Security Scanners

0tter

Was on this site some months ago and with the help of your members and a following wind I have finally finished my site.

Now I'm at that rotten stage where I'd love to go live but I just think my coding will be full of holes and vulnerable to hacking.

Is there anything out there that's simple to use, cheap and effective in the scanning of a site for any vulnerabilities. I've seen one but it costs an arm and a leg and I really don't have that much money to throw around.

Any suggestions will be gratefully received.

Thanks in anticipation.

0tter 🙂

jazz_snob

I'm not so sure a scanner will pick up everything. I might be able to show you directories that are exposed, or pages where source code is revealed, but if you developed a custom web app then a different approach might be needed (or in conjunction with scanning). Peer review is probably the cheapest and most thorough choice here.

You could also take these broad guidelines and step through your code: http://www.owasp.org/documentation/topten.html

Nessus is a free scanner and you can download a binary directly from nessus.org.

MarkR

These scanners will only find stock vulnerabilities and WILL DO NOTHING to audit your application for its own security holes.

The only acceptable solution is to use a methodology which encourages correctness - for example, using prepared queries, templates etc, and doing proper testing.

Mark

0tter

jazz_snob wrote:
I'm not so sure a scanner will pick up everything. I might be able to show you directories that are exposed, or pages where source code is revealed, but if you developed a custom web app then a different approach might be needed (or in conjunction with scanning). Peer review is probably the cheapest and most thorough choice here.

You could also take these broad guidelines and step through your code: http://www.owasp.org/documentation/topten.html

Nessus is a free scanner and you can download a binary directly from nessus.org.

Apol's for not getting a reply out sooner but I've been at work all day.

Peer review sounds a great idea, but have you any idea if there is anyone out there that would be interested and roughly what would I expect to pay? Also the question of who do I trust.

I'll take a look at the guidelines, but really being a newbie I sometimes get completely lost in the description of the problem, never mind the ultimate solution.

Thanks very much for the suggestions though, I'll have a look and if you know of any peer reviewers I would be grateful for any suggestions.

Many Thanks

0tter

MarkR wrote:
These scanners will only find stock vulnerabilities and WILL DO NOTHING to audit your application for its own security holes.

The only acceptable solution is to use a methodology which encourages correctness - for example, using prepared queries, templates etc, and doing proper testing.

Mark

You see that's it, I'm quite the novice and I've used code from other applications to build my site. So although once a pretty adept PASCAL programmer I'm lost when it is suggested that I use such methodologies to patch up the site.

Proper testing too is a problem, as I wouldn't know where to begin in trying to punch a hole in a PHP site.

Bit at a loss really, the site does look OK though, it was designed for my sister's business and I'm concerned I'm putting her livelihood in my hands.

Scanners, peer testing, d'oh I know I'm looking for the quick and simple answer where there might not be one, but anything to look for the gaping holes would be a start.

Thanks for your suggestion though.

Many Thanks

0tter

bodzan

...by reading PHP Security Guide...

0tter

jazz_snob wrote:
I'm not so sure a scanner will pick up everything. I might be able to show you directories that are exposed, or pages where source code is revealed, but if you developed a custom web app then a different approach might be needed (or in conjunction with scanning). Peer review is probably the cheapest and most thorough choice here.

You could also take these broad guidelines and step through your code: http://www.owasp.org/documentation/topten.html

Nessus is a free scanner and you can download a binary directly from nessus.org.

Took a look at the Nessus scanner and correct me if I'm wrong, but it looks like a web server or network security scanner. Ooops didn't make myself clear on this one, as my site is being hosted on a commercial internet service provider, which has the MySQL database and PHP scripting on-site, so hopefully vulnerabilities in this arena are not a problem, errrmmm fingers crossed, but they are a major player.

Is the PHP scripting scanner a module I didn't come across?

Thanks again.

0tter

Looking at the guidelines the first hurdle I come across is to set register_globals to off in php.ini.

Now this is simple, but as I have my site hosted on 1&1 I can't find it anywhere. I have phpadmin installed and cannot get to it through that and I cannot see any of the directories where it would normally put the file. Am I missing something, is anyone familiar with 1&1 and is there a simple way to get hold of the file.

Right I'm committed now and I'm going to work through all the suggestions you have given me, I recognise that this is the first of many hurdles, but believe me I've not just gone off found the problem and posted it up. I've searched high and low on the internet and have spent about three hours on this alone before I've put this one up. So any help would be apprecated at this stage.

I'll put up an enquiry to 1&1 but I've not ever had much luck with them.

Oh by the way I've done a <?php phpinfo(); ?> (helloworld??) and it tells me that register_globals is switched on. Think I might have done this ages ago, so there must be a way of switching it.

Thanks again for all your help it is very much appreciated.

Bill aka 0tter

jazz_snob

I just went thru this w/ some software i deployed. Had to contact the hosting company and ask very nicely to turn register globals off in a particular directory. It was the only solution. Problem is, that setting doesn't effect subdirectories, just that single directory. Some hosts might let you control settings thru .htaccess file.

