Php hacking techniques part 2

Implementing the above functions, you are not limited simply to database connections. You could, for instance, connect to some other data storage application, or store the session data in an encrypted virtual filesystem, or on a network file server.

Further Securing Sessions
There are a few remaining PHP directives for controlling sessions, several of these have security implications. Firstly, the session name (set with session.name) should be changed from the default to avoid collisions, especially on servers with multiple users.

The session.cookie_path directive determines the default cookie path, the path for which cookies will be sent in an HTTP request. If you have a forum at somedomain.com/forum, and somedomain.com/ does not require session management, you can change session.cookie_path as shown below.



php_value session.cookie_path /forum/



This prevents sections of your site which do not require the session cookie from being sent it, and limits exposure of the session IDs to those parts of a site where sessions are actually being used. This is especially important if some sections of your site have pages provided by other users, who could use those pages to steal session IDs from your visitors.

Setting session.use_only_cookies to true disables the passing of session IDs in URLs, at the cost of losing sessions support for users with cookies disabled, or on browsers not supporting cookies. Setting session.cookie_domain to the most restrictive domain name possible (e.g. forum.somesite.com instead of somesite.com) also helps to minimise exposure of session IDs. Of course, if you have a single login for an entire range of subdomains, you will have to set the domain as somedomain.com to ensure that the sessions are correctly managed across all of the subdomains.

Finally, it is possible to set the hash function used when creating session IDs. The default is to use MD5 (hash function 0), but SHA1 may also be used (hash function 1). SHA1 is a 160-bit hash function, whereas MD5 is only a 128-bit hash function, so using SHA1 for session hashes improves security slightly over using MD5. You can set the hash function using This setting was introduced in PHP 5.

php_value session.hash_function 1

Beyond PHP Security
Everything I've covered so far has been directly related to PHP and SQL security. The best situation we can manage here is PHP Safe Mode, which uses self-imposed restrictions to improve security. That this is the best we can achieve is due to the server architecture currently in use. There are, however, a few options for taking security a little further, and imposing the restrictions at a lower level than PHP itself. To conclude this series, I'll mention some of these briefly here.

Chroot
Chroot changes the "root" directory that a process can see. This effectively locks it into a certain directory structure within the overall filesystem. With this approach, you can lock a web server into some directory such as /home/www and it will not be able to access anything outside of that structure.

There are several advantages to doing this. The first is that the web server, PHP, any user scripts, and also any attackers, will be contained within this chroot "jail", unable to access files outside of it. Furthermore, you can remove all but the most essential software from the chroot environment. Removing any shells from the environment prevents a large number of exploits which attempt to invoke a remote shell. The minimal environment inside a chroot makes life very difficult for attackers, no matter whether their method of attack is through a vulnerability in your PHP code, or a vulnerability in the underlying web server.

Apache mod_security and mod_chroot
mod_security and mod_chroot are extension modules specifically for the Apache web server. These two modules provide chroot support for Apache without externally applying a chroot technique. mod_security also provides several other security features. Further information is available at http://www.modsecurity.org/ for mod_security and at http://core.segfault.pl/~hobbit/mod_chroot/ for mod_chroot.

suEXEC and Multiple Server Instances
Using a chroot to lock your web server into a restricted environment helps to prevent some security problems, but one of the big issues is shared hosting. Running multiple websites on the same server requires that the web server process has access to each user's files. If the web server has access, so do the other users (subject to PHP Safe Mode restrictions, of course). There are two ways around this, one which is Apache specific, and one which may be deployed on any server environment.

suEXEC, specific to Apache, switches an Apache process to be owned by the same user as the script it is executing, losing any escalated permissions. This locks that Apache instance into the permissions held by that user, rather than the permissions held by the master web server process itself. This mechanism allows a return to the more traditional permissions system, and each user can be reasonably sure his or her files are protected. The cost of this is that an Apache process may not then be promoted back to regain permissions and switch user again to serve a different user's files. This system works best when there will be many requests for pages owned by the same user. suEXEC is explained in more detail at http://httpd.apache.org/docs/1.3/suexec.html

