Holes in PHP applications
PHP Code Execution
* require() and include() - Both these functions read a specified file and interpret the contents as PHP code
* eval() - Interprets a given string as PHP code
* preg_replace() - When used with the /e modifier this function interprets the replacement string as PHP code
Command Execution
* exec() - Executes a specified command and returns the last line of the programs output
* passthru() - Executes a specified command and returns all of the output directly to the remote browser
* `` (backticks) - Executes the specified command and returns all the output in an array
* system() - Much the same as passthru() but doesn't handle binary data
* popen() - Executes a specified command and connects its output or input stream to a PHP file descriptor
File Disclosure
* fopen() - Opens a file and associates it with a PHP file descriptor
* readfile() - Reads a file and writes its contents directly to the remote browser
* file() - Reads an entire file into an array
Configuration
* Set register_globals off - This option will stop PHP creating global variables for user input. That is, if a user submits the form variable 'hello' PHP won't set $hello, only HTTP_GET/POST_VARS['hello']. This is the mother of all other options and is best single option for PHP security, it will also kill basically every third party application available and makes programming PHP a whole lot less convenient.
* Set safe_mode on - this introduces a large variety of restrictions including:
o The ability to restrict which commands can be executed (by exec() etc)
o The ability to restrict which functions can be used
o Restricts file access based on ownership of script and target file
o Kills file upload completely
This is a great option for ISP environments (for which it is designed) but it can also greatly improve the security of normal PHP environments given proper configuration. See the Safe Mode manual page for details.
* Set open_basedir This option prevents any file operations on files outside specified directories. This can effectively kill a variety of local include() and remote file attacks. Caution is still required in regards to file upload and session files.
* Set display_errors off, log_errors on This prevents PHP error messages being displayed in the returned web page. This can effectively limit an attackers exploration of the function of the script they are attacking. It can also make debugging very frustrating.
* Set allow_url_fopen off This stops remote files functionality. Very few sites really need this functionality.
Tuesday, February 24, 2009
Monday, February 23, 2009
5 useful url rewriting examples using .htaccess.
If you are looking for the examples of URL rewriting then this post might be useful for you. In this post, I’ve given five useful examples of URL rewriting using .htacess. If you don’t know something about url rewriting then please check my older post about url rewriting using .htaccess.
Now let’s look at the examples
1)Rewriting product.php?id=12 to product-12.html
It is a simple redirection in which .php extension is hidden from the browser’s address bar and dynamic url (containing “?” character) is converted into a static URL.
RewriteEngine on
RewriteRule ^product-([0-9]+)\.html$ product.php?id=$1
2) Rewriting product.php?id=12 to product/ipod-nano/12.html
SEO expert always suggest to display the main keyword in the URL. In the following URL rewriting technique you can display the name of the product in URL.
RewriteEngine on
RewriteRule ^product/([a-zA-Z0-9_-]+)/([0-9]+)\.html$ product.php?id=$2
3) Redirecting non www URL to www URL
If you type yahoo.com in browser it will be redirected to www.yahoo.com. If you want to do same with your website then put the following code to .htaccess file. What is benefit of this kind of redirection?? Please check the post about SEO friendly redirect (301) redirect in php and .htaccess.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^optimaxwebsolutions\.com$
RewriteRule (.*) http://www.optimaxwebsolutions.com/$1 [R=301,L]
4) Rewriting yoursite.com/user.php?username=xyz to yoursite.com/xyz
Have you checked zorpia.com.If you want to do redirection i.e http://yoursite.com/xyz to http://yoursite.com/user.php?username=xyz then you can add the following code to the .htaccess file.
RewriteEngine On
RewriteRule ^([a-zA-Z0-9_-]+)$ user.php?username=$1
RewriteRule ^([a-zA-Z0-9_-]+)/$ user.php?username=$1
5) Redirecting the domain to a new subfolder of inside public_html.