As far as nessus goes, for a custom app, it will probably not uncover much because no one has written a plugin that tests your app for known exploits. That is, first someone finds an exploit in your app, then they write a nessus plugin, then the scanner can pick it up----not very useful. But nessus does some sql injection and other attacks that might reveal exploits in your code, so that is what I meant as far as using nessus to scan your site.

Following good practices and code review is best.

0tter

jazz_snob wrote:
I just went thru this w/ some software i deployed. Had to contact the hosting company and ask very nicely to turn register globals off in a particular directory. It was the only solution. Problem is, that setting doesn't effect subdirectories, just that single directory. Some hosts might let you control settings thru .htaccess file.

As far as nessus goes, for a custom app, it will probably not uncover much because no one has written a plugin that tests your app for known exploits. That is, first someone finds an exploit in your app, then they write a nessus plugin, then the scanner can pick it up----not very useful. But nessus does some sql injection and other attacks that might reveal exploits in your code, so that is what I meant as far as using nessus to scan your site.

Following good practices and code review is best.

I'll have a look around for the .htaccess file that does ring a bell, but that could just be my failing memory?

Just been on customer support at 1&1 and it took around 15 minutes to get through (oh suspicious, but I wonder if they charged me at the premium rate for the on hold). Got a really nice lady but unfortunately her accent and mine clashed and I don't really know if she got the gist of what I was talking about. Her suggestion was to place a php.ini file in the root of the site and change the settings to what I needed, now I don't think that sounds right, what do you think?

I expressed that the file and the access rights would then be freely viewable, but she seemed pretty adamant that no-one would be able to see them, very sceptical, hey but I am just a nembie.

Bill

jazz_snob

If it is that simple, try it. Our php.ini is world-readable. Only line is: register_globals = off. I bet I could write a .htaccess so it isnt served, but havent tried.

0tter

jazz_snob wrote:
If it is that simple, try it. Our php.ini is world-readable. Only line is: register_globals = off. I bet I could write a .htaccess so it isnt served, but havent tried.

Right that's a good idea, you think I'll have to put that in every directory?

Just came across this article on errrm another PHP site - ahem.

Overriding the php.ini with no access!

Seems that you can change the values from within the scripts but I would get the feeling that the damage for register_globals would already be done outside the script.

I'll give your idea a go, the run hello world over it and see if it changes it, would be interested to know if you felt it should go into every directory then though.

Marvellous, that looks like the first hurdle out of the way, I reckon that leaves only another hundred or so 🙂

Right I'll not be in touch for a while, I've been working on this all night and it's past midnight, so I'm off to bed.

Thanks again,

Cheers

Bill

0tter

Right now we've managed to find out how to get around the php.ini problem, could anyone recommend what else I should set in there, in order to produce a more secure site?

I've heard that magic quotes and safe mode are pretty important, could anyone tell me what these ideally should be set to (sure that safe mode should be on). Also there seems to be numerous flavours of them e.g.

safe_mode
safe_mode_gid

and

magic_quotes_gpc
magic_quotes_runtime
magic_quotes_sybase

What do you do with these, if anything, to make the site more secure and are there any other settings I should be looking at?

Many thanks for all of your help so far.

Cheers

Bill

jazz_snob

bodzan wrote:
...by reading PHP Security Guide...

Given that we have no code to look at, you'll have to go by guidelines for good PHP programming...the link by bodzan is excellent.

0tter

Sorry about the absence of code, but it is an entire website with tens of thousands of lines, bound to be some holes I would have though. Though a friend did run a security scanner they have over it and found nothing. I'll have a better look at the link by bodzan.

Keep the suggestions coming, thanks again for your help.

Bill

dalecosp

I suppose it could also come down to the $amount="$".number_format($somemoney,2); that security of this site is worth to ya. There are some guys around here (not me 😉 ) who can "crack" well enough to do some testing for ya, given a URI.

Problem with that idea: you can't post professional inquiries on the PHPBuilder forums. 🙁

2nd problem: that could be quite expensive.

On another tack, here's a pretty good book on PHP Security.

0tter

dalecosp wrote:
I suppose it could also come down to the $amount="$".number_format($somemoney,2); that security of this site is worth to ya. There are some guys around here (not me 😉 ) who can "crack" well enough to do some testing for ya, given a URI.

Problem with that idea: you can't post professional inquiries on the PHPBuilder forums. 🙁

2nd problem: that could be quite expensive.

On another tack, here's a pretty good book on PHP Security.

Another problem is who do you trust, having not met anyone they could be a hackert themselves, or is that me just being sceptical.

Bought a book "Essential PHP Security" by Chris Shiflett, looked good but was a bit too technical for me, not enough idiot speak and too few examples, would have been good for a seasoned coder though.

I'll take a look at the one you've recommended though, I like the sound of a chapter dedicated to each problem, more my pace I think.

Thanks again.

Cheers

Bill