I think my PHP application is already hijacked?
I have a php site that allows registered users to login (with a valid passport) and set up a session based on their UserID. However, I'm pretty sure it was hijacked and I found "new" files on my server that I didn't post there. My site is clearing all user data for SQL injection and XSS, but this continues. Anyone got any ideas on how to solve this?
a source to share
Holding on to capture the session cookie should prevent an attacker from creating new files on your server. All it can do is grant access to the authenticated user's session. It depends on your code and / or server configuration, which will allow arbitrary files to be uploaded to the site's website.
To check remote compromise hits, get the creation times of the suspicious files (search.php, 7.php.jpg) etc., then comb your server logs to see what is happening at that time. If you log the session ID along with the rest of the hit, you can trivially see if the session has been hijacked as it will be used from two or more different IP addresses throughout the entire session. It would be especially obvious if the original user was logged in from one ISP and then suddenly there was a switch to a completely different ISP.
And of course, how are your sessions implemented? Biscuit? PHP trans_sid (session passing in hidden forms and query strings)? trans_sid is especially vulnerable to hijacking, since the simple act of exchanging a link is that your site also passes the session ID, and any external links on your site will have a session ID in the HTTP referrer.
a source to share
The solution PHP specialists are faced with is to use unique keys / tokens on every form submission, look at the Idea here on net-tutes .
Don't forget to take a look at the PHP Security Guide. ... It covers topics including XSS, Spoofing, SQL Injection, session hijacking, session fixation, and more.
Remember, always use the correct data types in your queries, for example, use functions int
either intval
before numbers and mysql_real_escape_string
for string values. Example:
$my_num = (int) $_POST['some_number'];
$my_string = mysql_real_escape_string($_POST['some_string']);
You can also use prepend statements for your queries.
Popular project for securing PHP applications:
- XSS filtering features from Christian Stocker (also uses the Kohana Framework )
- HTML cleaner (also used by "Cohana" )
- OSAP PHP Security Project
a source to share
I would say your cookie is easy to guess.
Some sites, when a user signs up, just create a cookie, and the authentication code just checks for EXISTING cookies.
Now if I register and log into your site and then cut your cookie open and notice that you are just storing my user id, then I can manipulate the value for a different user id and voila!
You get the idea.
a source to share