Suppose the you’ve redeveloped your site and all the new development reside inside the “new” folder of inside root folder.Then the new development of the website can be accessed like “test.com/new”. Now moving these files to the root folder can be a hectic process so you can create the following code inside the .htaccess file and place it under the root folder of the website. In result, www.test.com point out to the files inside “new” folder.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^test\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.test\.com$
RewriteCond %{REQUEST_URI} !^/new/
RewriteRule (.*) /new/$1
Now let’s look at the examples
1)Rewriting product.php?id=12 to product-12.html
It is a simple redirection in which .php extension is hidden from the browser’s address bar and dynamic url (containing “?” character) is converted into a static URL.
RewriteEngine on
RewriteRule ^product-([0-9]+)\.html$ product.php?id=$1
2) Rewriting product.php?id=12 to product/ipod-nano/12.html
SEO expert always suggest to display the main keyword in the URL. In the following URL rewriting technique you can display the name of the product in URL.
RewriteEngine on
RewriteRule ^product/([a-zA-Z0-9_-]+)/([0-9]+)\.html$ product.php?id=$2
3) Redirecting non www URL to www URL
If you type yahoo.com in browser it will be redirected to www.yahoo.com. If you want to do same with your website then put the following code to .htaccess file. What is benefit of this kind of redirection?? Please check the post about SEO friendly redirect (301) redirect in php and .htaccess.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^optimaxwebsolutions\.com$
RewriteRule (.*) http://www.optimaxwebsolutions.com/$1 [R=301,L]
4) Rewriting yoursite.com/user.php?username=xyz to yoursite.com/xyz
Have you checked zorpia.com.If you want to do redirection i.e http://yoursite.com/xyz to http://yoursite.com/user.php?username=xyz then you can add the following code to the .htaccess file.
RewriteEngine On
RewriteRule ^([a-zA-Z0-9_-]+)$ user.php?username=$1
RewriteRule ^([a-zA-Z0-9_-]+)/$ user.php?username=$1
5) Redirecting the domain to a new subfolder of inside public_html.
Suppose the you’ve redeveloped your site and all the new development reside inside the “new” folder of inside root folder.Then the new development of the website can be accessed like “test.com/new”. Now moving these files to the root folder can be a hectic process so you can create the following code inside the .htaccess file and place it under the root folder of the website. In result, www.test.com point out to the files inside “new” folder.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^test\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.test\.com$
RewriteCond %{REQUEST_URI} !^/new/
RewriteRule (.*) /new/$1
Tuesday, December 16, 2008
Generation of Photo Library
<html><head>
<script language="javascript">
function image_rep(x)
{
document.getElementById('imageshow').innerHTML="<img src='images/"+x+"'>";
}
</script>
</head><body>
<div style="clip: rect('top', 'right', 'bottom', 'left'); height:300px; width:300px; overflow:scroll; float:left; text-transform:lowercase;">
<?php
//Open images directory with chmod 0777
$dir = opendir("images");
$dir_image_no=0;
//List files in images directory
while (($file = readdir($dir)) !== false)
{
if ($file != "." && $file != "..")
{
echo "<a href='#' onClick='image_rep(\"".$file."\");'>". $file . "</a><br/>";
$dir_image_no++;
}
}
closedir($dir);
?>
</div>
<div align='left' id="imageshow" style="float:inherit"></div>
<div style="clear:both;"></div>
<div id="photo_lib_upload" >
<?
