In his presentation "Secure PHP Coding Practices," Jeff Channell will outline common security mistakes made by developers when creating PHP applications. Focusing on Joomla! in particular, attendees will learn the basics of how to prevent various hacking techniques such as Cross Site Scripting (XSS), SQL Injections, and Remote & Local Code Execution. Afterwards, a short Q&A session will be held.

1. Secure PHP Coding Practices @jeffchannell

3. Financial Loss

4. Disclosure of Information

5. Damage to other sites

7. Understand different exploitation techniques

9. Discovered numerous vulnerabilities, primarily in Joomla! extensions

11. SQL Injection

12. Code Execution

13. Cross Site Scripting (XSS)

14. Cross Site Request Forgery (CSRF)

16. Cannot be used by itself to gain access

17. Useful to an attacker

18. Generally involves absolute paths to files (Path Disclosure)

19. Error reporting generally includes paths

20. MySQL errors

22. Allows an attacker to alter the query

23. Does not always divulge information directly (known as “Blind Injection”)

24. SQL Injection – Example 1 $id = JRequest::getVar( 'id' ); $query = 'SELECT id, title FROM #__foobar WHERE id = ' . $id ; $db = JFactory::getDbo(); $db ->setQuery( $query ); $results = $db ->loadObject();

27. A malicious user can exploit this using the following request: index.php?option=com_foobar&id= 0 union select 1,2

30. SQL Injection – Example 1 $id = JRequest::get Int ( 'id' ); $query = 'SELECT id, title FROM #__foobar WHERE id = ' . $id ; $db = JFactory::getDbo(); $db ->setQuery( $query ); $results = $db ->loadObject();

31. SQL Injection – Example 2 $title = JRequest::getVar( 'title' ); $query = 'SELECT id, title FROM #__foobar WHERE title = apos;' . $title . 'apos;' ; $db = JFactory::getDbo(); $db ->setQuery( $query ); $results = $db ->loadObject();

35. SQL Injection – Example 2 $db = JFactory::getDbo(); $title = $db ->Quote( JRequest::get String ( 'title' ) ) ; $query = 'SELECT id, title FROM #__foobar WHERE title = ' . $title ; $db ->setQuery( $query ); $results = $db ->loadObject();

40. escapeshellcmd()

41. escapeshellarg()

43. Null bytes can be used to end a path prematurely

44. Only allow known files to be included

45. Local File Inclusion - Example $view = JRequest:: getString ( 'view' ); require_once JPATH_COMPONENT. '/views/' . $view . '.php' ;

48. Local File Inclusion - Example $path = JPATH_COMPONENT. '/views/' ; $files = JFolder::files( $path , '.php$' ); $file = JRequest::getString( 'view' ). '.php' ; if (in_array( $file , $files ) { require_once $path . $file ; } else { JError::raiseError( 500 , JText::_( 'COM_FOOBAR_VIEW_NOT_FOUND' ) ); }

50. FTP logs

53. register_globals and global path variables

56. Don't trust information from $_FILES

58. Javascript is a very flexible language

59. Browser Implementations

60. HTML DOM

61. E4X

64. JFilterInput

65. JFilterOutput

66. htmlspecialchars();

67. htmlentities();

69. Any Questions?