Obfuscating PHP

Obfuscating PHP

Programming RaviTeja   12:05:00 AM

Obfuscation is not the most effective way of security and at most of the times, it doesn’t help, as a professional hacker would already know these modifications and can easily make out what you are trying to hide. But obfuscation would really slow down the attacker and will keep away some script kiddies. It is better to obfuscate than rather telling him what he wants.

As an example - Server may use vulnerable version of PHP, with a public exploit released at some underground markets, Most of the time a simple automated exploit is released to help the “Point-Click-Hackers” (Script Kiddies). Now all they have to find is which Version of PHP you are using and if it is vulnerable, Point the exploit, launch it and own your system. In these cases obfuscating can really help you a lot.

By PHP obfuscation you can hide PHP, Which means you can stop or slow down a hacker attacking your machine.


In this tutorial, we’ll be looking at some of the most popular methods used by Site Administrators to Hide PHP , So let’s get started.

Editing php.ini file

PHP as a default exposes the fact that if it is installed on a server or not, by adding its signature to the Web server header which can really be lethal in some cases.

To set this off , Simply go to your php installation directory under “conf_files” , you can find your standard PHP Configuration file named “php.ini”

Now under this file , go to the “Miscellaneous” section and simply turn expose_php to Off.

Spoofing

By adding a simple line of code you can actually fool an attacker about what service are you using.

Spoof.php

Code:

<?php

error_reporting(0);
header("X-Powered-By: My Programming Language");
?>

Note: The header call should be made before you send any data to the client.

Using Some Basic Apache Rules

Most Web servers like Apache etc. Can be configured to use some basic rules that would allow to parse different file-types with PHP.

EG:-

A file like index.php, gives a straight clue to the attacker that the server is using php. But if we can use some basic server configuration to actually allow a extension like “.mpl” etc to parse PHP code. The attacker will certainly have no clue about the file extension.

For the Scope of this tutorial I’ll only be covering some Apache Rules/Configurations, but if you need help with some other servers, feel free to comment or PM me.

The configurations can be added either using the .htaccess directive or directly through the Apache Configurations file. Just add the following set of rules

Syntax :-

Code:

AddType application/x-httpd-php .extenstion

Example :-

Code:

AddType application/x-httpd-php .mpl .mp3 .py .asp

Note : Only use those extensions which are normally not used by the server , for example don’t use .txt extension as the server will interpret .txt as PHP code and if it contains some php , it will be executed.


[via] If you enjoyed this post, make sure you subscribe to my RSS feed! Comments are encouraged

What are Cookies ? Using Cookies in PHP.

What are Cookies ? Using Cookies in PHP.

php RaviTeja   8:23:00 PM

Cookies are basically small files which are stored in User’s Computer. Their main purpose is to hold data specific to a particular client and Website, They can only be accessed either by Web Server or the client computer. This allows the server to access user specific data while saving space on the web server, It allows the server to deliver specific tailored web pages to a particular user.

Cookies act as a mechanism to store data in the remote browser and thus tracking and identifying return users.

A Cookie mainly contains data in (key,value) pairs for example (name,aneesh) , (message,cookies are great).

That’s a lot of theory there now let’s move on how to use cookies using PHP.

Cookies in PHP

PHP provides us a with suite of functions for manipulation of cookies.

Setting of Cookies

These functions include setcookie() or setrawcookie() . As cookies are a part of HTTP headers so , it’s obvious we need to call setcookie() before sending any data.

Accessing Cookies

Any cookies which are sent to the server from the client will be automatically included in $_COOKIE auto – global array.

These cookies can be accessed using following syntax:-

Code:

   $_COOKIE['name'];

Using Cookies in PHP

The setcookie() function is used for setting of cookies

Syntax :-

Code:

  setcookie(name, value, expire, path, domain, secure, httponly);

Note: In the above all arguments except name is optional.

Example:-

Code:

  setcookie('name', 'aneesh');

This declares a cookie with name=name and value=aneesh , As no expire time is provided the cookie will be deleted from the browser after ending the session.

Example involving Expire time:-

Code:

  $minutes = 20;
  setcookie('name', 'aneesh' , time()+($minutes*60));

As the ‘expire’ time input should be in seconds we multiplied it with ‘60’ as each minute contains 60 seconds.

Printing:-

Code:

  echo $_COOKIE['name'];

This would print the value of cookie which we earlier set using setcookie()

Output:-

Code:

  aneesh

Making a Simple Application in PHP using Cookies

Now that we know quite a lot about what are cookies and how do we use them lets use them and make a small PHP Application.

