Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10022 > unrolled thread

Help with Security Have I coded this correctly?

Back to article view | Back to comp.lang.php

Contents

  Help with Security  Have I coded this correctly? chirag sharma <chiragsharma.guru99@gmail.com> - 2013-07-02 23:50 -0700
    Re: Help with Security  Have I coded this correctly? Arno Welzel <usenet@arnowelzel.de> - 2013-07-03 17:05 +0200
    Re: Help with Security  Have I coded this correctly? Twayne <nobody@spamcop.net> - 2013-07-03 12:31 -0400
      Re: Help with Security  Have I coded this correctly? Arno Welzel <usenet@arnowelzel.de> - 2013-07-09 16:20 +0200
    Re: Help with Security  Have I coded this correctly? Timothy <timothy@nospam.tld> - 2013-07-03 17:42 +0000
    Re: Help with Security  Have I coded this correctly? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-07-03 19:52 +0200
    Re: Help with Security  Have I coded this correctly? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-03 11:12 -0700
      Re: Help with Security  Have I coded this correctly? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-07-03 20:35 +0200
        Re: Help with Security  Have I coded this correctly? kishorguru99pvtltd@gmail.com - 2013-07-08 01:49 -0700
          Re: Help with Security  Have I coded this correctly? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-08 08:48 -0400

#10022 — Help with Security Have I coded this correctly?

I have created an online PHP code executor at http://web.guru99.com

Though I have checked all security aspects … do you experts see any major flaw that I need to care of?

[toc] | [next] | [standalone]

#10023

Am 03.07.2013 08:50, schrieb chirag sharma:

> I have created an online PHP code executor at http://web.guru99.com
> 
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?

Since you did not publish any code - how should one check your site for
flaws?

JFTR: When I try to run the script with the "Run" button an animated
progress indicator is displayed - but nothing else happens.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#10024

On 2013-07-03 2:50 AM, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>

Pretty good site, actually, the parts I looked at. Like the plain 
language used.

Same result as Arno on the test. IE 10; too bad he didn't menation his 
browser; it could be browser specific.

[toc] | [prev] | [next] | [standalone]

#10050

Am 03.07.2013 18:31, schrieb Twayne:

> On 2013-07-03 2:50 AM, chirag sharma wrote:
>> I have created an online PHP code executor at http://web.guru99.com
>>
>> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>>
> 
> Pretty good site, actually, the parts I looked at. Like the plain 
> language used.
> 
> Same result as Arno on the test. IE 10; too bad he didn't menation his 
> browser; it could be browser specific.

Firefox 22.0 running in Windows 7 Pro x64.

I just checked it again - and now it seems to work.

But again: Without any code or details about the implementation - how to
check for major flaws?



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#10025

On Tue, 02 Jul 2013 23:50:44 -0700, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com

Wow! That site looks very neat!

> Though I have checked all security aspects … do you experts see any
> major flaw that I need to care of?

I would only whitelist allowable patterns/functions. I it very plausible 
to miss an attack/harmful function in a blacklist.

For example I could partially read your source code by running:
	<?php
	readfile("exec.php");
	?>

I could not test your script reliably, because sometimes 'exec.php' 
throws an Apache 403 Forbidden error.


Be sure to disable include/require and the *_once variant, because they 
might include a remote script.


Timothy

[toc] | [prev] | [next] | [standalone]

#10026

chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
> 
> Though I have checked all security aspects … do you experts see any
> major flaw that I need to care of?

You should take care for the (arbitrary?) code execution
vulnerability[1] of your script.

[1] <http://en.wikipedia.org/wiki/Arbitrary_code_execution>

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#10027

On 7/2/13 11:50 PM, chirag sharma wrote:
> I have created an online PHP code executor at http://web.guru99.com
>
> Though I have checked all security aspects … do you experts see any major flaw that I need to care of?
>
I get a 403 forbidden on the AJAX request in both Chrome and Firefox.

