PHPUG Presentation

Securing PHP Web Applications Web Applications ,[object Object],[object Object],[object Object]

$ whoami ,[object Object],[object Object],[object Object]

<?=presoinfo();?> ,[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection ,[object Object],[object Object],[object Object]

SQL Injection ,[object Object],[object Object],[object Object],[object Object]

Cross-Site Scripting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

XSS Example ,[object Object],[object Object],[object Object]

Real-world Dangers ,[object Object]

So what? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Coder for Hire? ,[object Object],[object Object],[object Object],[object Object]

Common Mitigations ,[object Object],[object Object],[object Object]

Sanitization/Encoding ,[object Object],[object Object],[object Object],[object Object]

Input Sanitization Fail ,[object Object],[object Object],[object Object],[object Object],exec ( "convert '" . mysql_escape_string ( $path ) . "' /tmp/'" . mysql_escape_string ( basename ( $path )). "'.png" );

Better? ,[object Object],[object Object],[object Object],[object Object]

Server-Side Checks ,[object Object],[object Object],[object Object],[object Object],[object Object]

Bug Hunting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Cross-Site Request Forgery ,[object Object],[object Object],[object Object]

GET CSRF ,[object Object],[object Object],[object Object]

POST CSRF ,[object Object],<form name=”csrf” action=” http://x.com/delete.php ” method=”POST”> <input type=”hidden” name=”id” value=”123”> </form> <script>document.csrf.submit()</script>

Fixing CSRF ,[object Object],[object Object],[object Object],[object Object],[object Object]

Other Protections ,[object Object],[object Object],[object Object],[object Object],[object Object]

3rd Party Plugins ,[object Object],[object Object],[object Object]

Server Config ,[object Object],[object Object],[object Object],[object Object]

Location: $references ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Thanks ,[object Object],http://xkcd.com/327/

PHPUG Presentation

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (20)

Similar a PHPUG Presentation

Similar a PHPUG Presentation (20)

Último

Último (20)

PHPUG Presentation