The document discusses various methods for securing a web application from common vulnerabilities like SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). It recommends input filtering user-provided data, output encoding data returned to users, using prepared statements for database queries, adding anti-CSRF tokens to forms, and regularly updating systems and security patches. The document also stresses secure coding practices like auditing code for security issues and protecting source code and configuration files.
1. What is Security?
Jason Ragsdale
Sr. Technical Yahoo
Yahoo!
Help us
Thank our
Sponsors:
Friday, November 12, 2010
2. A good place to start...
php.ini
display_errors = Off
register_globals = Off
open_basedir = ....
What about safe_mode??
Friday, November 12, 2010
3. Don’t be stupid
Never require/include any file based on user
input without checking it first.
<?php
if (isset($_GET[‘page’])
{
require $_GET[‘page’];
}
?>
URL: script.php?page=/etc/passwd
....
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
Friday, November 12, 2010
4. Don’t be stupid... 2
If your solution uses eval().... you are doing it
wrong
<?php
if (isset($_GET[‘input’])
{
eval($_GET[‘input’]);
}
?>
URL: script.php?input=passthru(“cat /etc/passwd”);
....
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
Friday, November 12, 2010
5. Input Filtering
What is input?
Anything the user or interacting system
sends to your site i.e. ($_POST, $_GET,
$_REQUEST, $_COOKIE...)
What is a whitelist?
“A list of approved or favored items”
What is a blacklist?
“A list persons who are disapproved of or
are to be punished or boycotted”
Friday, November 12, 2010
10. Output Encoding
What is output?
Anything sent back to the user / sender
of the request (RSS Feed, Form Validate,
User created data...)
htmlentities Example
<?php
$str = “A ‘quote’ is <b>bold</b>”;
//Outputs: A ‘quote’ is <b>bold</b>
echo htmlentities($str);
//Outputs: A 'quote' is <b>bold</b>
echo htmlentities($str, ENT_QUOTES);
Friday, November 12, 2010
11. Tim Stiles
At this point mention XmlWriter and all
it’s wonders.... ;)
Friday, November 12, 2010
12. Database Inputs
(or: How I Learned to Stop Worrying and Love the Users)
Friday, November 12, 2010
13. How do i deal with it?
A input filter (whitelist) combined with
prepared statements... DONE
$clean = array();
if (ctype_alnum($_POST[‘username’]))
{
$clean[‘username’] = $_POST[‘username’];
}
$sql = “SELECT `username` FROM `users` WHERE `username`
= :username”;
$sth = $dbh->prepare($sql);
$sth->execute(array(‘:username’=> $clean[‘username’]));
$username = $sth->fetchColumn();
Friday, November 12, 2010
14. XSS
(Cross Site Scripting)
Example
<?php
echo “<p> Welcome back, {$_GET[‘username’]}.</p>”;
?>
------
Let’s exploit this
------
<p> Welcome back, <script> ....do something bad here... </script>.
</p>
Friday, November 12, 2010
15. XSS
(Cross Site Scripting)
If you do the two items we spoke about
Input Filtering
Output Encoding
You most likely are still vulnerable, but it’ll be a
lot harder to exploit
Almost impossible to completely nullify all
security / XSS stuff (new browsers and plugins all
the time + bad guys keep getting smarter)
Friday, November 12, 2010
16. CSRF
(Cross Site Request Forgeries)
Somewhere on MyFavoriteForum.com:
<img src=”bank.com/transfermoney.php?
to=me&amount=100.00”>
...if users are logged in, invisible actions can
be taken on their behalf, with their
authority.
Friday, November 12, 2010
17. CSRF
(Cross Site Request Forgeries)
Solutions
Sign your forms with a token (MD5 hash
with a secret key)
Validate the token before processing the
data
This can be done with Cookie and Session
data as well
Friday, November 12, 2010
18. Protecting Source Code
Make sure all code file extensions are
blocked from viewing
You can remove them from the html root
Or block them in the apache config
<FilesMatch “.inc$”>
order deny, allow
deny from all
</FilesMatch>
Friday, November 12, 2010
19. Protecting Source Code
Watch for editor backup files too!
.file.php.tmp
file.php~
etc...
Or don’t edit code on production boxes.
Friday, November 12, 2010
20. Code Auditing
Set a standard for your team (and yes a
team can be a single person)
Input Filtering Methods
Output Encoding Methods
Database Access Methods
Search code security points (echo, print...)
Enforce these methods
Friday, November 12, 2010
21. Code Auditing
Default to Secure.
Make being unsecure obvious and auditable
YAHOO_GET_RAW( “blah” )
Friday, November 12, 2010
22. System Security
Your website is only as secure as the
server/network is it hosted on
Perform regular package updates
Make sure you apply any updated PHP or
Apache code as soon as you can, there are
reasons for security releases
Friday, November 12, 2010
23. Firewalls & Access
Control
Only allow access to ports that you need to
80 - Web
443 - SSL
22 - SSH
Friday, November 12, 2010
24. Misc...
Signed Data (MD5)
Encrypted passwords in the DB
Config Files outside DOCROOT
Secret keys outside code, in config files
If it’s customer data USE SSL
Friday, November 12, 2010