Não confiar em ninguém !
- FIEO (Filter Input, Escape Output)
- Filtrar Input
- Dados entram válidos?
- Filtrar Output
- Dados que saem são seguros!
- Filtrar Input
<?php
foreach($_GET as $key=>$value) {
if( $key == 'Telefone' ) {
echo (preg_match("/^[0-9]{9}$/i", $value)) ? 'ok' : 'bad';
} else if ($key == 'Email' ) {
echo (preg_match("/^([a-z0-9\+_\-]+)(\.[a-z0-9\+_\-]+)*@([a-z0-9\-]+\.)+[a-z]{2,6}$/ix", $value)) ? 'ok' : 'bad';
} else if( $key == 'Username' ) {
echo (preg_match("/^([-a-z0-9_-])+$/i", $value)) ? 'ok' : 'bad';
}
}
?>
if( $idade > 0 and $idade < 120 ) { /* code */
$query = "... AND `idade` = '$idade'";
} else die('buh');Mais seguro:
$idade < '120' //$idade < 120Ver Código
<?php
//connect to the database
$db = mysql_connect( $dbHost, $dbUser, $dbPass ) or die ( 'Error connecting to database.' );
mysql_select_db( $dbDatabase, $db ) or die ( 'Couldn\'t select the database.' );
$login = $_GET['user'];
$pass = $_GET['password'];
$result=mysql_query( "select * from teste where login='$login' AND password='$pass'", $db );
//check that at least one row was returned
echo urldecode( $_SERVER['REQUEST_URI'] );
$rowCheck = mysql_num_rows( $result );
if( $rowCheck > 0 ){
while( $row = mysql_fetch_array( $result ) ){
//start the session and register a variable
//successful login code will go here...
echo '<br/>Wellcome to InsecureApp!';
echo '<br/>Account Settings';
echo '<br/>username:password<br/>';
echo $row[0] . ':' . $row[1] . '<br/>';
}
} else { //if nothing is returned by the query, unsuccessful login code goes here...
echo '<br />Incorrect login name or password. Please try again.';
}
echo "<a href='".$_SERVER['HTTP_REFERER']."'>Voltar Atrás";
Procedimento Correcto:
SELECT * FROM users WHERE `login`='$_POST["user"]' AND `password`='$_POST["password"]'Request: url/?user=' or 1=1 --&password=codebits
SELECT * FROM users WHERE `login`='' OR 1=1 --Ups... Ver Código
<?php
/*
$csrf_protect = new CSRFProtect();
$csrf_protect->enable();
*/
class CSRFProtect {
var $csrf_field = '_csrf_token';
function gen_token( ) {
return sha1( session_id( ) );
}
function error( $msg ) {
die( 'Logged' );
/* implement log using the $msg */
}
function to_protect( ) {
// Only protect if the user has a session
$session_id = session_id( );
if ( empty( $session_id ) ) return false;
return true;
}
function enable( ) {
if ( !$this->to_protect( ) ) return;
$csrf_token = $this->gen_token( );
// If it's a POST, check the token matches
if ( !empty( $_POST ) ) {
$form_token = $_POST[$this->csrf_field];
if ( $form_token != $csrf_token ) {
$this->error( "$form_token != $csrf_token" );
return;
}
}
// On POST or GET, we still need to add the token to any forms
ob_start( array( $this, 'ob_callback' ) );
}
function ob_callback( $html ) {
$token = $this->gen_token( );
$hidden = '<div style="display: none;"></div>';
$hidden .= '<input type="hidden" name="';
$hidden .= $this->csrf_field . '" value="' . $token;
$hidden .= '"/>');
$hidden .= '</div>';
return preg_replace('/(<form\W[^>]*\bmethod=(\'|"|)POST(\'|"|)\b[^>]*>)/i','\\1'.$hidden, $html);
}
}
?>
- random token para cada pedido
- ^ guardados em sessão (server side)
- e em hidden fields no formulários
- é só comparar valores
- vulnerabilidades XSS estragam tudo
O que se faz no Codebits enquanto espera pelo SecurityContest part2 ?
Karaoke, Guitar Hero,... e que tal desenvolver um filtro para CSRF ?