PHP {in}security
•Télécharger en tant que ODP, PDF•
2 j'aime•3,170 vues
Short presentation on techniques for protecting against vulnerabilities in commonly available PHP packages using a combination of Apache + FastCGI + suEXEC + chroot + mod_security2
![Presentation Overview ,[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommandé
Contenu connexe
Tendances
Tendances (18)
En vedette
En vedette (18)
Similaire à PHP {in}security
Similaire à PHP {in}security (20)
Dernier
Dernier (20)
PHP {in}security
- 1. PHP {in}security Michael Clark <michael at metaparadigm dot com>
- 3. php.ini
- 4. FastCGI
- 5. suEXEC
- 6. chroot jail
- 9. Conclusion
- 11. How do we protect against these vulnerabilities
- 12. Need to provide an environment with minimal trust for PHP applications
- 13. Only allow a minimal set of essential permissions in a hardened environment
- 14. Need to use privilege separation and chroot jails
- 18. By-product of FastCGI is that worker MPM can now be used.
- 19. Ability for Apache to handle more connections.
- 28. Dont include from any writable dirs
- 31. Detects special characters in URLs and inspects POST content type and payload.
- 32. Detects common injection patterns and exploits.
- 33. Adds additional logging (Full Request Headers).
- 36. We can't always audit and fix all of them
- 37. We can run them in a minimally trusted sandbox