Software Vulnerabilities and Defensive Coding

Common Software Vulnerabilities and Controls

• Common software vulnerabilities include:
  • Buffer, Stack, and Heap Overflows
  • Injection Flaws
  • Broken Authentication and Session Management
  • Cross-Site Scripting (XSS)
  • Non-Persistent or Reflected XSS
  • Persistent or Stored XSS
  • DOM based XSS
  • Cross-Site Request Forgery (CSRF)
  • Insecure Direct Object References
  • Security Misconfiguration
  • File Attacks
  • Side Channel Attacks

Defensive Coding Practices

• Defensive coding practices include:
  • Input Validation
  • Canonicalization
  • Sanitization
  • Error Handling
  • Safe APIs
  • Memory Management
  • Exception Management
  • Session Management
  • Configuration Parameters Management
  • Secure Startup
  • Cryptography
  • Concurrency
  • Tokenization
  • Sandboxing
  • Anti-Tampering

SQL Injection Vulnerability Example

• PHP code directly concatenates user inputs which makes the SQL query vulnerable to injection.

SQL Injection Attack Types

• The following inputs lead to a successful SQL injection attack against vulnerable code:
  • ' ; DROP TABLE products; #
  • 100 OR 1=1
  • apple

SQL Injection Mitigation

• PHP code can be fixed by using parameterized queries to avoid direct insertion of user inputs.

Code Injection Definition

• Code injection involves the attacker injecting code in the programming or scripting language used by the application
• Languages commonly injected into are PHP, Python, or JavaScript.

Vulnerable PHP Functions

• PHP functions that are particularly vulnerable to code injection:
  • eval()
  • include()
  • require()
  • include_once()
  • require_once()
  • preg_replace()
  • assert()

Code Injection Functions

• eval(): Evaluates a string as PHP code and is rarely needed.
• include(), require(), include_once(), require_once(): Used to include and execute files.
• preg_replace(): Used for regular expression search and replace, evaluates the replacement as PHP code if used with the /e modifier.
• assert(): Evaluates a string as PHP code if a condition is false, used for debugging.

Code Injection Prevention Methods

• Avoid using dangerous PHP functions like eval(), assert(), and preg_replace() with the /e modifier.
• Employ safe methods for dynamic content.
• Avoid the /e modifier in preg_replace(). Use preg_replace_callback() instead.

Code Injection Prevention Techniques

• htmlspecialchars() should be used to avoid code injections
• preg_replace_callback() should be used instead of preg_replace()
• It is best to avoid using preg_replace('/e')

Code Injection Via Directory Traversal

• Attackers use directory traversal (../../) to access a different directory
• This method allows them to upload a file containing harmful PHP code to the server.

Code Injection Prevention Strategy

• Use whitelisting over blacklisting.
• Sanitize and validate inputs

Code Injection Questions

• The primary reason to avoid using preg_replace('/e') in PHP is it allows evaluation of PHP code from user input, leading to code injection vulnerabilities.
• Code injection using the include() function can be prevented by validating that the function only includes safe characters and paths, and restrict it to known filenames.

Command Injection Definition

• Command injection involves the attacker executing arbitrary system commands on the host OS via the vulnerable application
• Often system shell commands are called

Functions Vulnerable to Command Injection in PHP

• Vulnerable functions include:
  • exec()
  • system()
  • shell_exec()
  • passthru()
  • popen()
  • proc_open()
  • backticks `` `

Command Injection Vulnerability Example

• Using shell_exec() along with the grep command, an attacker injected cat /etc/passwd command to view sensitive system files.
• Improper handling of user input in an application that performs network diagnostics allows attackers to inject OS commands.

Command Injection Prevention

• Always validate and sanitize inputs using functions like escapeshellarg() and escapeshellcmd().
• Avoid using user input directly in commands
• Apply proper input checks
• Use safer alternatives such as PHP functions.
• Minimize privileges in running commands.

Command Injection Prevention With PHP Built-In Functions

• Use scandir() or glob() instead of ls for directory listings
• Use unlink() instead of rm for file deletion
• Use copy(), rename(), and move_uploaded_file() instead of cp or mv for file operations
• Employ file_put_contents(), file_get_contents(), and fopen() instead of cat or echo for reading and writing files
• To check server connectivity employ PHP functions like:
  • fsockopen()
  • stream_socket_client()
  • cURL instead of system("ping $host")

Harmful PHP Code in Command Injections

• Passing the following inputs in PHP code would be dangerous in command injections:
  • ; rm -rf /

Command Injection Attacks

• The most susceptible PHP function to command injection attacks is exec()

Command Injections Risks

• A dangerous consequence of using the exec() function in PHP without proper input validation is an attacker could control the server.

Command Injection Mitigation Tips

• Mitigate command injection vulnerabilities by restricting input to a whitelist of allowed commands and using escapeshellarg() or escapeshellcmd().

Explore common software vulnerabilities like XSS and SQL injection. Learn defensive coding practices including input validation and secure APIs to mitigate risks. Understand techniques for secure software development.