The alternative is to use multiple instances of the web server, each one running with the permissions of a different user. Each server then only has the permissions it needs to serve a single website, so a reverse proxy must be used as a front to all of these server instances, redirecting requests for a virtually hosted website to the Apache instance responsible for actually serving that site. This solution is the most secure, but also the most resource-hungry. Information about using Apache as a reverse proxy is available at http://httpd.apache.org/docs/1.3/mod/mod_proxy.html

How to check for PHP vulnerabilities
The best way to check whether your web site & applications are vulnerable to PHP security attacks is by using a Web Vulnerability Scanner. A Web Vulnerability Scanner crawls your entire website and automatically checks for vulnerabilities to PHP attacks. It will indicate which scripts are vulnerable so that you can fix the vulnerability easily. Besides PHP security vulnerabilities, a web application scanner will also check for SQL injection, Cross site scripting & other web vulnerabilities.

The Acunetix Web Vulnerability Scanner scans for SQL injection, Cross site scripting (XSS), Google hacking and many more vulnerabilities. For more information & a trial download click here.

Check if your website is vulnerable to attack with Acunetix Web Vulnerability Scanner

Acunetix Web Vulnerability Scanner ensures website security by automatically checking for SQL injection, Cross site scripting and other vulnerabilities. It checks password strength on authentication pages and automatically audits shopping carts, forms, dynamic content and other web applications. As the scan is being completed, the software produces detailed reports that pinpoint where vulnerabilities exist. Take a product tour or download the evaluation version today!

Scanning for XSS vulnerabilities with Acunetix WVS Free Edition!
To check whether your website has cross site scripting vulnerabilities, download the Free Edition from http://www.acunetix.com/cross-site-scripting/scanner.htm. This version will scan any website / web application for XSS vulnerabilities and it will also reveal all the essential information related to it, such as the vulnerability location and remediation techniques. Scanning for XSS is normally a quick exercise (depending on the size of the web-site).

Final Words
This concludes the tour of PHP and SQL security. There is much more information available on the web about each security issue covered in this series, and many other issues also. In particular, several Apache modules exist for improving security through chrooting, reverse proxies, or simply checking requests for attacks such as directory traversal.

The PHP manual over at php.net points out any security concerns relating to most functions, and the comments posted by users below the reference pages often contain useful security hints and code samples

Leia Mais…

Cookies in PHP

The better and simple solution for sending the user input values from one page to another page is using COOKIES. We can send data easily from page to page and can be easily retrieved and used.

Setting Cookies

setcookie():This method is used for creating the Cookies. Important note is that Cookies are sent with the HTTP headers,so setcookie() must be called before any output is generated.

Example:
setcookie('Variable','Value');

This is the default syntax declaration, We have another parameters which has its own importance but they are not mandatory.

The third argument to setcookie() is an expiration time,expressed as an epoch timestamp.For example, this cookie expires at noon GMT on December 3, 2004:

setcookie('flavor','chocolate chip',1102075200);

If the third argument to setcookie() is missing (or empty),the cookie expires when
the browser is closed. Also,many systems can’t handle a cookie expiration time
greater than 2147483647,because that’s the largest epoch timestamp that fits in a
32-bit integer

The fourth argument to setcookie() is a path. The cookie is sent back to the server
only when pages whose path begin with the specified string are requested. For example, the following cookie is sent back only to pages whose path begins with /products/:

setcookie('flavor','chocolate chip','','/products/');

The page that’s setting this cookie doesn’t have to have a URL that begins with /products/, but the following cookie is sent back only to pages that do.

The fifth argument to setcookie() is a domain. The cookie is sent back to the server
only when pages whose hostname ends with the specified domain are requested. For
example,the first cookie in the following code is sent back to all hosts in the example.com domain,but the second cookie is sent only with requests to the host test.example.com:
setcookie('variable','value','','','.example.com');
setcookie('variable','value','','','test.example.com');

If the first cookie’s domain was just example.com instead of .example.com,it would
be sent only to the single host example.com (and not www.example.com or test.
example.com).

