In the early days of the Internet most web development was done by professionals. Since then an array of web development tools, several scripting languages, and easily configurable web server software has made it easier for the novice to create and host their own website's. It has a significant user base and thousands of free scripts can be found all over the internet to perform all kinds of useful functions.
In this paper, the basics behind the PHP scripting language and Apache web server architecture will be outlined. Any web server could have been used for this paper, but the Apache web server was chosen dues to its popularity and availability as an open source product. Next, an investigation of the various PHP vulnerabilities will be conducted to provide readers with information that will help them write PHP scripts that are not easily exploited.
When a rule is violated the severity is reported along with the filename and line number. The tool is aptly named the Vulnerability Detection Tool and its design and use is also outlined in this paper. PHP is a general-purpose scripting language that is especially suited to server-side web development, in which case PHP generally runs on a web server. Any PHP code in a requested file is executed by the PHP runtime, usually to create dynamic web page content or dynamic images used on websites or elsewhere. It can also be used for command-line scripting and client-side graphical user interface applications. PHP can be deployed on most web servers, many operating systems and platforms, and can be used with many relational database management systems .
Most web hosting providers support PHP for use by their clients. It is available free of charge, and the PHP Group provides the complete source code for users to build, customize and extend for their own use. In this simple example the PHP tags allow the web server to know when to send the code to the PHP module running in the background. When the PHP start tag is encountered the web server application that is interpreting the HTML code knows to pass this to the PHP module.
The PHP module then takes the code and creates HTML code to write out "Hello World" to the client's browser screen. It is very powerful and different from client side java scripts because the PHP code is executed on the server and not the client. There are three main areas of Web development that PHP can handle. These are server-side scripting, command line scripting, and writing desktop applications.
The last type in the list, desktop applications, is not an area that PHP excels as pointed out by the creators on the PHP website. However, there is an extension for creating Graphical User Interfaces called PHP-GTK [Oglio et al. 2006]. Additionally, PHP can be used by the most popular web servers on all of the main stream operating systems. To understand some of the vulnerabilities examined in later sections of this paper we will need to dig a little deeper into basic PHP syntax. The way variables can be operated on is very similar to most programming languages. Given the similarities a listing of these operators is not necessary but before writing any PHP scripts it is suggested to review them via online documentation [Achour, et al. 2007].
The same can be said of the control structures with exception of a few new types that are unique to the PHP language. Table 1 contains the list of unique control structures and a short description of their operation. A few of these typically are not considered control structures in most programming languages but because this is a scripting language they are defined in this manner.
Now that we know a little about the different types of constructs available in PHP lets examine how functions are created within PHP. The roots of PHP are quite simple and originate with one man. His name was Rasmus Lerdorf and in 1995 he wrote a simple set of Perl scripts to track accesses of his online resume. He chose the C programming language and made the application and source available to everyone. He called the application "Personal Home Page / Forms Interpreter" or PHP/FI.
The new implementation gave users the ability to communicate with databases and make simple dynamic web applications. Over the years, PHP/FI became quite popular and in 1997 the second version of PHP/FI was released. This version incorporated fixes and enhancements from the user community.
The official release date for PHP/FI 2.0 was November 1997 but its life would be short lived because PHP/FI would receive a major overhaul and name change from some new developers. PHP allows developers to write extensions in C to add functionality to the PHP language. PHP extensions can be compiled statically into PHP or loaded dynamically at runtime. Numerous extensions have been written to add support for the Windows API, process management on Unix-like operating systems, multibyte strings , cURL, and several popular compression formats. Some of the language's core functions, such as those dealing with strings and arrays, are also implemented as extensions. The PHP Extension Community Library project is a repository for extensions to the PHP language.
A lot of servers will only serve HTML files by default. More often than not, you will need to install PHP and configure it to work with your web server. If you do not have control over the server that you are uploading your files to, then you will need to contact your hosting provider. On a number of occasions, I've come across lower-end hosting packages that do not support any server-side scripting languages (i.e. HTML-only).
