Showing posts with label php. Show all posts
Showing posts with label php. Show all posts
Wednesday, April 5, 2017
Web Application Protection Tool to detect and correct vulnerabilities in PHP web applications
Web Application Protection Tool to detect and correct vulnerabilities in PHP web applications
WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP (version 4.0 or higher) and with a low rate of false positives. WAP detects and corrects the following vulnerabilities:
- SQL Injection (SQLI)
- Cross-site scripting (XSS)
- Remote File Inclusion (RFI)
- Local File Inclusion (LFI)
- Directory Traversal or Path Traversal (DT/PT)
- Source Code Disclosure (SCD)
- OS Command Injection (OSCI)
- PHP Code Injection
This tool semantically analyses the source code. More precisely, it does taint analysis (data-flow analysis) to detect the input validation vulnerabilities. The aim of the taint analysis is to track malicious inputs inserted by entry points ($_GET, $_POST arrays) and to verify if they reaches some sensitive sink (PHP functions that can be exploited by malicious input). After the detection, the tool uses data mining to confirm if the vulnerabilities are real or false positives. At the end, the real vulnerabilities are corrected with the insertion of the fixes (small pieces of code) in the source code. WAP is written in Java language and is constituted by three modules:
- Code Analyzer: composed by tree generator and taint analyser. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.
- False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyser, this module collects the presence of the attributes that define a false positive. Then, the Logistic Regression algorithm receives them and classifies the instance as being a false positive or not (real vulnerability).
- Code Corrector: Each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created.
Download WAP
Go to link download
Friday, March 31, 2017
PHP Secure Configuration Checker Check current PHP configuration for potential security flaws
PHP Secure Configuration Checker Check current PHP configuration for potential security flaws
Among the most tedious tasks of PHP security testing is the check for insecure PHP configuration. As a successor of our PHP Security Poster, we have created a script to help system administrators as well as security professionals to assess the state of php.ini and related topics as quickly and as thoroughly as possible. For later reference, the script is called "PHP Secure Configuration Checker" , or pcc.
Inspiration and previous work
- phpinfo(): Just like phpinfo() the pcc is supposed to give a brief overview of security related configuration issues.
- phpsecinfo: This is an alternative project that appears to have been discontinued in 2007.
- SektionEins PHP Security Poster (2009-2011): Some text snippets and recommendations of our own work we put into the popular poster have been reused.
Ideas, Features and Software Design
- One single file for easy distribution: In respect to an update process and access restrictions, a single file can be handled easier than a whole web application monster.
- Simple tests for each security related ini entry: Testing php.ini on a live system is the main aspect of this project. Each entry is supposed to be checked or otherwise actively ignored.
- A few other tests: pcc is not restricted to php.ini checks. Other ideas can be implemented as well.
- Compatibility: PHP 5.4 is supposed to work. Older PHP versions are not supposed to be used in the wild anyway.
- NO complicated/overengineered code, e.g. no classes/interfaces, test-frameworks, libraries, ...: In most cases, a recommendation is based on a simple boolean decision, e.g. is it 1 or is it 0. The corresponding code is supposed to reflect this simplicity. Also, simple code leads to fewer programming errors.
- Novice factor: The result is supposed to help secure the PHP environment. There is no need to obfuscate, encrypt or hide the code. Even unexperienced developers or system administrators may take a glance at the code - free of charge.
- NO (or very few) dependencies: pcc is supposed to run in the most simplistic (yet still realistically sane) PHP environment. Writing files and loading bloated library code should be avoided.
- Safeguards: In order to prevent information disclosure, IP restrictions are implemented, as well as a lock-out mechanism based on the scripts modification time.
- Suhosin: pcc checks the correct configuration of the Suhosin extension.
Download PHP Secure Configuration Checker
Go to link download
Monday, March 13, 2017
FuckShitUp Multi Vulnerabilities Scanner written in PHP
FuckShitUp Multi Vulnerabilities Scanner written in PHP
Basically, FSU is bunch of tools written in PHP-CLI. Using build-in functions, you are able to grab urls using search engines - and so, dork for interesting files and full path disclosures. Using list of urls, scanner will look for Cross Site Scripting, Remote File Inclusion, SQL Injection and Local File Inclusion vulnerabilities. It is able to perform mass bruteforce attacks for specific range of hosts, or bruteforce ssh with specific username taken from FPD. Whenever something interesting will be found, like vulnerability or broken auth credentials, data will be saved in .txt files - just like urls, and any other files. FSU is based on PHP and text files, its still under construction so i am aware of any potential bugs. Principle of operation is simple.
More urls -> more vulns. For educational purposes only.
Intro
- Data grabbing:
- URLs (geturl/massurl) -> (scan)
- Configs, Databases, SQLis (dork)
- Full Path Disclosures / Users (fpds) -> (brutefpds)
- Top websites info (top)
- Massive scanning
- XSS, SQLi, LFI, RFI (scan)
- FTP, SSH, DBs, IMAP (multibruter)
- Accurate SSH bruteforce (brutefpds)
Plan
- Web Apps
- Grab urls via geturl or massurl (massurl requires list of tags as file)
- Scan urls parameters for vulns with scan
- Servers
- Pick target, get ip range
- Scan for services on each IP and bruteforce with multibruter
- Grab full path disclosures, and so linux usernames
- Perform SSH bruteforce for specific user with brutefpds
- Info grabbing
- Use dork for automatic dorking
- Use fpds for full path disclosure grabbing
- Use search for searching someone in ur databases
- Use top for scanning all top websites of specific nation
- Others
- Stat shows actual statistics and informations
- Show display specific file
- Clear and filter - remove duplicates, remove blacklisted urls
Others
MultiBrtuer requirements (php5):
- php5-mysql - for mysql connections
- php5-pgsql - for postgresql connections
- libssh2-php - for ssh connections
- php5-sybase - for mssql connections
- php5-imap - for imap connections
TODO:
- Fix problems with grabbing large amount of urls
- More search engines
- SQL Injector
- RFI shell uploader
- FSU is not secure as it should be
Download FuckShitUp
Go to link download
Subscribe to:
Posts (Atom)