Web Application Security, Part 2 - Revision history

Todd: /* Example */

2022-02-20T14:40:04Z

Example

Todd: /* Real-Life Examples */

2018-07-18T20:57:22Z

Real-Life Examples

Todd: /* Real-Life Examples */

2018-07-18T20:53:57Z

Real-Life Examples

Todd: /* Real-Life Examples */

2018-07-18T20:53:31Z

Real-Life Examples

Todd: /* Real-Life Examples */

2018-07-18T20:52:57Z

Real-Life Examples

Alex: /* Example */

2018-02-25T20:26:59Z

Example

Alex: /* Solution */

2017-09-29T20:36:10Z

Solution

Alex: Deleted PHP 5.3 support

2017-08-24T17:25:52Z

Deleted PHP 5.3 support

Alex: Deleted OpenID

2017-08-24T17:25:18Z

Deleted OpenID

Alex: /* Checking Passwords */

2017-08-24T17:24:21Z

Checking Passwords

@@ Line 88: / Line 88: @@
 // Bind the parameter
 $stmt->bind_param('s', $user);
 $stmt->execute();

@@ Line 327: / Line 327: @@
 * [http://gizmodo.com/some-guy-figured-out-how-to-delete-every-photo-on-faceb-1685491356 Facebook, February 2015 (bypassing authorization on REST API calls)]
 * [http://www.theregister.co.uk/2012/04/18/toshiba_slapped_by_ico/ Toshiba, April 2012 (parameter manipulation / information leakage)]
 * [http://www.zdnet.com/blog/security/3-million-bank-accounts-hacked-in-iran/11577 Iranian Banks, April 2012 (information leakage)]

@@ Line 249: / Line 249: @@
 * [http://www.dutchnews.nl/news/archives/2012/04/new_online_medical_records_sca.php Dutch Department Stores, April 2012]
 * [http://www.scmagazine.com.au/News/292592,allphones-hacked-staff-passwords-exposed.aspx Allphones (Australian Telecommunications Retailer), March 2012]
 == Abuse of Functionality ==

@@ Line 186: / Line 186: @@
 * [http://www.zdnet.com/no-data-breach-in-first-weibo-attack-2062301014/ Weibo, June 2011]
 * [http://www.pcworld.com/businesscenter/article/228609/hackers_steal_hotmail_messages_thanks_to_web_flaw.html Hotmail, May 2011]
 * [http://www.theregister.co.uk/2010/05/19/facebook_private_data_leak/ Facebook, May 2010]

@@ Line 249: / Line 249: @@
 * [http://www.zdnet.com/unknowns-hack-european-space-agency-4010026071/ European Space Agency, May 2012]
 * [http://www.dutchnews.nl/news/archives/2012/04/new_online_medical_records_sca.php Dutch Department Stores, April 2012]
 * [http://www.scmagazine.com.au/News/292592,allphones-hacked-staff-passwords-exposed.aspx Allphones (Australian Telecommunications Retailer), March 2012]
 * [http://www.abc4.com/content/news/slc/story/More-fallout-Salt-Lake-City-police-website-hacked/PiSspE768UiioitJ3K4gyQ.cspx Salt Lake City Police Department, February 2012]

