PHP Scriptonite - attacking/securing PHP

[chsh]

Originally posted here by PuReExcTacy
We're not talking about system patching, that's a whole new issue altogether. Register globals is also another thread. Basically, my thread is pointing things that you can do to secure your php installation. I didn't get broken into thank god, but I wanted to share the reason why. Weak input validation was the original vulnerability being discussed, not register globals. Thanks for your comment though.

My point was more that maybe your example could be a real valid dangerous one, not one created ficticiously. If people can learn from it anyway, it's only good.

[PuReExcTacy]

Originally posted here by slarty
show_source only shows the source code if it's called. In practice, no application ever calls show_source. So where's the danger?

I already explained the danger above. I look at functions and classes like services on the OS. If I know I'm not going to ever be using the service, I disable it. That's the basic principle.

If I would come to need the function, then removing it from the list only takes a second and it helps keep the environment safer. A perfect example of this concept is file system functions. Why would I make them available if I were not going to be using it, again this concept is for a production environment, not dev.


PuRe