Download to read offline
![Some simple code...
<?php
$a = (int)$_GET['a'];
$b = (int)$_GET['b'];
$result = $a + $b;
printf('The answer is %d', $result);](https://image.slidesharecdn.com/140602-dipyourtoesintheseaofsecurityphpdorset-140603031551-phpapp02/75/Dip-Your-Toes-in-the-Sea-of-Security-PHP-Dorset-2nd-June-2014-4-2048.jpg)
![SQL Injection (#1)
<?php
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = {$user_id}";
$db->execute($sql);
✘](https://image.slidesharecdn.com/140602-dipyourtoesintheseaofsecurityphpdorset-140603031551-phpapp02/75/Dip-Your-Toes-in-the-Sea-of-Security-PHP-Dorset-2nd-June-2014-16-2048.jpg)
![SQL Injection (#1)
<?php
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = :userid";
$stmt = $db->prepare($sql);
$stmt->bind('userid', $user_id);
$stmt->execute();
✔](https://image.slidesharecdn.com/140602-dipyourtoesintheseaofsecurityphpdorset-140603031551-phpapp02/75/Dip-Your-Toes-in-the-Sea-of-Security-PHP-Dorset-2nd-June-2014-17-2048.jpg)
Uploaded byJames Titcumb
Dip Your Toes in the Sea of Security (PHP Dorset, 2nd June 2014)
The document is a presentation by James Titcumb on security best practices, particularly for PHP applications, emphasizing the importance of simplicity, risk awareness, and secure coding. Key points include protecting against SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and proper authentication methods. It advocates for learning about vulnerabilities, threat modeling, and maintaining minimal configurations while providing resources for further learning.
More Related Content
Similar to Dip Your Toes in the Sea of Security (PHP Dorset, 2nd June 2014)
![Best practices for crafting high quality PHP apps (php[world] 2019)](https://cdn.slidesharecdn.com/ss_thumbnails/191022-qualitytutorialphpworld2019-191020175612-thumbnail.jpg?width=640&height=640&fit=bounds)
![Climbing the Abstract Syntax Tree (php[world] 2019)](https://cdn.slidesharecdn.com/ss_thumbnails/191024-climbingtheabstractsyntaxtreephpworld2019-191020175622-thumbnail.jpg?width=640&height=640&fit=bounds)
Dip Your Toes in the Sea of Security (PHP Dorset, 2nd June 2014)
- 1. Dip Your Toes inthe Sea of Security James Titcumb PHP Dorset 2nd June 2014
- 2.
- 3.
- 4. Some simple code... <?php $a= (int)$_GET['a']; $b = (int)$_GET['b']; $result = $a + $b; printf('The answer is %d', $result);
- 5.
- 6. The Golden Rules 1.Keep it simple
- 7. The Golden Rules 1.Keep it simple 2. Know the risks
- 8. The Golden Rules 1.Keep it simple 2. Know the risks 3. Fail securely
- 9. The Golden Rules 1.Keep it simple 2. Know the risks 3. Fail securely 4. Don’t reinvent the wheel
- 10. The Golden Rules 1.Keep it simple 2. Know the risks 3. Fail securely 4. Don’t reinvent the wheel 5. Never trust anything / anyone
- 11. OWASP & the OWASPTop 10 https://www.owasp.org/
- 12. Application Security (mainly PHPapplications)
- 13.
- 14.
