文件名称：Securing PHP Web Applications.pdf
文件大小：13.08MB
文件格式：PDF
更新时间：2022-09-07 06:28:14
Securing PHP Web Applications
Contents Acknowledgments xiii About the Authors xv Part I Web Development Is a Blood Sport—Don't Wander onto the Field Without a Helmet 1 Chapter 1 Security Is a Server Issue and Other Myths 3 Reality Check 3 Security Is a Server Issue 5 Hackers Gain Control Through Insecure Applications 5 Programmers Can Harden Their Own Applications 6 Security Through Obscurity 7 Native Session Management Provides Plenty of Security 9 “My Application Isn’t Major Enough to Get Hacked” 9 The “Barbarians at the Gate” Syndrome 10 Wrapping It Up 10 Part II Is That Hole Really Big Enough to Drive a Truck Through? 11 Chapter 2 Error Handling 13 The Guestbook Application 13 Program Summary 13 Primary Code Listing 14 From the Library of Lee Bogdanoff CONTENTS vi Users Do the Darnedest Things . . . 15 I Wonder What Will Happen If I Do This? 15 Expecting the Unexpected 18 Building an Error-Handling Mechanism 19 Test for Unexpected Input 20 Decide What to Do with Erroneous Data 23 Make the System Mind-Numbingly Easy to Use 24 Wrapping It Up 26 Chapter 3 System Calls 27 Navigating the Dangerous Waters of exec(),system(), and Backticks 27 Using System Binaries with the SUID Bit and sudo 28 Using System Resources 29 Usingescapeshellcmd() and escapeshellarg() to Secure System Calls 30 escapeshellcmd() 30 escapeshellarg() 30 Create an API to Handle All System Calls 31 Why Not Just Escape the Arguments and Be Done? 31 Validate User Input 32 Patch the Guestbook Application 32 ThemoveFile()Function 32 Changes to the Application 34 Wrapping It Up 34 Part III What's In a Name? More Than You Expect 35 Chapter 4 Buffer Overflows and Variable Sanitation 37 What Is a Buffer, How Does It Overflow, and Why Should You Care? 37 Buffers, Stacks, Heaps, and Memory Allocation 39 Consequences of a Buffer Overflow 42 Memory Allocation and PHP 42 Pay Attention to the Latest Security Alerts 44 Prevent Buffer Overflows by Sanitizing Variables 46 Premise: Data Is Guilty Until Proven Innocent, Especially If It Comes from Outside the Application 46 Where Does Data Come From? 48 How to Sanitize Data to Prevent Buffer Overflows 48 Patch the Application 49 Verify That We’re Running the Latest Stable Versions 49 Check Variable Sanitation 51 Wrapping It Up 52 Chapter 5 Input Validation 53 New Feature: Allow Users to Sign Their Guestbook Comments 53 From the Library of Lee Bogdanoff CONTENTS vii The Problem: Users Who Give You More Than You Asked For 54 Spammers 55 Injection Attacks 55 Assumptions: You Know What Your Data Looks Like 55 Database Constraints 56 Logical Constraints 56 The Solution: Regular Expressions to Validate Input 57 Tainted Data 57 Regexes 101 58 That Greedy, Lazy . . . Regex! 62 Common Input Validation Patterns 65 Wrapping It Up 67 Chapter 6 Filesystem Access: Accessing the Filesystem for Fun and Profit 69 Opening Files 69 Local Filesystem Access 69 Remote Filesystem Access 71 Preventing Remote Filesystem Exploits 72 Creating and Storing Files 73 Allowing File Uploads 73 Storing Files Safely 75 Changing File Properties Safely 76 Changing File Permissions in UNIX, Linux, and Mac OS X 76 Changing Windows File Permissions 77 Changing File Permissions in PHP 87 Patching the Application to Allow User-Uploaded Image Files 88 Modify the API 88 Create the Upload Form 90 Wrapping It Up 90 Part IV “Aw come on man, you can trust me” 93 Chapter 7 Authentication 95 What Is User Authentication? 95 Usernames and Passwords 97 Image Recognition 99 Privileges 100 How to Authenticate Users 101 Directory-Based Authentication 101 User Database 114 Storing Usernames and Passwords 115 Encryption 115 Password Strength 116 Assess Your Vulnerability 117 From the Library of Lee Bogdanoff CONTENTS viii Patching the Application to Authenticate Users 117 Add User Database Table and Double-Check Database Security 118 Create Authentication API 119 Wrapping It Up 120 Chapter 8 Encryption 121 What Is Encryption? 