DeanWhitehouse Posted May 12, 2009 Share Posted May 12, 2009 Please can anyone run some security tests on my site, i believe i have covered everything to protect it. On the site the main things i want to be safe against are things like RFI, cross-server attack, sql attacks and in game exploits. Any loop holes can be posted here, on the site, or PM(ed) to me on either site. The site is http://www.americangangsters.org/ Username: test password: tester Here is another thing to test http://www.americangangsters.org/airport.php Go there without logging in, and it redirects to the home page then back there when you log in, should i store the previous page in sessions? Thanks, Blade Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/ Share on other sites More sharing options...
jackpf Posted May 12, 2009 Share Posted May 12, 2009 Problem registering, please try again later. Hmm... Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832428 Share on other sites More sharing options...
DeanWhitehouse Posted May 12, 2009 Author Share Posted May 12, 2009 Hmm this is the third account so far to have problems registering, please don't try registration page just yet Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832431 Share on other sites More sharing options...
jackpf Posted May 12, 2009 Share Posted May 12, 2009 Okie dokie. I ran XSS and SQL injection tests on the two pages I could access and they were both fine. Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832438 Share on other sites More sharing options...
DeanWhitehouse Posted May 12, 2009 Author Share Posted May 12, 2009 Ok should work fine now Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832450 Share on other sites More sharing options...
jackpf Posted May 12, 2009 Share Posted May 12, 2009 Seems ok. I do, however, only possess novice hacking skills Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832498 Share on other sites More sharing options...
darkfreaks Posted May 12, 2009 Share Posted May 12, 2009 Find.php: Failures:12 Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31 Tested value: 1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116 Tested value: 1 AND USER_NAME() = 'dbo' Tested value: 1 AND 1=1 Tested value: 1 OR 1=1 cartheft.php: Failures:16 Tested value: %31%27%20%4F%52%20%27%31%27%3D%27%31 Tested value: 1' OR '1'='1 Tested value: 1 UNION ALL SELECT 1,2,3,4,5,6,name FROM sysObjects WHERE xtype = 'U' -- Tested value: 1 UNI/**/ON SELECT ALL FROM WHERE Tested value: 1 AND ASCII(LOWER(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'), 1, 1))) > 116 Tested value: ' OR username IS NOT NULL OR username = ' Tested value: 1' AND non_existant_table = '1 Tested value: 1'1 Tested value: '; DESC users; -- Tested value: 1 AND USER_NAME() = 'dbo' Tested value: 1' AND 1=(SELECT COUNT(*) FROM tablenames); -- Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832865 Share on other sites More sharing options...
TheFilmGod Posted May 13, 2009 Share Posted May 13, 2009 Darkfreaks - how do you do that? Is it some FF plug-in? Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832941 Share on other sites More sharing options...
gffg4574fghsDSGDGKJYM Posted May 13, 2009 Share Posted May 13, 2009 Not sure what darkfreaks are using but they are some FF plugins for that https://addons.mozilla.org/en-US/firefox/addon/7597 Or just search for hack, security or SQL there a lot of plugin. Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832948 Share on other sites More sharing options...
Maq Posted May 13, 2009 Share Posted May 13, 2009 Darkfreaks - how do you do that? Is it some FF plug-in? Yes, it's called "SQL Inject Me". I use it all the time, even though it catches trivial things that may or may not pose harm, it's a very good tool. Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832950 Share on other sites More sharing options...
darkfreaks Posted May 13, 2009 Share Posted May 13, 2009 yes sorry SQL inject me is the tool before some mod comes in here and bitches i didnt post the name of it Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832957 Share on other sites More sharing options...
Maq Posted May 13, 2009 Share Posted May 13, 2009 yes sorry SQL inject me is the tool before some mod comes in here and bitches i didnt post the name of it I don't think any Moderator would bitch that you wouldn't post it, it's a pretty popular security plug-in anyway Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-832959 Share on other sites More sharing options...
Daniel0 Posted May 13, 2009 Share Posted May 13, 2009 yes sorry SQL inject me is the tool before some mod comes in here and bitches i didnt post the name of it You want a warning for trolling Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833029 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 Thanks, any advice on securing against them ? Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833348 Share on other sites More sharing options...
darkfreaks Posted May 13, 2009 Share Posted May 13, 2009 be sure to use plenty of sanitization like strip_tags(),mysql_real_escape_string(),htmlspecialchars(),filter_var(),trim(),stripslashes() Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833407 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 Ok, even using all of them the find user page still has vulnerabilitys Any ideas? Although they don't even do anything xD Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833506 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 I can't understand whats causing the 403 error though Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833531 Share on other sites More sharing options...
jackpf Posted May 13, 2009 Share Posted May 13, 2009 Your server probably has software installed to help protect you against sql injection. With an attempt, it'll serve a 403 page and probably temp ban the IP or something. Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833542 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 hmm ok, good good One last thing, unless there are more vulnerabilities will my function stop or cause a problem to my data, if used to sanitise queries function QuerySecure($query) { $query = strip_tags($query); $query = htmlspecialchars($query); $query = filter_var($query); $query = trim($query); $query = stripslashes($query); $query = mysql_real_escape_string($query); return $query; } Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833547 Share on other sites More sharing options...
Daniel0 Posted May 13, 2009 Share Posted May 13, 2009 Please read the individual manual pages for the functions to see what they do... Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833554 Share on other sites More sharing options...
darkfreaks Posted May 13, 2009 Share Posted May 13, 2009 Try: <?php function QuerySecure($query) { $query = strip_tags($query); $query = htmlspecialchars($query); //works only in php5 strips unwanted injection $query = filter_var($query,FILTER_SANITIZE_STRING); ///////////////// $query = trim($query); $query = stripslashes($query); $query = mysql_real_escape_string($query); return $query; } ?> also as suggested read up on the functions to see what they do and see if you need them or not Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833569 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 Thanks, so as far as i can tell there are no security issues Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833588 Share on other sites More sharing options...
Daniel0 Posted May 13, 2009 Share Posted May 13, 2009 Sorry, my last post was meant to say that your function sucks, and that reading the relevant manual pages should make it clear why... Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833589 Share on other sites More sharing options...
DeanWhitehouse Posted May 13, 2009 Author Share Posted May 13, 2009 Wow, daniel you might want to work on your idea of helping a bit Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833601 Share on other sites More sharing options...
Daniel0 Posted May 13, 2009 Share Posted May 13, 2009 Okay then, if you're too don't want to check for yourself. strip_tags removes HTML tags from a string. htmlentities converts characters to their respective HTML entities (e.g. © -> ©) filter_var with FILTER_SANITIZE_STRING removes HTML tags plus some extra optional stuff. This has already been done. trim removes whitespace from both ends. That's fine. stripslashes strips slashes. How do you know that's needed? mysql_real_escape_string escapes things for MySQL queries. This is the only thing you needed here. You shouldn't escape things like HTML entities before inserting it into the database, but rather do it before you output it. You should store the raw data in the database. Better yet, just use prepared statements and your strings will automatically be sanitized. darkfreaks just listed a lot of functions for sanitation, most of which were irrelevant to that problem, and you just slammed all of them in one big function. Link to comment https://forums.phpfreaks.com/topic/157827-security-test-american-gangsters/#findComment-833610 Share on other sites More sharing options...
Recommended Posts