@@ Line 76: / Line 76: @@
 === Example ===
-Here is an example of what you might do on your login page.  '''''Note:'' This example assumes that you salted the user's password already and stored it in the database.'''
+Here is an example of what you might do on your login page.  '''''Note:'' This example assumes that you hashed the user's password already and stored it in the database.'''
 <source lang="php">
@@ Line 85: / Line 85: @@
 // Use a prepared statement
-$stmt = $mysqli->prepare("SELECT COUNT(*), id, crypted_password FROM users WHERE username=?");
+$stmt = $mysqli->prepare("SELECT COUNT(*), id, hashed_password FROM users WHERE username=?");
 // Bind the parameter
@@ Line 109: / Line 109: @@
 </source>
-'''Note:''' You may sometimes see functions like vanilla [http://php.net/md5 md5()] used to hash passwords.  md5() does indeed perform one-way hashing, but it does so without a salt.  '''THIS IS BAD PRACTICE''', because unsalted md5 hashes can be trivially reversed using a rainbow table.  (Just Google for "md5 decrypter".)  Using a salt prevents the effective use of a rainbow table. Additionally, '''the md5 function, even with a salt, should not be used because it has been proved vulnerable.'''
+'''Note:''' You may sometimes see functions like vanilla [http://php.net/md5 md5()] or [http://php.net/crypt crypt()] used to hash passwords.  md5() does indeed perform one-way hashing, but it does so without a salt.  '''THIS IS BAD PRACTICE''', because unsalted md5 hashes can be trivially reversed using a rainbow table.  (Just Google for "md5 decrypter".)  Using a salt prevents the effective use of a rainbow table. Additionally, '''the md5 function, even with a salt, should not be used because it has been proved vulnerable.'''
 === Real-Life Examples ===

@@ Line 174: / Line 174: @@
 $destination_username = $_POST['dest'];
 $amount = $_POST['amount'];
 if(!hash_equals($_SESSION['token'], $_POST['token'])){
 	die("Request forgery detected");

@@ Line 98: / Line 98: @@
 $pwd_guess = $_POST['password'];
 // Compare the submitted password to the actual password hash
 if($cnt == 1 && password_verify($pwd_guess, $pwd_hash)){

← Older revision		Revision as of 17:25, 24 August 2017
Line 111:		Line 111:

	'''Note:''' You may sometimes see functions like vanilla [http://php.net/md5 md5()] used to hash passwords. md5() does indeed perform one-way hashing, but it does so without a salt. '''THIS IS BAD PRACTICE''', because unsalted md5 hashes can be trivially reversed using a rainbow table. (Just Google for "md5 decrypter".) Using a salt prevents the effective use of a rainbow table. Additionally, '''the md5 function, even with a salt, should not be used because it has been proved vulnerable.'''		'''Note:''' You may sometimes see functions like vanilla [http://php.net/md5 md5()] used to hash passwords. md5() does indeed perform one-way hashing, but it does so without a salt. '''THIS IS BAD PRACTICE''', because unsalted md5 hashes can be trivially reversed using a rainbow table. (Just Google for "md5 decrypter".) Using a salt prevents the effective use of a rainbow table. Additionally, '''the md5 function, even with a salt, should not be used because it has been proved vulnerable.'''
−
−	~~=== OpenID ===~~
−
−	One other solution that will solve ''all'' issues related to password security is to not have passwords at all. This can be achieved using [[wikipedia:OpenID\|OpenID]], which allows end users to use their accounts from other sites (e.g. Google, Yahoo, and Twitter) to authenticate on your site. Not only does this make your life easier in the security realm, but it also eliminates the need for password recovery, etc.
−
−	There are many PHP libraries available for OpenID authentication; one such library is the creatively named [http://pear.php.net/package/OpenID OpenID], which you can install using [[PHP#PEAR\|PEAR]]. You will need to install some other packages first, some from yum (if using RHEL) and some from pear. (If you don't install them, PEAR will yell at you.) These are the commands you need to run in order to install the correct packages (make sure you understand what they do before running them):
−
−	~~<source lang="bash">~~
−	~~$ sudo yum install php-mbstring php-bcmath # not necessary on Debian~~
−	~~$ sudo apachectl graceful # restart Apache~~
−	~~$ sudo pear install Crypt_DiffieHellman-0.2.6 Validate-0.8.5 Services_Yadis-0.5.1 OpenID-0.3.3~~
−	~~</source>~~
−
−	~~Here's an example implementation that uses the PEAR package.~~
−
−	~~'''Login Page:'''~~
−	~~<source lang="html4strict">~~
−	~~<form action="process_openid.php" method="post">~~
−	~~<input id="start" name="start" type="hidden" value="true" />~~
−	~~<fieldset>~~
−	~~<legend>Sign in using OpenID</legend>~~
−	~~<div id="openid_choice">~~
−	~~<p>Please select your account provider:</p>~~
−	~~<select name="identifier">~~
−	~~<option value="https://www.google.com/accounts/o8/id">Google</option>~~
−	~~<option value="http://yahoo.com/">Yahoo</option>~~
−	~~</select>~~
−	~~</div>~~
−	~~<p>~~
−	~~<input type="submit" value="Sign In"/>~~
−	~~</p>~~
−	~~</fieldset>~~
−	~~</form>~~
−	~~</source>~~
−
−	~~'''process_openid.php:'''~~
−	~~<source lang="php">~~
−	~~<?php~~
−	~~require_once 'OpenID/RelyingParty.php';~~
−	~~require_once 'OpenID/Message.php';~~
−	~~require_once 'Net/URL2.php';~~
−
−	~~session_start();~~
−
−	~~$realm = "http://www.yoursite.com/";~~
−	~~$returnTo = $realm . "path/to/process_openid.php";~~
−
−	~~$identifier = @$_POST['identifier'] ?: @$_SESSION['identifier'] ?: null; // note: the @ signs suppress "undefined" notices~~
−
−	~~$o = new OpenID_RelyingParty($returnTo, $realm, $identifier);~~
−
−	~~// Part 1: We are processing a login request before visiting the OpenID provider~~
−	~~if(@$_POST['start']) {~~
−	~~$authRequest = $o->prepare();~~
−	~~$url = $authRequest->getAuthorizeURL();~~
−
−	~~header("Location: ".$url);~~
−	~~exit;~~
−	}
−
−	~~// Part 2: The user is returning to our site after visiting the OpenID provider's site~~
−	~~else {~~
−	~~$usid = @$_SESSION['identifier'] ?: null;~~
−	~~unset($_SESSION['identifier']);~~
−
−	~~$queryString = count($_POST) ? file_get_contents('php://input') : $_SERVER['QUERY_STRING'];~~
−
−	~~$message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);~~
−
−	~~$result = $o->verify(new Net_URL2($returnTo . '?' . $queryString), $message);~~
−
−	~~if($result->success()){~~
−	~~// Login Success!~~
−
−	~~// Get the OpenID identifier, which is unique to every OpenID user (i.e. you can use it in your database to~~
−	~~// keep track of people between logins), and save it in the session:~~
−	~~$_SESSION["openid.identity"] = $message->get("openid.identity");~~
−
−	~~// Now redirect to the target page for logged-in users~~
−	~~}else{~~
−	~~// Login Failed. You can redirect back to the login page or whatever~~
−	}
−	}
−	?>
−	~~</source>~~
−
−	'''Note:''' OpenID is by nature a secure form of authentication for a web application; the fact that government agencies like the GSA use OpenID helps attest to this. However, OpenID remains vulnerable to man-in-the-middle, content-spoofing attacks. If you are writing a high-profile application using OpenID, it is therefore recommended that you establish an SSL (https) connection to your OpenID providers to help prevent phishing.
−
−	~~'''Note:''' You may use OpenID for modules 4 and higher, but you must implement your own authentication system for module 3.~~

	=== Real-Life Examples ===		=== Real-Life Examples ===

@@ Line 56: / Line 56: @@
 As an extra bit of fun, the == operator exhibits some behavior that's less than intuitive.
-Try to guess what the output will be if you were to run the following code:
+Try to guess what the output would be if you were to run the following code:
 <source lang="php">
@@ Line 73: / Line 73: @@
 Luckily, PHP, starting in version 5.5, has your back, with a function that solves both the problems above. You can use the [https://secure.php.net/manual/en/function.password-verify.php password_verify()] function to check a password securely.
 === Example ===