| Author |
Message |
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
 Posted: Wed Jun 14, 2006 8:27 am Post maybe stupid Post subject: Vulnerability scanners? |
 |
 |
|
|
| Can you guys tell me what a VERY good vulnerability scanner is besides core impact and nessus? I already use nmap to find some openings, but I want specific vulnerabilities pertaining to sql abd php. I know there are many out there and I can just search google, but there are a lot and I want to know what is usually used, and what is really worth downloading.. |
|
| Back to top |
|
 |
anon
Guest
Offline
|
| Posted: Wed Jun 14, 2006 8:33 am Post maybe stupid Post subject: |
|
|
|
|
| the best vunrability scanner is looking at you in the mirror. |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Wed Jun 14, 2006 8:34 am Post maybe stupid Post subject: |
|
|
|
|
| That didn't make sense. |
|
| Back to top |
|
|
Mine GO BOOM
Hunch Hunch
What What
Age:42
Gender:
Joined: Aug 01 2002
Posts: 3615
Location: Las Vegas
Offline
|
| Posted: Wed Jun 14, 2006 12:03 pm Post maybe stupid Post subject: |
|
|
|
|
It means, almost any vulnerability dealing with PHP/SQL is usually injection type code. An example would be, with PHP, taking user input and sending it directly into a SQL statement.
$limit = $HTTP_GET_VARS['limit'];
$sql = "GET * FROM table LIMIT " . $limit; |
Oops. Someone sends the string 0; DROP table; as your limit variable, and you just lost your table. Even worse is if the output of the statement is somehow directly visible by the user, because then they can use GET statements to find out information from your SQL database, such as passwords or table names, to do even more damage.
The same idea with php. If you don't sanitize user input, and you open a filename based upon their input, you could accidently open /etc/passwd and give the user ever login name on your system. Even worse would be to somehow allow the script to include/execute another script based upon user input, because if they could upload a gif file that is actually a script, and they get your program to include/execute that file, they just gained full access to your system.
How to fix this? Don't trust register_globals, as it is much better to parse all input from $HTTP_POST/GEt yourself. This would also force you to look at when you are accepting user input, so you can recognize that input needs to be in a certain form, and can halt the script early to print out errors.
Hell, read this article for php security checks. |
|
| Back to top |
|
|
Cyan~Fire
I'll count you!
Age:37
Gender:
Joined: Jul 14 2003
Posts: 4608
Location: A Dream
Offline
|
| Posted: Wed Jun 14, 2006 1:03 pm Post maybe stupid Post subject: |
|
|
|
|
Huh? Register_globals is setting every get/post/cookie variable as a global variable, which is an unrelated security concern.
_________________
This help is informational only. No representation is made or warranty given as to its content. User assumes all risk of use. Cyan~Fire assumes no responsibility for any loss or delay resulting from such use.
Wise men STILL seek Him. |
|
| Back to top |
|
|
Mine GO BOOM
Hunch Hunch
What What
Age:42
Gender:
Joined: Aug 01 2002
Posts: 3615
Location: Las Vegas
Offline
|
| Posted: Wed Jun 14, 2006 2:05 pm Post maybe stupid Post subject: |
|
|
|
|
| Cyan~Fire wrote: | | .. unrelated security concern. |
No, it isn't. If used correctly, it is great. The reason it is a security concern is that with beginners, or even those that have used it for a while, it easily allows itself for abuse. Sample from link posted before:
// Assume $article_id is set by the URL
if ($article_id == 0) {
$guest_ok = true;
}
if (!$guest_ok) {
// Check user is authenticated using a function defined elsewhere
check_auth();
} |
Yes, it is easy to fix. The problem is that most people don't know to look for errors such as this, and it is usually better to initialize only the user inputs you want, as it forces the programmer to recognize where the values are coming from, POST, GET, or cookie. |
|
| Back to top |
|
|
Cyan~Fire
I'll count you!
