strai Posted August 6, 2008 Share Posted August 6, 2008 Does anyone have a clue if it is possible for an 'outsider' to figure out whether register_globals is set to on in a particular web application? The 'outsider' does not have access to the php code and does not have access to the phpinfo() output. Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/ Share on other sites More sharing options...
discomatt Posted August 6, 2008 Share Posted August 6, 2008 The server should never directly tell a visitor that register_globals is on, but it's not extremely hard to find out in most situations. If it is on, I'd just turn it off rather than worry about this Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-609652 Share on other sites More sharing options...
strai Posted August 6, 2008 Author Share Posted August 6, 2008 I am testing a lot of vulnerability scanners and I have created a web application where I deliberately left 6 prevalent vulnerabilities like XSS, SQL-injection etc. One of those vulnerabilities is the fact that register_globals is on. In my admin.php page, the server checks whether $admin == true. If so, the visitor has access to the admin.php page. However, when register_globals is on, one can easily set the $admin variable to true. My question is: Is it por a vulnerability scanner possible to detect whether register_globals is on? Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-609679 Share on other sites More sharing options...
PFMaBiSmAd Posted August 6, 2008 Share Posted August 6, 2008 Because register_globals affect data values in variables, the short answer is no, a general purpose vulnerability scanner cannot tell if register_globals are on. It would take specific knowledge about how the data is being used in the code in order to be able to write a vulnerability scanner that could trigger an indication if register_globals were on. Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-609740 Share on other sites More sharing options...
nadeemshafi9 Posted August 7, 2008 Share Posted August 7, 2008 try ini_get('register_globals '); Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-610772 Share on other sites More sharing options...
nadeemshafi9 Posted August 7, 2008 Share Posted August 7, 2008 try ini_get('register_globals '); just tested it it returns empty string if its off and 1 if its on Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-610782 Share on other sites More sharing options...
nadeemshafi9 Posted August 7, 2008 Share Posted August 7, 2008 i dont know hwo to do it from outside the server, must be some sort of port communication or somthing youl probably need to be logged in im not sure Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-610788 Share on other sites More sharing options...
nadeemshafi9 Posted August 7, 2008 Share Posted August 7, 2008 if you can create file with php_info() phpinfo.php then you can read the output Link to comment https://forums.phpfreaks.com/topic/118407-find-out-if-register_globals-is-on/#findComment-610794 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.