The last optional argument to setcookie() is a flag that if set to 1,instructs the
browser only to send the cookie over an SSL connection. This can be useful if the
cookie contains sensitive information,but remember that the data in the cookie is
stored in the clear on the user’s computer.

Reading Cookie Values
A cookie’s value isn’t available in $_COOKIE during the request in which the cookie isset. In other words,the setcookie() function doesn’t alter the value of $_COOKIE. On subsequent requests,however,each cookie is stored in $_COOKIE. If register_globals
is on, cookie values are also assigned to global variables.

When a browser sends a cookie back to the server,it sends only the value. You can’t
access the cookie’s domain,path,expiration time,or secure status through $_COOKIE
because the browser doesn’t send that to the server.
To print the names and values of all cookies sent in a particular request,loop
through the $_COOKIE array:

foreach ($_COOKIE as $cookie_name => $cookie_value) {
print "$cookie_name = $cookie_value
";
}

Deleting Cookies
Call setcookie() with no value for the cookie and an expiration time in the past:

setcookie('flavor','',time()-86400);

It’s a good idea to make the expiration time a few hours or an entire day in the past,in case your server and the user’s computer have unsynchronized clocks. For example,if your server thinks it’s 3:06 P.M. and a user’s computer thinks it’s 3:02 P.M.,a cookie with an expiration time of 3:05 P.M. isn’t deleted by that user’s computer even though the time is in the past for the server.
The call to setcookie() that deletes a cookie has to have the same arguments (except
for value and time) that the call to setcookie() that set the cookie did,so include the path, domain, and secure flag if necessary.

Different browsers handle cookies in slightly different ways,especially with regard to how strictly they match path and domain strings and how they determine priority
between different cookies of the same name.

Leia Mais…

PHP working with Files and Directory

Below are some of the important methods used when working or manipulating the files or folders

parse_ini_file($filename)
parse_ini_file() loads in the ini file specified in filename, and returns the settings in it in an associative array.
Example
// Parse without sections
$ini_array = parse_ini_file("sample.ini");
print_r($ini_array);

// Parse with sections
$ini_array = parse_ini_file("sample.ini", true);
print_r($ini_array);
O/P
Array
(
[one] => 1
[five] => 5
[animal] => Dodo bird
[path] => /usr/local/bin
[URL] => http://www.example.com/~username
[phpversion] => Array
(
[0] => 5.0
[1] => 5.1
[2] => 5.2
[3] => 5.3
)

)
Array
(
[first_section] => Array
(
[one] => 1
[five] => 5
[animal] => Dodo bird
)

[second_section] => Array
(
[path] => /usr/local/bin
[URL] => http://www.example.com/~username
)
)

basename($path)
Given a string containing a path to a file, this function will return the base name of the file.
Example
$path = "/home/httpd/html/index.php";
$file = basename($path); // $file is set to "index.php"

dirname($path)
Given a string containing a path to a file, this function will return the name of the directory.
example
$path = "/etc/passwd";
$file = dirname($path); // $file is set to "/etc"

pathinfo($_SERVER['PHP_SELF'])
pathinfo() returns an associative array containing information about path.
Example
$path_parts = pathinfo('/www/htdocs/inc/lib.inc.php');

echo $path_parts['dirname'], "\n"; //www/htdocs/inc
echo $path_parts['basename'], "\n"; //lib.inc.php
echo $path_parts['extension'], "\n"; //php
echo $path_parts['filename'], "\n"; // lib.inc

realpath($path)
realpath() expands all symbolic links and resolves references to '/./', '/../' and extra '/' characters in the input path and return the canonicalized absolute pathname
Example
echo realpath('/windows/system32'); //C:\WINDOWS\System32

getcwd()
Gets the current working directory.

file_exists
hecks whether a file or directory exists

Leia Mais…

PHP Magic Methods

These are the following magic methods available

__construct, __destruct, __call, __callStatic, __get, __set, __isset, __unset, __sleep, __wakeup, __toString, __invoke, __set_state and __clone are magical in PHP classes.

PHP reserves all function names starting with __ as magical.