Age:37
Gender:
Joined: Jul 14 2003
Posts: 4608
Location: A Dream
Offline
|
| Posted: Wed Jun 14, 2006 3:34 pm Post maybe stupid Post subject: |
|
|
|
|
| But turning register globals off will not fix the problem you are talking about, opening a file based on user's input. What it will fix is opening a file using a variable that's not supposed to be user input. |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Wed Jun 14, 2006 5:15 pm Post maybe stupid Post subject: |
|
|
|
|
Anon, I understand what you said now. I had to think about it for a little while. I still can't beat the standard vulnerability scanner when it comes to speed, so I don't agree. lol
Anyway, good points, but can someone point out a good vulnerability scanner? lol |
|
| Back to top |
|
|
Doc Flabby
Server Help Squatter
Joined: Feb 26 2006
Posts: 636
Offline
|
| Posted: Thu Jun 15, 2006 6:03 am Post maybe stupid Post subject: |
|
|
|
|
Learn how to find secuity problems first, then you will understand the value of a scanner.
Secuitry scanners are just one in a range of tool to secure a system. They are not to be used on there own, or to be relyed on. I have rarely found any use for them, A simple port-scan tends to tell me more about what i need to know to secure a system.
nessus is the best btw |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 10:02 am Post maybe stupid Post subject: |
|
|
|
|
Argh. I beg to differ! I want to find vulnerabilities in databases mainly. And Im don't think its necessary to try a million ways manually, when I have something to do it for me - and quickly!
So Nessus is the best hm?
---
BTW, port scans can only get you but so far. |
|
| Back to top |
|
|
SpecShip
Complete twat
Gender:
Joined: Dec 17 2005
Posts: 514
Location: 8025 - Spec Freq
Offline
|
| Posted: Thu Jun 15, 2006 11:15 am Post maybe stupid Post subject: |
|
|
|
|
You do realise quan is a dumb scriptkiddie wannabe who's just looking for ez ways to "haxor" forums, right?
REGISTER GLOBALS IS BAD!
cyan, stop being stupid and get educated: http://il2.php.net/register_globals
_________________
Replacing yazour untill the whore returns.
"I could run a ss server on my car stereo!" -Xalimar
"Liberta tuit ma ex infernis" -Event Horizon
"I know too much about nothing." - Mine GO BOOM
"Hmm anyway, back to my kingdom hearts." - Chambahs |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 12:07 pm Post maybe stupid Post subject: |
|
|
|
|
| Spec, wtf are you talking about? Im never said I would hack anything. Im not a script kiddie. And if I am, then so be it. All im looking for is a good vulnerability scanner. |
|
| Back to top |
|
|
Smong
Server Help Squatter
Joined: 1043048991
Posts: 0x91E
Offline
|
| Posted: Thu Jun 15, 2006 12:57 pm Post maybe stupid Post subject: |
|
|
|
|
| You do have a reputation for asking how to hack and threatening to hack. |
|
| Back to top |
|
|
BDwinsAlt
Agurus's Posse
Age:34
Gender:
Joined: Jun 16 2003
Posts: 1145
Location: Alabama
Offline
|
| Posted: Thu Jun 15, 2006 12:59 pm Post maybe stupid Post subject: |
|
|
|
|
Let me test the database for you :p
Check out http://hackthissite.org. You can complete realistic missions and ask them on their forums. It teaches you about sql vunerabilities and stuff like that. |
|
| Back to top |
|
|
Cerium
Server Help Squatter
Age:43
Gender:
Joined: Mar 05 2005
Posts: 807
Location: I will stab you.
Offline
|
| Posted: Thu Jun 15, 2006 1:13 pm Post maybe stupid Post subject: |
|
|
|
|
HAH!
BDwinsAlt teaching quanchi how to hack. You cant write this stuff, folks.
_________________
There are 7 user(s) ignoring me right now. |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 1:13 pm Post maybe stupid Post subject: |
|
|
|
|
:/
Its like you're not even reading what I'm saying. Nvm.
If someone could delete this topic, please do. I'd appreciate it. |
|
| Back to top |
|
|
Cerium
Server Help Squatter
Age:43
Gender:
Joined: Mar 05 2005
Posts: 807
Location: I will stab you.
Offline
|
| Posted: Thu Jun 15, 2006 1:14 pm Post maybe stupid Post subject: |
|
|
|
|
Out of curiosity, why do you need a scanner? What possible use could you have for it?
Everyone here -- myself included -- knows you plan on using it to try to hack someone elses site, because somehow thats cool to you. But just for the hell of it, feel free to attempt to prove us all wrong. |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 1:30 pm Post maybe stupid Post subject: |
|
|
|
|
Fine, I'll find vulnerabilities manually.
