PHP and Application Security - OWASP Road Show 2013

Follow this topic:

@rjsmelo

PHP and Application Security

#owasp #php #appsec

RICARDO MELO

@rjsmelo 2

RICARDO MELO

● CTO @ DRI● PHP, Mysql, Linux and lots of other

OSS● ZCE, RHCE, LPI 3, ITIL, etc

1999 - 2013 DRI. Alguns direitos reservados. 3

Outline

● PHP Context● Pain points● Resources


OWASP - Builders, Breakers and Defenders

● Builders - https://www.owasp.org/index.php/Builders ● Breakers - https://www.owasp.org/index.php/Breakers ● Defenders - https://www.owasp.org/index.php/Defenders


What's PHP?

● PHP its a programming language● As born as “Personal Home Page”, but

nowerdays is one of the most popular programming language on/for the internet.

● Gone away from it's roots and switch its name to - PHP: Hypertext Preprocessor


PHP Anatomy

● The language “Core” (the if's e else's)● The “official” libraries of functions

(extensions)● Al the rest

– PEAR

– PECL

– Composer

– OSS libraries


What Makes PHP Popular

● Low entry barrier● Imediate results● The “instantaneous reward” factor for the

programmer● Solves the problems It proposes to in

quick and effective way.


In fact it was been defined as ...

● Rasmus Lerdorf (the creator of PHP):“PHP has never been just a scripting engine with some cool add-ons. PHP has always been the solution to the Web problem with even more bonus add-ons. And as I have said so many times, PHP is not about purity in CS principles or architecture, it is about solving the ugly web problem with an admittedly ugly, but extremely functional and convenient solution. If you are looking for purity you are in the wrong boat. Get out now before you get hit by a wet cat!”


Ease of use?

● register_globals● magic_quotes● safe_mode● open_basedir


Myths and Legends of PHP

● PHP is insecure● But <insert your language here> its

secure● Frameworks will solve all our security

problems


Myths and Legends of PHP (2)

● PHP is just for building some small sites.● If you really want to build an enterprise

website/portal/webapp/etc then you must use <enter your language here>


Information Security

“Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction”

(http://en.wikipedia.org/wiki/Information_security)


“Standard Approach”

“[...] we need to improve the security of our software [...]”

● List of security Flaws– OWASP top 10

– SANS top 25

– Valid for all programming language and genéric enough

● And a Book: “secure <your programming language>”

● Code review & pen test & ...


Example: OWASP Top 10

● A1-Injection● A2-Broken Authentication and Session

Management● A3-Cross Site Scripting (XSS)● A4-Insecure Direct Object References● A5-Security Misconfiguration● A6-Sensitive Data Exposure● A7-Missing Function Level Access Control● A8-Cross-Site Request Forgery (CSRF)● A9-Using Components with Known

Vulnerabilities● A10-Unvalidated Redirects and Forwards


PHP and (in)Security

● “With great power comes great responsibility”

● The simplicity and flexibility of the language often puts the programmers in troubles

● The “shared hosting” has bring the “all in the webroot” kind of applications to the PHP world.– Remember: except by server configuration all files are available

directly from the internet.


register_globals

● The Classic...● All parameters passed to the script

(GET, POST, COOKIE, SERVER) ends as globals.

// call: http://server/script.php?authorized=1

if ( some_function_to_chek($username,$password) {$authorized = 1;

}if ( ! $authorized ) {

exit;}// rest of the code


$_REQUEST

● $_REQUEST was a quick fix for register_globals

● Uses the same processing order as register_globals

● Instead of registering globals, registers “keys” on the array $_REQUEST

● Mixing GET e POST can foster XSRF and others.

● Most recommends direct access to $_GET & $_POST to keep more control.


Case Sensitive & Type insensitive

● The first normally is not a problem...● But type insensitive brings some

unexpected problems

$country = "1 ; truncate world;";

if ( $country > 0 ) {mysql_query("delete from world where country = {$country}");

}

echo (int)$country; // 1echo (string)$country; // 1; truncate world;


Type juggling & Type cast

● http://www.php.net/manual/en/language.types.type-juggling.php – Variable type is based on context

● If you add (+) the it's a int (or a float)● If you use string concatenation (.) then is a string

● But you can force It!– (int), (float), (string), (array), (object), (unset)

– settype

$country = "1 ; truncate world;";settype($country,'integer');echo (int)$country; // 1echo (string)$country; // 1


PHP strings and .... C strings

● PHP uses a great amount of libraries ... in C.– “\0” in PHP is one char as all the rest

– But in C it means the end of string

$file = $_GET['file']; // "../../etc/passwd\0"

if (file_exists('/home/wwwrun/'.$file.'.php')) { // file_exists will return true as the // file /home/wwwrun/../../etc/passwd exists

include '/home/wwwrun/'.$file.'.php'; // the file /etc/passwd will be included}


Streams

● PHP uses streams to access “files”.● file:// — Accessing local filesystem● http:// — Accessing HTTP(s) URLs● ftp:// — Accessing FTP(s) URLs● php:// — Accessing various I/O streams● zlib:// — Compression Streams● data:// — Data (RFC 2397)● glob:// — Find pathnames matching pattern● phar:// — PHP Archive● ssh2:// — Secure Shell 2● rar:// — RAR● ogg:// — Audio streams● expect:// — Process Interaction Streams


include / require

● include / require uses streams meaning that you can include / require via “http”, “ftp”, etc.

● Except if you disable allow_url_fopen

// $_GET['theme_path'] => http://some-host.xpto/nasty.php?

include "{$_GET['theme_path']}/header.inc";


The trendy .inc

● There was a trend of using .inc● Only supersede by the "rename" to

.orig or .bak when doing live "debugging" directly on the servers

● Normally if the file ends with “.php” the file is processed by PHP, if it's named .inc or .orig is handled as a regular text file.


SQL Injections and Mysql

● Myth:– The mysql extension is vurnerable to SQL injection

– To solve this you must use● Mysqli● PDO

● Fact:– All extensions will allow you to do the queries that YOU want

– So, there is the possibility do do SQL injection in all

– The problem is between the chair and the keyboard

– In fact they refer to using prepared statements.


Session Magic

● session_start()● It Just Works ● Session Fixation

– session.use_only_cookies (default 1 para o PHP5.3)

– session_regenerate_id()


Useful Resources

● http://www.php.net

● https://www.owasp.org/index.php/Top_Ten● https://www.owasp.org/index.php/Cheat_Sheets● https://www.owasp.org/index.php/PHP_Security_Ch

eat_Sheet (wip)● https://www.owasp.org/index.php/OWASP_Zed_Att

ack_Proxy_Project● https://www.owasp.org/index.php/OWASP_Guide_

Project

Follow this topic:

@rjsmelo

QA

www.dri-global.com

@rjsmelo

[email protected]

Thank you

PHP and Application Security - OWASP Road Show 2013

Technology

Transcript of PHP and Application Security - OWASP Road Show 2013