__sleep
serialize() checks if your class has a function with the magic name __sleep. If so, that function is executed prior to any serialization. It can clean up the object and is supposed to return an array with the names of all variables of that object that should be serialized. If the method doesn’t return anything then NULL is serialized and E_NOTICE is issued.

__wakeup
Conversely, unserialize() checks for the presence of a function with the magic name __wakeup. If present, this function can reconstruct any resources that the object may have.

Example:
class Connection {
protected $link;
private $server, $username, $password, $db;

public function __construct($server, $username, $password, $db)
{
$this->server = $server;
$this->username = $username;
$this->password = $password;
$this->db = $db;
$this->connect();
}

private function connect()
{
$this->link = mysql_connect($this->server, $this->username, $this->password);
mysql_select_db($this->db, $this->link);
}

public function __sleep()
{
return array('server', 'username', 'password', 'db');
}

public function __wakeup()
{
$this->connect();
}
}

__tostring
The __toString method allows a class to decide how it will react when it is converted to a string.

Example
class Member
{
private $m_szEmail;
private $m_szUsername;

public function __construct($szUsername, $szEmail)
{
$this->m_szUsername = $szUsername;
$this->m_szEmail = $szEmail;
}
}

$pMember = new Member('Karl', 'karl@talkphp.com');

echo $pMember;

O/P is object.

Usually, most people would achieve this with code like:

echo $pMember->getUsername() . " (" . $pMember->getEmail() . ")";

However, what we can do is use the __toString() function to change the default behaviour of the object to string conversion. This would allow us to specify exactly
Add this method in your class

public function __toString()
{
return sprintf('%s (%s)', $this->m_szUsername, $this->m_szEmail);
}

__set() is run when writing data to inaccessible properties.

__get() is utilized for reading data from inaccessible properties.

__isset() is triggered by calling isset() or empty() on inaccessible properties.

__unset() is invoked when unset() is used on inaccessible properties.

__call() is triggered when invoking inaccessible methods in an object context.

__callStatic() is triggered when invoking inaccessible methods in a static context.

__invoke() this method is called when a script tries to call an object as a function.

__set_state() This static method is called for classes exported by var_export() since PHP 5.1.0.

The only parameter of this method is an array containing exported properties in the form array('property' => value, ...).

Leia Mais…

PHP 5 OOPS concepts Key Words

Extends
In PHP a class a class can inherit methods, functions and members of other class by using the extends keyword in the declaration. In PHP it is not possible to inherit from multiple classes, a class can inherit from only one base class.

The class from which inheritance is done is called the parent class or base class and the class which inherits is called the child class.

Final
The final keyword prevents the child classes from overriding a method. This can be done by prefixing the method with the keyword final. If the complete class is being defined as final then that class cannot be extended.

Abstract
A new concept of abstract classes and methods has been introduced in PHP5. When a class is defined as abstract then it is not allowed to create the instance of that class. A class that contains at least one abstract method must also be abstract. The methods defined as abstract cannot define the implementation; they just declare the method’s signature.

When a child class is inheriting from an abstract parent class, then all the methods marked abstract in parent class declaration must also be additionally defined by the child class. These methods must be defined with the same or weaker access. This means that if an abstract method is declared as protected in the parent class then it must be declared either as protected or public in the child class.

Static
When class members or methods are declared as static then there is no need to instantiate that class. These members and methods are accessible without the instantiation of the class. If a member is declared as static then it cannot be accessed by an instantiated class object, but a method declared as static can be accessed by an instantiated class object.

The static declaration of a class must be after the visibility declaration (means that after the member or method has been declared as public, protected, or private).

The static method calls are resolved at compile time and static properties cannot be accessed through the object through the arrow operator (->).

Interfaces
Object interfaces allow the creation of a code which specifies that which method a class must implement, without having to define how these methods have to be handled.

Interfaces are defined in the same way as a class is defined. These interfaces are defined with the keyword “interface”. In the interface the contents of the methods do not have to be defined and all the methods declared in the interface must be declared as public.

Implementation of Interfaces
To implement an interface, the implements operator is used. The methods must be defined before implementation and all the methods in the interface must be implemented within a class.

Leia Mais…