instructor: Let's talk about how we can prevent 2 2
these vulnerabilities now. 3 3
The first thing is a lot of these vulnerabilities exist 4 4
because of the functionality they provide. 5 5
For example, the file upload problem we had, 6 6
it allows the user to upload any file extension, 7 7
any file type, this shouldn't happen, 8 8
there shouldn't be a way for users to upload 9 9
any files they want. 10 10
Maybe if you want them to upload a picture, 11 11
then make sure they're uploading the picture, 12 12
check the file types. 13 13
If you're expecting them to upload a song, an MP# file, 14 14
make sure it's a media file, it's not a PHP 15 15
or an executable code. 16 16
Usually, you should never allow users 17 17
to upload any executables. 18 18
Filter's can be used to check whether, 19 19
to check the extension and make sure 20 20
that the file is being uploaded is a JPEG or whatever. 21 21
But that's not a good way, 22 22
the best way is to check the file type and make sure 23 23
the file type is a picture, or is a media file, 24 24
instead of checking the extension 25 25
because that can be bypassed as well. 26 26
The second type of vulnerabilities that we looked at 27 27
was the code execution vulnerabilities. 28 28
In these exploits, we were able to run any code we wanted 29 29
on the target computer. 30 30
Again this functionality should be avoided, 31 31
you should avoid allowing users to run any sort of code 32 32
on your server. 33 33
Try to avoid all these functions 34 34
such as the var pass through, 35 35
and all these functions that allow a user 36 36
to run operating system code on the server. 37 37
If you absolutely had to use something like it, 38 38
then make sure you analyze the input before you execute it. 39 39
For example, in the example we seen 40 40
where the code was doing a ping and it will ping anything 41 41
we put in the text box. 42 42
So I'm putting here /$textbox just to show 43 43
that this is the input that we put in the text box. 44 44
This is what the program actually looks like 45 45
if it looks too complicated forget about it 46 46
we're just talking about the concept here. 47 47
So we're going to be talking about this here. 48 48
So, say for example you put what we did 49 49
is we put a normal IP, 50 50
and then we put the semicolon, and then we put a command 51 51
that we wanted to do so we just for example ls -la. 52 52
The problem with this is the web application used 53 53
to take this the way it is, copy it, and run it in here. 54 54
Which will, when you execute this command, 55 55
it will do the ping first, and then it will do the ls -la 56 56
which is the command that we wanted. 57 57
What you need to do is, for example, if you had to do it, 58 58
what I advise is you just don't use these functions. 59 59
If you had to use a function like this, 60 60
then what you should do is check that the input 61 61
is what you're expecting, 62 62
for example, you expecting an IP address 63 63
and nothing else, so you can use regex 64 64
to make sure, now I'm not gonna talk about regex 65 65
or what regex is, 66 66
regex is basically a rule 67 67
that'll make sure that the input looks 68 68
on the following format. 69 69
So it takes a digit, digit 70 70
dot digit digit dot digit digit dot digit digit 71 71
which if I put anything else, 72 72
then the web application should refuse it. 73 73
You can also make sure that there is no semicolons 74 74
and that there is no spaces, 75 75
so everything comes in as one thing 76 76
and then it gets executed. 77 77
Again, this is a way of making it more secure 78 78
but the best thing is just to avoid these functions. 79 79
The third type of vulnerability 80 80
that we looked at was the file inclusion 81 81
and we looked at two types. 82 82
The local file inclusion 83 83
which allowed us to include any file on the system 84 84
and then read files 85 85
which will cause a file disclosure vulnerability 86 86
and then you'd be able to read any file on the server 87 87
and then we looked at the remote file inclusion 88 88
which is very dangerous 89 89
which allowed us to include any file 90 90
from any web server so we were able to include PHP shells 91 91
and then get connection from the target computer. 92 92
To prevent these, first of all, 93 93
make sure you prevent the remote file inclusion. 94 94
So just in case anything goes wrong, 95 95
people can't include files from outside your server 96 96
and you can do that the same way we enabled it 97 97
using the PHP ini 98 98
by disabling the allow_url_fopen 99 99
and allow_url-include. 100 100
And if we go here to our Metasploitable, 101 101
I'll just show you very quick, 102 102
so if we do sudo nano 103 103
which is the text editor /etc/PHP/cgi/php.ini, 104 104
the same file that we used, 105 105
this is the file for the PHP settings. 106 106
If you open that file, 107 107
and now I'm gonna do Control + W, 108 108
and look for allow_url. 109 109
And you wanna make sure that the allow_url_fopen 110 110
is set to Off 111 111
and allow_url_include is set to Off as well. 112 112
Control + X + Y and enter 113 113
and that'll save it for you. 114 114
The other way to prevent these exploits 115 115
is to use static file inclusion 116 116
so instead of using dynamic file inclusion 117 117
which we've seen, you can hard code the files 118 118
that you want to include in the code 119 119
and not get them using GET or POST. 120 120
For example, what's happening in the examples 121 121
we see in the vulnerability examples 122 122
is we have a page called page or index.php. 123 123
And then this index.php takes a parameter called page 124 124
and then it takes another page, 125 125
for example, news.php. 126 126
And it includes this news.php in the code. 127 127
So what's the code look like? 128 128
In the PHP code, you'll see something like include. 129 129
So what this will do basically, 130 130
and that looks like this, I believe, 131 131
what this do, it includes 132 132
whatever comes after the page parameter. 133 133
So the code will dynamically takes whatever that comes in 134 134
after the page parameter and includes it in the current page 135 135
so this will be in the index.php page. 136 136
Okay, this is very bad 137 137
because even if it's not GET, 138 138
sometimes people use POST 139 139
and in POST you won't see this 140 140
so it'll be posted but you can use a proxy 141 141
such as Burp proxy 142 142
and this will look like that 143 143
and then you can modify it 144 144
and get it to include anything you want 145 145
and then it's displayed on the page. 146 146
What we really want to do is we want the user not to be able 147 147
to manipulate with what's gonna be included, 148 148
so if you wanted to include a page called news.php, 149 149
just include it inside this 150 150
without giving the user the ability 151 151
to change it. 152 152
I know you're gonna program your code 153 153
to just have it looking like this 154 154
but the users, we know, we've seen how users 155 155
can play with this and just get it 156 156
to include anything they want. 157 157
The best way to do it 158 158
is just to get it to include page.php 159 159
so your code is not using any variables. 160 160
It's hard coded, it might make your code longer 161 161
but it's much more secure.