I don't know what you've done to protect against attack. Are you safe 
against the following type of attack? Are you just scrubbing the input, 
or have you actually locked-down and hardened the PHP itself?

<?php
$foo = "scan";
$foo .= "dir";

var_dump($foo('.'));
?>

[toc] | [prev] | [next] | [standalone]

#10028

Daniel Pitts wrote:
> On 7/2/13 11:50 PM, chirag sharma wrote:
>> I have created an online PHP code executor at http://web.guru99.com
>>
>> Though I have checked all security aspects … do you experts see any
>> major flaw that I need to care of?
>>
> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
> 
> I don't know what you've done to protect against attack. Are you safe
> against the following type of attack? Are you just scrubbing the input,
> or have you actually locked-down and hardened the PHP itself?
> 
> <?php
> $foo = "scan";
> $foo .= "dir";
> 
> var_dump($foo('.'));
> ?>

When the AJAX request did work (about an hour ago), I was able to
execute the following successfully:

<?php
print_r(glob("*"));
?>

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#10039

On Thursday, July 4, 2013 12:05:09 AM UTC+5:30, Christoph Michael Becker wrote:
> Daniel Pitts wrote:
> 
> > On 7/2/13 11:50 PM, chirag sharma wrote:
> 
> >> I have created an online PHP code executor at http://web.guru99.com
> 
> >>
> 
> >> Though I have checked all security aspects � do you experts see any
> 
> >> major flaw that I need to care of?
> 
> >>
> 
> > I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
> 
> > 
> 
> > I don't know what you've done to protect against attack. Are you safe
> 
> > against the following type of attack? Are you just scrubbing the input,
> 
> > or have you actually locked-down and hardened the PHP itself?
> 
> > 
> 
> > <?php
> 
> > $foo = "scan";
> 
> > $foo .= "dir";
> 
> > 
> 
> > var_dump($foo('.'));
> 
> > ?>
> 
> 
> 
> When the AJAX request did work (about an hour ago), I was able to
> 
> execute the following successfully:
> 
> 
> 
> <?php
> 
> print_r(glob("*"));
> 
> ?>
> 
> 
> 
> -- 
> 
> Christoph M. Becker
> Thanks for reply
if  disable "glob()" function  it can be solve.

[toc] | [prev] | [next] | [standalone]

#10040

On 7/8/2013 4:49 AM, kishorguru99pvtltd@gmail.com wrote:
> On Thursday, July 4, 2013 12:05:09 AM UTC+5:30, Christoph Michael Becker wrote:
>> Daniel Pitts wrote:
>>
>>> On 7/2/13 11:50 PM, chirag sharma wrote:
>>
>>>> I have created an online PHP code executor at http://web.guru99.com
>>
>>>>
>>
>>>> Though I have checked all security aspects � do you experts see any
>>
>>>> major flaw that I need to care of?
>>
>>>>
>>
>>> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
>>
>>>
>>
>>> I don't know what you've done to protect against attack. Are you safe
>>
>>> against the following type of attack? Are you just scrubbing the input,
>>
>>> or have you actually locked-down and hardened the PHP itself?
>>
>>>
>>
>>> <?php
>>
>>> $foo = "scan";
>>
>>> $foo .= "dir";
>>
>>>
>>
>>> var_dump($foo('.'));
>>
>>> ?>
>>
>>
>>
>> When the AJAX request did work (about an hour ago), I was able to
>>
>> execute the following successfully:
>>
>>
>>
>> <?php
>>
>> print_r(glob("*"));
>>
>> ?>
>>
>>
>>
>> --
>>
>> Christoph M. Becker
>> Thanks for reply
> if  disable "glob()" function  it can be solve.
>

What you don't understand is - that will solve THIS problem.  But how 
many other potential security risks do you have?

There are huge risks when allowing people to place code on your system. 
  Securing your system is much more than just disabling a few functions.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web