instructor: Let's talk about how we can prevent
these vulnerabilities now.
The first thing is a lot of these vulnerabilities exist
because of the functionality they provide.
For example, the file upload problem we had,
it allows the user to upload any file extension,
any file type, this shouldn't happen,
there shouldn't be a way for users to upload
any files they want.
Maybe if you want them to upload a picture,
then make sure they're uploading the picture,
check the file types.
If you're expecting them to upload a song, an MP# file,
make sure it's a media file, it's not a PHP
or an executable code.
Usually, you should never allow users
to upload any executables.
Filter's can be used to check whether,
to check the extension and make sure
that the file is being uploaded is a JPEG or whatever.
But that's not a good way,
the best way is to check the file type and make sure
the file type is a picture, or is a media file,
instead of checking the extension
because that can be bypassed as well.
The second type of vulnerabilities that we looked at
was the code execution vulnerabilities.
In these exploits, we were able to run any code we wanted
on the target computer.
Again this functionality should be avoided,
you should avoid allowing users to run any sort of code
on your server.
Try to avoid all these functions
such as the var pass through,
and all these functions that allow a user
to run operating system code on the server.
If you absolutely had to use something like it,
then make sure you analyze the input before you execute it.
For example, in the example we seen
where the code was doing a ping and it will ping anything
we put in the text box.
So I'm putting here /$textbox just to show
that this is the input that we put in the text box.
This is what the program actually looks like
if it looks too complicated forget about it
we're just talking about the concept here.
So we're going to be talking about this here.
So, say for example you put what we did
is we put a normal IP,
and then we put the semicolon, and then we put a command
that we wanted to do so we just for example ls -la.
The problem with this is the web application used
to take this the way it is, copy it, and run it in here.
Which will, when you execute this command,
it will do the ping first, and then it will do the ls -la
which is the command that we wanted.
What you need to do is, for example, if you had to do it,
what I advise is you just don't use these functions.
If you had to use a function like this,
then what you should do is check that the input
is what you're expecting,
for example, you expecting an IP address
and nothing else, so you can use regex
to make sure, now I'm not gonna talk about regex
or what regex is,
regex is basically a rule
that'll make sure that the input looks
on the following format.
So it takes a digit, digit
dot digit digit dot digit digit dot digit digit
which if I put anything else,
then the web application should refuse it.
You can also make sure that there is no semicolons
and that there is no spaces,
so everything comes in as one thing
and then it gets executed.
Again, this is a way of making it more secure
but the best thing is just to avoid these functions.
The third type of vulnerability
that we looked at was the file inclusion
and we looked at two types.
The local file inclusion
which allowed us to include any file on the system
and then read files
which will cause a file disclosure vulnerability
and then you'd be able to read any file on the server
and then we looked at the remote file inclusion
which is very dangerous
which allowed us to include any file
from any web server so we were able to include PHP shells
and then get connection from the target computer.
To prevent these, first of all,
make sure you prevent the remote file inclusion.
So just in case anything goes wrong,
people can't include files from outside your server
and you can do that the same way we enabled it
using the PHP ini
by disabling the allow_url_fopen
and allow_url-include.
And if we go here to our Metasploitable,
I'll just show you very quick,
so if we do sudo nano
which is the text editor /etc/PHP/cgi/php.ini,
the same file that we used,
this is the file for the PHP settings.
If you open that file,
and now I'm gonna do Control + W,
and look for allow_url.
And you wanna make sure that the allow_url_fopen
is set to Off
and allow_url_include is set to Off as well.
Control + X + Y and enter
and that'll save it for you.
The other way to prevent these exploits
is to use static file inclusion
so instead of using dynamic file inclusion
which we've seen, you can hard code the files
that you want to include in the code
and not get them using GET or POST.
For example, what's happening in the examples
we see in the vulnerability examples
is we have a page called page or index.php.
And then this index.php takes a parameter called page
and then it takes another page,
for example, news.php.
And it includes this news.php in the code.
So what's the code look like?
In the PHP code, you'll see something like include.
So what this will do basically,
and that looks like this, I believe,
what this do, it includes
whatever comes after the page parameter.
So the code will dynamically takes whatever that comes in
after the page parameter and includes it in the current page
so this will be in the index.php page.
Okay, this is very bad
because even if it's not GET,
sometimes people use POST
and in POST you won't see this
so it'll be posted but you can use a proxy
such as Burp proxy
and this will look like that
and then you can modify it
and get it to include anything you want
and then it's displayed on the page.
What we really want to do is we want the user not to be able
to manipulate with what's gonna be included,
so if you wanted to include a page called news.php,
just include it inside this
without giving the user the ability
to change it.
I know you're gonna program your code
to just have it looking like this
but the users, we know, we've seen how users
can play with this and just get it
to include anything they want.
The best way to do it
is just to get it to include page.php
so your code is not using any variables.
It's hard coded, it might make your code longer
but it's much more secure.