121 Choosing an Encryption Type 123 Algorithm Strength 123 Speed Versus Security 124 Use of the Data 124 Password Security 125 Patching the Application to Encrypt Passwords 125 Modifying the User Table 126 Create the Encryption and Salting Functions 126 Modify the Password Validation System 127 Wrapping It Up 128 Chapter 9 Session Security 129 What Is a Session Variable? 129 Major Types of Session Attacks 129 Session Fixation 130 Session Hijacking 131 Session Poisoning 133 Patching the Application to Secure the Session 133 Wrapping It Up 136 Chapter 10 Cross-Site Scripting 137 What Is XSS? 137 Reflected XSS 137 Stored XSS 138 Patching the Application to Prevent XSS Attacks 138 Wrapping It Up 139 Part V Locking Up for the Night 141 Chapter 11 Securing Apache and MySQL 143 Programming Languages, Web Servers, and Operating Systems Are Inherently Insecure 143 Securing a UNIX, Linux, or Mac OS X Environment 144 Update the Operating System 145 Securing Apache 147 Upgrade or Install the Latest Stable Version of Apache 147 Give Apache Its Own User and Group 149 From the Library of Lee Bogdanoff CONTENTS ix Hide the Version Number and Other Sensitive Information 151 Restrict Apache to Its Own Directory Structure 152 Disable Any Options You Don’t Explicitly Need 153 Install and Enable ModSecurity 154 Securing MySQL 159 Upgrade or Install the Latest Version 159 Disable Remote Access 163 Change Admin Username and Password 163 Delete Default Database Users and Create New Accounts for Each Application 164 Delete the Sample Databases 165 Wrapping It Up 166 Chapter 12 Securing IIS and SQL Server 167 Securing a Windows Server Environment 167 Update the Operating System 168 Securing IIS 177 Reduce the Server’s Footprint 177 Secure the Web Root 179 Securing SQL Server 187 Install or Upgrade to the Latest Version 187 Secure Microsoft SQL Server 200 Wrapping It Up 205 Chapter 13 Securing PHP on the Server 207 Using the Latest Version of PHP 207 Examining the Zend Framework and Zend Optimizer 208 Finding the Latest Stable Version of PHP 212 Using the Suhosin Patch and Extension 213 Using the Security Features Built into PHP and Apache 213 safe_mode 213 SuEXEC 214 Using ModSecurity 215 Hardening php.ini 216 Wrapping It Up 218 Chapter 14 Introduction to Automated Testing 219 Why Are We Talking About Testing in a Security Book? 219 Testing Framework 220 Types of Tests 222 Unit Tests 222 System Tests 223 Choosing Solid Test Data 223 Wrapping It Up 224 From the Library of Lee Bogdanoff CONTENTS x Chapter 15 Introduction to Exploit Testing 225 What Is Exploit Testing? 225 Fuzzing 226 Installing and Configuring PowerFuzzer 227 Using PowerFuzzer 231 Testing Toolkits 233 Obtaining CAL9000 234 Using CAL9000 235 Proprietary Test Suites 246 Benefits and Features of a Proprietary Test Suite 246 Using a Proprietary Test Suite to Scan Your Application 247 Wrapping It Up 254 Part VI “Don’t Get Hacked” Is Not a Viable Security Policy 255 Chapter 16 Plan A: Designing a Secure Application from the Beginning 257 Before You Sit Down at the Keyboard . . . 257 Concept Summary 257 Workflow and Actors Diagram 260 Data Design 260 Infrastructure Functions 267 Identifying Points of Failure 269 Login and Logout 269 File Upload 270 User Input 270 Filesystem Access 271 Wrapping It Up 271 Chapter 17 Plan B: Plugging the Holes in Your Existing Application 273 Set Up Your Environment 273 Using a Three-Stage Deployment 273 Using Version Control 275 Application Hardening Checklist 276 Check Your Server Security 276 Find the Vulnerabilities in Your Code 276 Fix the Most Obvious Problems 277 Have Your Code Peer-Reviewed 278 Wrapping It Up 278 Epilogue Security Is a Lifestyle Choice: Becoming a Better Programmer 279 Avoid Feature Creep 279 Write Self-Documenting Code 280 Use the Right Tools for the Job 282 Have Your Code Peer-Reviewed 283 Wrapping It Up 284 From the Library of Lee Bogdanoff CONTENTS xi Appendix Additional Resources 285 PEAR 285 Books 286 Web Sites 287 Tools 288 Integrated Development Environments (IDE) and Frameworks 288 Exploit Testing Tools 288 Automated Testing Tools 288 Glossary 289 Index 293