CMC Posted March 26, 2008 Share Posted March 26, 2008 Hi, Well, I've been working on my site on and off for about 6-7 months now (maybe one 2-3 days of work a month ) and it's been really progessing. In fact, it's almost complete. I've only got a few more scripts to write and integrate plus a couple more features. I decided it's time to have it audited. Myself, I have tried the basic stuff, some XSS, path disclosures etc but I haven't been able to get any results. However, I'm no expert in vulnerability exploitation, so I was hoping some of you crazy folk () would kindly help me out and see if any bugs can be found. (and reported) I'd appreciate if the actual domain and name of the site were kept hidden (Google seems to index posts here pertty fast) and if any huge risks are exposed, they won't be taken advantage of (too badly, i.e: taking over my server ). Right, so down to the nitty gritty. Here's my URL: http://tinyurl.com/yrjmvr Thanks for any help! -CMC Also visual bug notification would be greatly appreciated.(I'm aware of alignment issues between IE and FX) Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/ Share on other sites More sharing options...
john010117 Posted March 27, 2008 Share Posted March 27, 2008 Just found the include directory. Huge security risk. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-501825 Share on other sites More sharing options...
CMC Posted March 27, 2008 Author Share Posted March 27, 2008 thanks I'll fix the CHMOD ASAP. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-501840 Share on other sites More sharing options...
hassank1 Posted May 18, 2008 Share Posted May 18, 2008 what could be the disadvantages if you found the include dir !! and how to fix that ! ? thx Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-544215 Share on other sites More sharing options...
947740 Posted May 20, 2008 Share Posted May 20, 2008 If you do not protect your code (give the filenames wrong extensions), people may be able to see your passwords and things like that. Is that url supposed to redirect me to: http://www.ridemtl.com/index.php ? Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-545990 Share on other sites More sharing options...
hassank1 Posted May 20, 2008 Share Posted May 20, 2008 Ok.. but I am not sure I've totally get your point ! what's the relation between include dir . and ppl know my passwords !! and which password(s) ?? Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546026 Share on other sites More sharing options...
nloding Posted May 20, 2008 Share Posted May 20, 2008 @hassank1: If you don't protect the dir, people can then access the files. If the filename is .inc instead of .php, it may be skipped by the parser and the 'hacker' would be able to see everything contained inside. So now imaging you have a constants.inc with the password to you database ... Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546091 Share on other sites More sharing options...
hassank1 Posted May 20, 2008 Share Posted May 20, 2008 aha Okay .. now I've understood better .. well ! when I want to use .inc .. I used it as follow .. file.inc.php !! abt protecting dir .. u are talk about set permissions like rwxr--r-- for example ! Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546098 Share on other sites More sharing options...
djpic Posted May 21, 2008 Share Posted May 21, 2008 yes, what is the point of using the .inc extension anyways? I have always used .php even with my included files. Does it change anything with how the page loads? Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546452 Share on other sites More sharing options...
947740 Posted May 21, 2008 Share Posted May 21, 2008 Servers do not know how to handle .inc files; they process them like text files, so all of the info is displayed. When you use .php, nothing is displayed, so your information is safe. .inc is the short name for "include", which was just convenient for some person sometime. Unless you configure your server correctly, it is not safe to use .inc files. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546482 Share on other sites More sharing options...
nloding Posted May 21, 2008 Share Posted May 21, 2008 I personally use .inc.php -- i like the 'inc' keyword there to remind me what 'db' or 'user' or whatever file is. user.php could be anything -- maybe it shows online users. user.inc.php immediately tells me it's my included library of user functions/classes. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546495 Share on other sites More sharing options...
947740 Posted May 21, 2008 Share Posted May 21, 2008 I just put all of those files in an includes folder. OOopps! It keeps them separated, and I know which files are which. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-546496 Share on other sites More sharing options...
dare87 Posted May 22, 2008 Share Posted May 22, 2008 along with the chmod I would do a .htaccess That way it doesn't say error 403 but just redirects them to the home page... Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-547497 Share on other sites More sharing options...
juliston Posted June 3, 2008 Share Posted June 3, 2008 @hassank1: If you don't protect the dir, people can then access the files. If the filename is .inc instead of .php, it may be skipped by the parser and the 'hacker' would be able to see everything contained inside. So now imaging you have a constants.inc with the password to you database ... thanks for the information. Link to comment https://forums.phpfreaks.com/topic/98061-beta-site/#findComment-556163 Share on other sites More sharing options...
Recommended Posts