Evil Code and how to defend against it CSCI 4300

1
Evil Code and how to defend against itCSCI 4300

• http//shiflett.org/php-security.pdf
• http//phpsec.org/projects/guide/2.html

2
(No Transcript)
3
Defense against form input attacks data filtering
4
Dispatch method
5
Dispatch script example
6
Spoofed form input
7
Whitelist Input Verification
8
Whitelist Email address verification
9
Simple message board
10
Message Board Attack
11
Message Board defense

• Security tip use pre-existing PHP functions
  they are more efficient and less likely to
  contain security holes.

12
Cross-Site Request forgeries

• Victim has authenticated to target site T
• Evil site E forges a privileged request to T
• Forged request succeeds by virtue of victims
  authentication tokens.

13
Cross-Site Request Forgery example

• Target site, stox.com
• ltinput typetext namestockgt
• ltinput typetext namen_sharesgt
• ltinput typesubmitgt
• Evil site, evil-hackers.org
• ltimg srchttp//stox.com?nameIBMn_shares1000000
  gt

14
CSRF defense form tokens
15
Database Credentials

• Place db.inc outside of document root, so it
  cannot be accessed via a URL!

16
SQL injection attack

• lt?php
• //get uname and passwd
• ...
• mysql_query (select from user where
  unameuname and passwordpasswd)
• Evil input
• Uname my_uname
• Passwd mypassd delete from user where aa