PHP is evil (Defensive programming)
summary
Explains concrete failures and fixes: SQL injection keeps happening because people cast to int instead of using prepared statements, tutorials teach unsafe concatenation, and legacy Magic quotes behavior leads to double-escaping and CSV overflows. Demonstrates a live exploit path using logs + proc self fd2 to include attacker-sent PHP and drop a c99 mad shell when allow_url_include or writable caches exist. Recommends open_basedir, disabled_functions, safe server ownership, SE Linux and layered defenses plus attention to null‑byte, UTF‑7 and eval/backtick risks.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:34Welcome!
- 1:46What we are going to talk about today...
- 2:54for example
- 4:18Some things to avoid...
- 6:13String Escaping
- 11:12Correct way to escape
- 11:46Input Cleaning
- 12:35Random cool IE hack...
- 14:03More Strings!!!!
- 16:49Affected Functions?
- 17:27Securing around PHP
- 20:20Case Study
- 20:33Target & Discovery
- 23:22Step 2: Exploit!
- 25:26Find the password!
- 26:14Some easy ways this could have been avoided
- 27:43Wrapping up...
related talks
10mIntroduction to web security
45mKnow Your Enemies: Live Exploit of a PHP Engine Security Breach
02h 18mWeb application security (Part 2)
01h 02mCode Review For Security
01h 01mSecurity: From basic principles to PHP specifics
55mDip Your Toes in the Sea of Security
44mEnding Injection Vulnerabilities
45mPHP: Particularly Horrible Programs