Let's talk about how we can prevent these vulnerabilities now.
The first thing is a lot of these vulnerabilities exist because of the functionality they provide.
For example the file upload problem we had.
It allows the user to upload any file extension any file type.
This shouldn't happen.
There shouldn't be a way for users to upload any files they want.
Maybe if you want them to upload a picture then make sure they're uploading a picture check the file
types.
If you're expecting them to upload a song an empty three file make sure it's a media file.
It's not a BHP or an executable code.
Usually you should never allow users to upload any executable filters can be used to check whether to
check the extinction and make sure that the file is being uploaded that is a JPEG or whatever but that's
not a good way.
The best way is to check the file type and make sure the file type is a picture or is a media file instead
of checking the extension because that can be bypassed as well.
The second type of vulnerabilities that we looked at was the code execution vulnerabilities and these
exploits we were able to run any code we wanted on the target computer.
Again this functionality should be avoided.
You should avoid allowing users to run any sort of code on your server.
Try to avoid all these functions such as the evolved pass through and all of these functions that allow
a user to run operating system code on the server if you absolutely had to use something like it then
make sure you analyze the input before you execute it.
For example in the example we seen where the code was doing a ping and it would think anything we put
in the text box.
So I'm put in here slash the text box just to show that this is the input that we put in the text box.
This is what the program actually looks like if it looks too complicated forget about it.
We're just talking about the concept here.
So we're gonna be talking about this year so say for example you put what we did is we put a normal
IP and then we put the semicolon and then we put a command that we wanted to do so we did for example
airlines L.A. The problem with this is the web application used to take this the way it is copied and
run it in here which will when you when you execute this command it will do the pink first and then
it will do the Allies L.A. which is the command that we wanted.
What you need to do is for example if you had to do it what I advise is you just don't use these functions
if you had to use a function a function like this.
Then what you should do is check that the input is what you're expecting for example you're expecting
an IP address and nothing else.
So you can use projects to make sure and I'm not going to talk about projects or what projects is rejects
is basically a rule that will make sure that the input looks on the following format.
So it takes a digit digit dot digit digit dot digit digit that the two digit which if I put anything
else than the web application should refuse it.
You can also make sure that there is no semicolons and that there is no spaces.
So everything comes in as one thing and then it gets executed.
Again this is a way of making it more secure but the best thing is just to avoid these functions the
third type of vulnerability that we looked at was the file inclusion and we looked at two types the
local file inclusion which allowed us to include any file on the system and then read files which will
cause a file disclosure vulnerability.
And then you'd be able to read any file on the server and then we looked at the remote file inclusion
which is very dangerous which allowed us to include any file from any web server.
So we were able to include BHP shales and then get connection from the target's computer to prevent
these first of all make sure you prevent the remote file inclusion.
So just in case anything goes wrong people can't include files from outside your server and you can
do that the same way we enabled it using the page behind me by disabling the allow yourself left open
and allow your I'll include.
And if we go here to our to exploit well I'll just show you very quick.
So if we do pseudo Nano which is the text editor it ECPAT PCG IPH be that tiny the same file that we
used.
This is the file for the HP settings.
If you open that file and now I'm going to do control w I'll look for allow your URL
and you to make sure that they allow your Elif openly said to off and allow your l include is said to
off as well.
Control x y and enter and that'll save it for you
the other way to prevent these exploits is to use static file inclusion.
So instead of using dynamic file inclusion which we see and you can hard code the files that you want
to include in the code and not get them using get or post for example what's happening and the examples
we see in the vulnerable examples is we have a page called page or index that BHP and then this index
does.
BHP takes a parameter called page and then it takes another page for example news that BHP and it includes
this new space within the code.
So what's the code look like in the page code you'll see something like include.
So what this will do basically and that looks like this I believe what this do.
It includes whatever comes after the page parameter so the code will dynamically takes whatever that
comes in after the page parameter and includes it in the current page.
So this will be in the index that BHP page OK.
This is very bad because even if it's not get sometimes people use posed an impost.
You won't see this.
So it will be posted but you can use a proxy such as birth proxy.
And this would look like that and then you can modify it and get it to include anything you want and
then it's displayed on the page.
What we really want to do is we want the user not to be able to manipulate with what's going to be included.
So if you wanted to include a page called news that BHP just included inside this without giving the
user the ability to change it.
I know you're going to program your code to just have it looking like this but the users we know we
see how users can play with this and just get that to include anything they want.
So the best way to do it is just to get it to include page that BHP.
So your code is not using any variables it's it's hardcoded.
It might make your code log longer but it's much more secure.