- 15. SQL Injection (#1) 1.Use PDO / mysqli 2. Use prepared / parameterized statements
- 16. SQL Injection (#1) <?php $user_id= $_GET['user_id']; $sql = " SELECT * FROM users WHERE user_id = {$user_id}"; $db->execute($sql); ✘
- 17. SQL Injection (#1) <?php $user_id= $_GET['user_id']; $sql = " SELECT * FROM users WHERE user_id = :userid"; $stmt = $db->prepare($sql); $stmt->bind('userid', $user_id); $stmt->execute(); ✔
- 18. Cross-Site Scripting /XSS (#3) ● Escape output
- 19. Cross-Site Scripting /XSS (#3) ● Escape output <?php $unfilteredInput = '<script type="text/javascript">...</script>'; // Unescaped - JS will run :'( echo $unfilteredInput; // Escaped - JS will not run :) echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
- 20. Cross-Site Request Forgery/ CSRF (#8) ● HTTP request ● e.g. submit a POST request to login form
- 21. Errors, Exceptions &Logging (#6) Sensitive Information exposure custom Exception & Error handling - filter what the end user sees - Handle API responses in a unified way
- 22. curl + https <?php curl_setopt($ch,CURLOPT_SSL_VERIFYHOST, false); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); ✘
- 23. curl + https <?php curl_setopt($ch,CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); curl_setopt($ch, CURLOPT_CAINFO, "/path/to/certificate"); ✔
- 24.
- 25.
- 26.
- 27.
- 28. We are notsecurity experts! We CAN write secure code
- 29. We are notsecurity experts! We CAN write secure code ● Learn more ● Keep it simple ● Think about attack vectors ● Prioritise vulnerabilities
- 30. ● Be the“threat” ● What do you want? ○ Personal data (name, address, DOB) ○ Sensitive data (credit cards, bank accounts) ○ Cause disruption (downtime) ● How would you do it? Think Differently
- 31. Threat Modelling ● Damage ●Reproducibility ● Exploitability ● Affected users ● Discoverability
- 32.
- 33. Authentication == Verifying IDENTITY ●Password ● Delegated password (LDAP etc.) ● One-time code (SMS, Yubi, Google 2FA etc.) ● Biometrics (fingerprints, iris, DNA etc.) ● Keycards / USB sticks etc.
- 34.
- 35.
- 36. CRYPTOGRAPHY IS HARD NEVER EVER “ROLLYOUR OWN” EVER!!!
- 37. Case Study: CustomAuthentication We thought about doing this…
- 38. Case Study: CustomAuthentication We thought about doing this…
- 39. Case Study: CustomAuthentication We thought about doing this… ...but the we realised we were overcomplicating things.
- 40. Password Hashing ● Neverstore plain text passwords ● Never encrypt passwords ● Always hash passwords ● Use password_hash / password_verify ○ >= PHP 5.5 ○ < PHP 5.5, use ircmaxell/password-compat
- 41. Authorization == Verifying ACCESS ●Access lists ● Role-based ● Attribute-based
- 42.
- 43. SSH Fortress ● Passwordless ●Rootless ● Lock down IP ● Run on different port
- 44. Firewalls #!/bin/bash IPT="/sbin/iptables" $IPT --flush $IPT --delete-chain $IPT-P INPUT DROP $IPT -P FORWARD DROP $IPT -P OUTPUT DROP # Loopback $IPT -A INPUT -i lo -j ACCEPT $IPT -A OUTPUT -o lo -j ACCEPT # Inbound traffic $IPT -A INPUT -p tcp --dport ssh -j ACCEPT $IPT -A INPUT -p tcp --dport 80 -j ACCEPT # Outbound traffic $IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT $IPT -A OUTPUT -p udp --dport 53 -m state
- 45. Brute Force Attacks ●iptables (complex) ● fail2ban ● DenyHosts
- 46. Install Only WhatYou Need ● Audit Regularly ● Use provisioning ● Don’t install cruft
- 47. Case Study: BeMinimal Internets Postfix Squid Proxy (badly configured) hacker spam
- 48. Resources ● http://securingphp.com/ ● https://www.owasp.org/ ●http://blog.ircmaxell.com/
- 49. The Golden Rules 1.Keep it simple 2. Know the risks 3. Fail securely 4. Don’t reinvent the wheel 5. Never trust anything / anyone
- 50. If you followall this, you get...
- 51. If you followall this, you get...
- 52.
- 53.