Visited.php :-

Code:

  
  
      
          
      
      

Welcome Visitor
According to your browser cookies you
           have';
           }
           else
           {
              echo 'have not';
           }
           ?>  visited our site in the last 10 days.   
      
  

Output :-
1. When visiting for the first time :-

Code:

  Welcome Visitor
  According to your browser cookies you have not visited our site in the last 10 days.

2. Not visiting for the first time

Code:

  Welcome Visitor
  According to your browser cookies you have visited our site in the last 10 days.

Courtesy : Go4Expert (copied and pasted for my personal reference)

Top 10 MySQL Mistakes Made by PHP People

Top 10 MySQL Mistakes Made by PHP People

php RaviTeja   3:41:00 PM

A lot of developers would choose PHP than any other programming languages. Why? Because PHP is commonly said to be faster and more efficient for complex programming tasks and trying out new ideas, and is considered by many to be more stable and less resource-intensive as well. It is a very powerful programming language. However, what you created in PHP is not effective if you implement a weak database. Commonly, when you work in PHP, you'll also probably work with MySQL for the database. Well, many would have problems involving PHP and MySQL and some of these are caused by the mistakes which are listed below:

1. Using MySQL and not MySQLi

This is one of the very very common mistake made by PHP people. PHP Manual recommends using MySQLi over MySQL

If you are using MySQL versions 4.1.3 or later it is strongly recommended that you use the mysqli extension instead.

2. User inputted data not sanitized/cleaned

When you are creating a form, it enables a user to input anything they want, therefore, exposing your database to any vulnerability that there is. Your code, which processes the input from your form, should be carefully written so as to ensure that the input is as requested. If not your database would be prone to SQL injection or any attack which could lead to its destruction.

3. Querying all the fields (*) instead of specific fields.

It is important to create your query based only on what you need. Using * returns all columns in a table. One disadvantage of this is - it is slower compared to the specific query because it extracts all the data stored in a specific table (and some of it may not be of use).

4. Using full-privileged users for database operations.

Privileges such as updating, adding, deleting, etc. should only be granted to users with such specific functions. Full privileges can be very powerful and in the same way harmful, and should be granted only when necessary to roles and trusted users of the database.

5. Poor naming standards.

When naming your databases, objects, fields, etc., use descriptive names. Name them so that when you go back to your code years from now, you still know what it is about. Sometimes, you name fields, tables, or databases with names that only makes sense to you. When you visit it again after a month or so, you can't even figure out what it is. So, better name them carefully and descriptively. There really isn't a right or wrong way to name them. Although there are some simple general rules that should be followed like not using spaces, avoiding the use of reserved words, not using dashes, etc.

6. Not properly normalized tables.

Normalization is the process of organizing data to minimize redundancy. It involves dividing large tables into smaller ones to produce well-structured relations. When not properly normalized, additions, deletions, and modifications of any data may lead to problems like data redundancy or data inconsistency.

7. Using usernames or other character typed fields as primary keys.

A primary key is anything unique that you assign to a specific record in your database. In other words, that certain record only belongs to that certain primary key. Using usernames or other character typed fields as primary keys may lead to accidental access to certain information.

8. Relying too much on PHP.

Instead of using MySQL functions to do the mathematical calculation PHP developer's prefer to be using PHP to perform those calculation. As an example AVG() is an built in Function in MySQL still I have seen many people prefer to be using PHP to get the average of values fetched from MySQL.

Apart from that comparing values, or any other operations that we need to solve, sometimes, we tend to create our own versions of functions which we don't know exists in MySQL. For example, using PHP script for comparison in order to determine the largest value in a group of data, when in fact, we can use the Max() function in MySQL. This can lead to unnecessary steps and ultimately results in slower code. Therefore, it is good to utilize your knowledge in MySQL, or in cases where you are not familiar enough with it, it's good to study and analyze MySQL.

9. Using wrong data types.

MySQL supports a number of data types which includes numeric types, date and time types, and string (character) types.So, for example, if you're storing dates use the Date data type. Using any other data type will only make it complicated. You should use the most precise data type for your data to ensure optimum storage and to reduce possible errors.

10. Not using UTF-8.

MySQL includes character set support that enables you to store data using a variety of character sets and perform comparisons according to a variety of collations. When creating a database, some of us forget to set the database to UTF-8 character set, which then makes us wonder why some of the data won't appear anywhere else. Setting it to UTF-8 usually solves those issues.  
source : Go4Expert