[nyphp-talk] Is anyone using a web application security solution?

In a recently sql injection thread, someone mentioned modsecurity and php-ids as quick Bandaids. Is anyone using a web application security front-end in production? The one¹s I¹m aware of: http://www.modsecurity.org/ http://php-ids.org/ http://www.binarysec.com/ http://www.applicure.com/ Though

[nyphp-talk] Anybody knows how to compile Inclued 0.3?

Hey! While searching for some special bugs in APC I found this nice tool: http://t3.dotgnu.info/blog/php/inclued-0.3.html. I then downloaded it, but had no success in compiling it. The INSTALL file actually contains this line: "(fill in details about compiling it)" :) So it would be nice if

[nyphp-talk] Trimming Posts WAS: Injection Attack, any ideas?

All, Please remember to trim your posts and subjects (and don't top-post like I just did :) Thanks, --- Hans Zaunere / President / New York PHP www.nyphp.org / www.nyphp.com [EMAIL PROTECTED] wrote on Wednesday, November 07, 2007 12:40 AM: > Hello Jake, > > Wednesday, November 7, 200

Re: Re[2]: [nyphp-talk] Injection Attack, any ideas?

You might want to log all the submitted POST data for a few days in case the spam spider comes around again. Add something like this to the start of your script: $fp=fopen('/tmp/'.time().'-'.uniqid().'-'.$_SERVER['REMOTE_ADDR'],'w'); fputs($fp,print_r($_REQUEST,TRUE)); fclose($fp); ~Rolan On Nov

Re: [nyphp-talk] Injection Attack, any ideas?

[EMAIL PROTECTED] wrote: First how did that bad guy "execute" the query without hitting the submit button or entering the captcha code and how did it bypass the check function. Your running queries before you do your captcha check in your code. if (!isset($_POST['securityImageValue']) || !iss

Re[2]: [nyphp-talk] Injection Attack, any ideas?

Hello David, Wednesday, November 7, 2007, 8:08:27 PM, you wrote: > [EMAIL PROTECTED] wrote: >> >> Here is the URL : http://cl1p.net/myexploitedcode/ >> >> thanks, mikesz > I am definitely not the code fashion police here, but I have quite some > problems to figure out what the code does and f

Re[2]: [nyphp-talk] Injection Attack, any ideas?

Hello David, Thanks for the tips. I was able to correlate the timestamp of the error message and the bad guys IP address. The are using a POST to do the injection. -- Best regards, mikeszmailto:[EMAIL PROTECTED] ___ New Yo

Re: [nyphp-talk] Injection Attack, any ideas?

[EMAIL PROTECTED] wrote: Here is the URL : http://cl1p.net/myexploitedcode/ thanks, mikesz I am definitely not the code fashion police here, but I have quite some problems to figure out what the code does and from where it gets stuff. Some more comments other than a sequence of dashes make

Re: [nyphp-talk] Injection Attack, any ideas?

[EMAIL PROTECTED] wrote: The question is, actually multiple related questions: First how did that bad guy "execute" the query without hitting the submit button or entering the captcha code and how did it bypass the check function. It seems like the query was sent directly to the database though

Re: [nyphp-talk] Injection Attack, any ideas?

For future reference, can you please snip quoted text to only the relevant bits. ___ New York PHP Community Talk Mailing List http://lists.nyphp.org/mailman/listinfo/talk NYPHPCon 2006 Presentations Online http://www.nyphpcon.com Show Your Participati