Waraxe Forums

KingOfSka · Advanced user

hi all !
i'm learning php, now i would like to know how to discover vulns in a generic php site, without having its sources
i found some easy RFI linke index.php?var=somestring , are there some othere possible vulns ?

Heintz · Valuable expert

you probably want to read
http://phpsec.org - recommendations and put your self in "bad" guy roll Smile

KingOfSka · Advanced user

thanks a lot i'm reading that papers Smile

by the way, some papers about vulns that can be finded in php source ?

waraxe · Site admin

http://www.devshed.com/c/a/PHP/PHP-Security-Mistakes/

Be creative and open-minded, think from attacker's point of view, consider to try all possible attack vectors - GET/POST/COOKIE/USERAGENT/REFERER, search for base64(),urldecode(),eval(),unserialize(),stripslashes(), etc etc etc

And if you have tried all the easy attack possibilities, then next is execution flow/execution logic analyzing - even in very secure php scripts (but with very complicated and sophisthicated code) can be found hidden logical design time flaws, just waiting to exploit. But this is hard work and first analyze all the user-submitted data to all the script parts Wink

-->EDIT<-- OOPS, sorry, my bad. I noticed, that you are talking about generic website (so called "black box") with not known source code...
All my previous text is meant to be about open source code Smile

FistFucker · Regular user

FistFucker's quote: "If you know how to use a programming language, you also know how to misuse it." So become a very good "PHP coder" and you will also become a very good "PHP hacker". I know this listens boring, but it's the true. Just read, read, read, learn, try out and understand, that's all. :-)

But blind attacking, without knowledge of the source code is very difficult. Sure you can find SQL injections, but they are most useless without knowledge of the database structure and then you can misuse them only for a full path disclosure. Local or remote file inclusion could be possible. Try something like: 'index.php?file=downloads' --> 'index.php?file=http://www.waraxe.com', 'index.php?file=/etc/passwd' or 'index.php?file=C:\boot.ini'. And if it shows the content of the URL or file you can execute your own PHP code there or steal files. (Local/Remote File Inclusion)