Make sure that this isn't the case with the package that you are using. If you do have control over the server, then you will need to make sure that PHP is properly installed. If you search around, you will find hundreds of tutorials on how to setup PHP and Apache / Nginx to work on Windows, Linux and Macintosh. HTML is the markup language for displaying content and is not processed on the server side.
Php is a programming style language used to create pages that are processed and served from the server. Php files can always read and display HTML code, but HTML does not automatically parse php code. To do so, you will need to make adjustments to your .htaccess file. Once that is done, the php code will display within HTML files without issue. Follow the instructions below as they guide you on enabling html files to display php code via your .htaccess file.
This dialog contains settings for the vulnerable commands which can be found in the HTML files and also the HTML file extensions which should be tested for vulnerabilities. The default vulnerable command rules are "$_GET" and "passthru". These commands pose a potential security threat when used in certain ways. Thus the tool will search and detect these commands in the HTML files.
Commands can be added to the list by selecting the "Add" button next to the command rules list. When "Add" is selected, a dialog box comes up which allows the user to enter in the command name for which to search. In order to remove commands from this list, simply click on the item in the list and then click the "Remove" button next to the "Vulnerable Commands List" window. Additionally, doing this will mean that if someone has a sub-website with other .php files, they will not wok. PHP provides a number of functions for reading and modifying run-time configuration directives.
These can be used in an application to override settings in php.ini. The ability to modify configuration values is useful when you don't have access to PHP's configuration files , when troubleshooting an application, or when running certain tasks . You may need to look for calls to ini_set() in your code if the application isn't behaving as expected. For example, if you set display_errors to 1 in php.ini, but you still don't see error output, chances are it's being overridden somewhere. Detection of vulnerabilities in PHP scripts and PHP daemon configurations are somewhat difficult and cumbersome tasks. For PHP scripts, a certain level of knowledge in PHP scripting is required to detect such vulnerabilities.
Certain commands can be used safely in some contexts but could also be used maliciously or just by mistake by novice PHP scripters. On large web servers with hundreds of pages, the time to search through all the pages could be extensive. As for PHP daemon configurations, there are certain recommended settings and practices used by PHP experts to alleviate risks in PHP which the common system administrator may not know. Thus a tool has been created which recursively searches through HTML for certain PHP vulnerabilities and attempts to determine if the code is structured in such a way that it can be exploited.
This tool also examines the PHP daemon configuration for recommended settings and notifies the user if these settings are incorrect or not present. The following subsections describe the usage of the tool and its design. Normally, you don't necessarily need to use any server side scripting language like PHP to download images, zip files, pdf documents, exe files, etc. If such kind of file is stored in a public accessible folder, you can just create a hyperlink pointing to that file, and whenever a user click on the link, browser will automatically downloads that file. The lower window of the dialog box shows the "File Extensions to Test" which are the file extensions that the vulnerability search will investigate for vulnerabilities. The default extensions are ".html", ".htm", and ".php".
The user can add extensions to this list by clicking the "Add" button next to the "File Extensions to Test" window. File extensions can be deleted by selecting the appropriate file extensions that wish to be deleted and then clicking the "Remove" button next to the "File Extensions to Test" window. PHP, along with most other applications, has problems that are inadvertently put in the source code which may cause the application to be vulnerable to certain attacks. Patches and bug fixes are released to fix the issues, but as development continues on the application, more problems can be introduced. The severity of the issue depends on the type of bug in the software.
The best way to eliminate these bugs is to have the latest version of the software. Another weak validation method that is widely used in file upload forms is to use a blacklist of types of files that have dangerous extensions. Upload forms using this mechanism would check the extension of the file that is being uploaded and compare its file extension to a list of extensions that the application considers harmful.