Vulnerability scanners aren't always used to hack systems. I could be patching up a database and need to know if I missed something..
I don't plan on hacking anyone. I plan on helping out a friend with his website, and if you know just as much as I do, then you know that its easy for someone to perform an sql injection on your website. Thats what my friend wants to prevent.
Other information on this is none of your business. |
|
| Back to top |
|
|
Mine GO BOOM
Hunch Hunch
What What
Age:42
Gender:
Joined: Aug 01 2002
Posts: 3615
Location: Las Vegas
Offline
|
| Posted: Thu Jun 15, 2006 1:44 pm Post maybe stupid Post subject: |
|
|
|
|
| Quan Chi2 wrote: | | I don't plan on hacking anyone. I plan on helping out a friend with his website, and if you know just as much as I do, then you know that its easy for someone to perform an sql injection on your website. Thats what my friend wants to prevent. |
Tell him to use fgrep or any application that lets you search lines in a file, and make a report of every SQL call. For these forums, it was easy to check every SQL statement, as they setup every SQL call through the same function, and before the function call they always setup the SQL statement with the variable $sql = blah.
When you look at all the calls, check how every variable is assigned. If it is assigned by anything the user can input, be in from a HTTP request or doing a search on a username already returned from a previous SQL request, is it escaped properally? Are variables that are assumed to be numbers actually checked that they are in fact numbers? |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 2:07 pm Post maybe stupid Post subject: |
|
|
|
|
| K, thanks |
|
| Back to top |
|
|
SpecShip
Complete twat
Gender:
Joined: Dec 17 2005
Posts: 514
Location: 8025 - Spec Freq
Offline
|
| Posted: Thu Jun 15, 2006 2:33 pm Post maybe stupid Post subject: |
|
|
|
|
Now, if he actually had a clue he would've known how to take such vulnerabilities and turn them into exploits...thank goodness he's just a stupid kid.
Cerium, heh, good one.
Yep, can't write life, life it's is too damn funny. |
|
| Back to top |
|
|
Quan Chi2
Member of "Sexy Teenagers that Code" Group
Age:34
Gender:
Joined: Mar 25 2005
Posts: 860
Location: NYC
Offline
|
| Posted: Thu Jun 15, 2006 2:36 pm Post maybe stupid Post subject: |
|
|
|
|
| Spec, hop off my dick, please. You're sucking me hard and I don't like it. |
|
| Back to top |
|
|
newb
Turds are yummy
Age:33
Gender:
Joined: Mar 15 2005
Posts: 1267
Location: England
Offline
|
| Posted: Fri Jun 16, 2006 4:14 am Post maybe stupid Post subject: |
|
|
|
|
Sucking what? Your non-existant dick?
_________________
Haha SpecShip |
|
| Back to top |
|
|
doc flabby (at work)
Guest
Offline
|
| Posted: Fri Jun 16, 2006 7:04 am Post maybe stupid Post subject: |
|
|
|
|
hmm
I wouldnt recommend running any kind of scanner against a server that does not belong to you. There lies the way to a court case.
People have been sucessfully procecuted for less. |
|
| Back to top |
|
|
CypherJF
I gargle nitroglycerin
Gender:
Joined: Aug 14 2003
Posts: 2582
Location: USA
Offline
|
| Posted: Fri Jun 16, 2006 7:25 am Post maybe stupid Post subject: |
|
|
|
|
| Mine GO BOOM wrote: | | ...parse all input from $HTTP_POST ... |
I am pretty sure they're going to deprecate $HTTP_POST/GET aren't they?
I tell everyone to use super-global's: $_POST, $_GET, $_SERVER, $_COOKIE, $_FILE.
To block SQL injection's using PHP, look into the appropriate API's. MySQL has $return_string = mysql_real_escape_string($string); which will properly escape the query (do not rely on add_slashes(), it's a false sense of security!).
Sometime check out the PHP Security Consortium, and Chris Shiflett (an expert in PHP security), they publish, free, material which can be downloaded.
_________________
Performance is often the art of cheating carefully. - James Gosling |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Statistics
Register
Profile
Login to check your private messages
Login
You know, helmets are a good thing... 
