Have I coded this correctly? [message #182075 is a reply to message #182074] Wed, 03 July 2013 14:35 Go to previous messageGo to next message
Christoph Michael Bec is currently offline  Christoph Michael Bec
Messages: 207
Registered: June 2013
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
Daniel Pitts wrote:
> On 7/2/13 11:50 PM, chirag sharma wrote:
>> I have created an online PHP code executor at http://web.guru99.com
>>
>> Though I have checked all security aspects … do you experts see any
>> major flaw that I need to care of?
>>
> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
>
> I don't know what you've done to protect against attack. Are you safe
> against the following type of attack? Are you just scrubbing the input,
> or have you actually locked-down and hardened the PHP itself?
>
> <?php
> $foo = "scan";
> $foo .= "dir";
>
> var_dump($foo('.'));
> ?>

When the AJAX request did work (about an hour ago), I was able to
execute the following successfully:

<?php
print_r(glob("*"));
?>

--
Christoph M. Becker
Re: Help with Security Have I coded this correctly? [message #182087 is a reply to message #182075] Mon, 08 July 2013 04:49 Go to previous messageGo to next message
kishorguru99pvtltd is currently offline  kishorguru99pvtltd
Messages: 1
Registered: July 2013
Karma: 0
Junior Member
add to buddy list
ignore all messages by this user
On Thursday, July 4, 2013 12:05:09 AM UTC+5:30, Christoph Michael Becker wrote:
> Daniel Pitts wrote:
>
>> On 7/2/13 11:50 PM, chirag sharma wrote:
>
>>> I have created an online PHP code executor at http://web.guru99.com
>
>>>
>
>>> Though I have checked all security aspects � do you experts see any
>
>>> major flaw that I need to care of?
>
>>>
>
>> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
>
>>
>
>> I don't know what you've done to protect against attack. Are you safe
>
>> against the following type of attack? Are you just scrubbing the input,
>
>> or have you actually locked-down and hardened the PHP itself?
>
>>
>
>> <?php
>
>> $foo = "scan";
>
>> $foo .= "dir";
>
>>
>
>> var_dump($foo('.'));
>
>> ?>
>
>
>
> When the AJAX request did work (about an hour ago), I was able to
>
> execute the following successfully:
>
>
>
> <?php
>
> print_r(glob("*"));
>
> ?>
>
>
>
> --
>
> Christoph M. Becker
> Thanks for reply
if disable "glob()" function it can be solve.
Re: Help with Security Have I coded this correctly? [message #182088 is a reply to message #182087] Mon, 08 July 2013 08:48 Go to previous messageGo to next message
Jerry Stuckle is currently offline  Jerry Stuckle
Messages: 2598
Registered: September 2010
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
On 7/8/2013 4:49 AM, kishorguru99pvtltd(at)gmail(dot)com wrote:
> On Thursday, July 4, 2013 12:05:09 AM UTC+5:30, Christoph Michael Becker wrote:
>> Daniel Pitts wrote:
>>
>>> On 7/2/13 11:50 PM, chirag sharma wrote:
>>
>>>> I have created an online PHP code executor at http://web.guru99.com
>>
>>>>
>>
>>>> Though I have checked all security aspects � do you experts see any
>>
>>>> major flaw that I need to care of?
>>
>>>>
>>
>>> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
>>
>>>
>>
>>> I don't know what you've done to protect against attack. Are you safe
>>
>>> against the following type of attack? Are you just scrubbing the input,
>>
>>> or have you actually locked-down and hardened the PHP itself?
>>
>>>
>>
>>> <?php
>>
>>> $foo = "scan";
>>
>>> $foo .= "dir";
>>
>>>
>>
>>> var_dump($foo('.'));
>>
>>> ?>
>>
>>
>>
>> When the AJAX request did work (about an hour ago), I was able to
>>
>> execute the following successfully:
>>
>>
>>
>> <?php
>>
>> print_r(glob("*"));
>>
>> ?>
>>
>>
>>
>> --
>>
>> Christoph M. Becker
>> Thanks for reply
> if disable "glob()" function it can be solve.
>

What you don't understand is - that will solve THIS problem. But how
many other potential security risks do you have?

There are huge risks when allowing people to place code on your system.
Securing your system is much more than just disabling a few functions.


--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex(at)attglobal(dot)net
==================
Re: Help with Security Have I coded this correctly? [message #182098 is a reply to message #182071] Tue, 09 July 2013 10:20 Go to previous message
Arno Welzel is currently offline  Arno Welzel
Messages: 317
Registered: October 2011
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
Am 03.07.2013 18:31, schrieb Twayne:

> On 2013-07-03 2:50 AM, chirag sharma wrote:
>> I have created an online PHP code executor at http://web.guru99.com
>>
>> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>>
>
> Pretty good site, actually, the parts I looked at. Like the plain
> language used.
>
> Same result as Arno on the test. IE 10; too bad he didn't menation his
> browser; it could be browser specific.

Firefox 22.0 running in Windows 7 Pro x64.

I just checked it again - and now it seems to work.

But again: Without any code or details about the implementation - how to
check for major flaws?



--
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
Quick Reply
Formatting Tools:   
  Switch to threaded view of this topic Create a new topic
Previous Topic: Consumir Web Service usando SoapClient y Certificados jsk
Next Topic: How can i get value of text area?
Goto Forum:
  

-=] Back to Top [=-
[ Syndicate this forum (XML) ] [ RSS ]

Current Time: Sun Oct 22 19:05:21 EDT 2017

Total time taken to generate the page: 0.02207 seconds