You even get a simple control panel for starting up your local web server and MySQL database. Those additions are a nice perk, and coupled with how easy it is to install MAMP, you might just want to ditch the default PHP installation and get MAMP going. It is advantageous when some troubleshooting is required from getting out of a stuck situation. Historically, old versions of PHP had some configuration parameters and default values for such runtime settings that made some PHP applications prone to security issues. Support for "magic quotes" and "register globals" settings has been deprecated since PHP 5.3.0, and removed from PHP 5.4.0. PHP has also attracted the development of many software frameworks that provide building blocks and a design structure to promote rapid application development .
Some of these include PRADO, CakePHP, Symfony, CodeIgniter, Laravel, Yii Framework, Phalcon and Laminas, offering features similar to other web frameworks. Basic object-oriented programming functionality was added in PHP 3 and improved in PHP 4. This allowed for PHP to gain further abstraction, making creative tasks easier for programmers using the language.
Object handling was completely rewritten for PHP 5, expanding the feature set and enhancing performance. In previous versions of PHP, objects were handled like value types. The drawback of this method was that code had to make heavy use of PHP's "reference" variables if it wanted to modify an object it was passed rather than creating a copy of it. In the new approach, objects are referenced by handle, and not by value.
Moodle core often loads all the lib.php files of the given plugin types. For the performance reasons, it is strongly recommended to keep this file as small as possible and have just required code implemented in it. All the plugin's internal logic should be implemented in the auto-loaded classes. A common mistake made when securing file upload forms is to only check the MIME-type returned by the application runtime. For example, with PHP, when a file is uploaded to the server, PHP will set the variable $_FILES['uploadedfile']['type'] to the MIME-type provided by the web client. This will block the execution of all PHP scripts within those folders, even if they are named index.php.
By default, the configuration pertaining to errors is found in the following directives within the configuration file php.ini. There might be several different php.ini files on your system depending on how you're running PHP, whether it's on the CLI or behind a web server such as Apache or Nginx. Here's where you can find your php.ini file in common distributions of Linux. PHP code is usually processed on a web server by a PHP interpreter implemented as a module, a daemon or as a Common Gateway Interface executable.
On a web server, the result of the interpreted and executed PHP code – which may be any type of data, such as generated HTML or binary image data – would form the whole or part of an HTTP response. Various web template systems, web content management systems, and web frameworks exist which can be employed to orchestrate or facilitate the generation of that response. Additionally, PHP can be used for many programming tasks outside the web context, such as standalone graphical applications and robotic drone control. PHP code can also be directly executed from the command line.
And just name your script product on the server (without .php file extension). Then you might try this is you're running on Apache 2.4+. This is by design, it ensures that your project does not break because of unexpected changes in dependencies. Each handler does not know about other handlers and only takes information from and sends data back to the Apache core.
The handlers that are called are based on the type of requests made by the client. In this paper, the main point of interest is when a client requests something that requires interpreting PHP code embedded in the website's source HTML. In some instances the PHP scripts will request data from the client. This data is received but not checked by the web server and then passed onto the PHP module that will use it to satisfy the original request made by the client. The next section will discuss how a mischievous client can use this ability to send unchecked data to exploit certain weaknesses within the PHP language.
The Apache Web Server is the most widely used web serving application on the web today and is freely available online . The initial release was sometime in 1994 and was simply called NCSA HTTP daemon. The history is not very well documented during it infancy.
Over the next few months a core group of webmasters added the bug fixes to NCSA HTTP v1.3 and released the first official version of the Apache Web Server in April of 1995. The primary reason for the name was out of respect for the Apache Native American tribe and their resourcefulness and endurance through troubling times. Secondly, it was because it was created from a group of patches or in literal terms "a patchy server" . When image upload only is allowed, most web applications usually validate the image header by using a server-side function such as getimagesize() in PHP. When called, this function will return the size of an image. If the file is not a valid image, meaning that the file header is not that of an image, the function will return FALSE.