//code for image upload
if(isset($_POST['subFrm'])&&($_POST['subFrm']="1"))
{
$filename=$_FILES["photo"]["name"];
$ext=explode(".",$filename);
$arrlen=sizeof($ext); //length of array contaning file name
if((strtolower($ext[$arrlen-1])!="php")||(strtolower($ext[$arrlen-1])!="js"))
{
if((strtolower($ext[$arrlen-1])=="jpeg")||(strtolower($ext[$arrlen-1])=="jpg")||(strtolower($ext[$arrlen-1])=="png")||(strtolower($ext[$arrlen-1])=="gif"))
{
$finalname=time().str_replace(" ","_",$_FILES["photo"]["name"]); //echo"filename".$finalname;
move_uploaded_file($_FILES["photo"]["tmp_name"],"images/".$finalname);
$frm_inv="Your image has been uploaded successfully. <a href=# onclick='window.open(\"images/".$finalname."\",\"\",\"height=200,width=600,address=no\");return false;'> Click here </a>to View your uploaded image.";
$frm_col="black";
}
else
{
$frm_inv="Invalid file format :".$_FILES["photo"]["name"];
$frm_col="red";
}
}
else
{
$frm_inv="Invalid file format :".$_FILES["photo"]["name"];
$frm_col="red";
}
}
?>
<form action="" method="post" enctype="multipart/form-data" name="upload_frm">
<table>
<tr><td ALIGN="RIGHT">
<font face="Verdana" color="#75B04F"><strong>Image upload:</strong></FONT><br/><font face="Verdana" size="-2">(jpg, gif, png format only)</font>
</td>
<td class="td1" align="right"><input type="file" name="photo" onChange="img_uplo();"><input type="hidden" value="<?php echo $finalname; ?>" id="file"><input type="hidden" value="<?php echo $finalname; ?>" id="file1"><input type="hidden" name="subFrm" id="subFrm" value="1" />
</td>
</tr>
</table>
</form>
</body>
<script language="javascript">
function img_uplo()
{
document.upload_frm.submit();
}
</script>
</div>
<body>
</html>
<script language="javascript">
function image_rep(x)
{
document.getElementById('imageshow').innerHTML="<img src='images/"+x+"'>";
}
</script>
</head><body>
<div style="clip: rect('top', 'right', 'bottom', 'left'); height:300px; width:300px; overflow:scroll; float:left; text-transform:lowercase;">
<?php
//Open images directory with chmod 0777
$dir = opendir("images");
$dir_image_no=0;
//List files in images directory
while (($file = readdir($dir)) !== false)
{
if ($file != "." && $file != "..")
{
echo "<a href='#' onClick='image_rep(\"".$file."\");'>". $file . "</a><br/>";
$dir_image_no++;
}
}
closedir($dir);
?>
</div>
<div align='left' id="imageshow" style="float:inherit"></div>
<div style="clear:both;"></div>
<div id="photo_lib_upload" >
<?
//code for image upload
if(isset($_POST['subFrm'])&&($_POST['subFrm']="1"))
{
$filename=$_FILES["photo"]["name"];
$ext=explode(".",$filename);
$arrlen=sizeof($ext); //length of array contaning file name
if((strtolower($ext[$arrlen-1])!="php")||(strtolower($ext[$arrlen-1])!="js"))
{
if((strtolower($ext[$arrlen-1])=="jpeg")||(strtolower($ext[$arrlen-1])=="jpg")||(strtolower($ext[$arrlen-1])=="png")||(strtolower($ext[$arrlen-1])=="gif"))
{
$finalname=time().str_replace(" ","_",$_FILES["photo"]["name"]); //echo"filename".$finalname;
move_uploaded_file($_FILES["photo"]["tmp_name"],"images/".$finalname);
$frm_inv="Your image has been uploaded successfully. <a href=# onclick='window.open(\"images/".$finalname."\",\"\",\"height=200,width=600,address=no\");return false;'> Click here </a>to View your uploaded image.";
$frm_col="black";
}
else
{
$frm_inv="Invalid file format :".$_FILES["photo"]["name"];
$frm_col="red";
}
}
else
{
$frm_inv="Invalid file format :".$_FILES["photo"]["name"];
$frm_col="red";
}
}
?>
<form action="" method="post" enctype="multipart/form-data" name="upload_frm">
<table>
<tr><td ALIGN="RIGHT">
<font face="Verdana" color="#75B04F"><strong>Image upload:</strong></FONT><br/><font face="Verdana" size="-2">(jpg, gif, png format only)</font>
</td>
<td class="td1" align="right"><input type="file" name="photo" onChange="img_uplo();"><input type="hidden" value="<?php echo $finalname; ?>" id="file"><input type="hidden" value="<?php echo $finalname; ?>" id="file1"><input type="hidden" name="subFrm" id="subFrm" value="1" />
</td>
</tr>
</table>
</form>
</body>
<script language="javascript">
function img_uplo()
{
document.upload_frm.submit();
}
</script>
</div>
<body>
</html>
Subscribe to:
Posts (Atom)