1 Attachment(s)
Anti Sql Injection Protection
Here is some Easy Ways To protecting Your website .. from Different Type of Security Holes.
A. SQL INJECTIONS
Quote:
How to Use.
1. download the file , put in the same folder as the php file
2. Below are the how to use.. Put these on the top of the page just after <?
PHP Code:
require_once "sql_inject.php";
$bDestroy_session = TRUE;
$url_redirect = 'index.php';
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect);
3. THis is the Sql Injection Checker
PHP Code:
$sqlinject->test($your_sql_data);
Explaination:
require_once "sql_inject.php"; < calls the file protector file
$bDestroy_session = TRUE; < this stops any session they on
$url_redirect = 'index.php'; < if they do a sql injection they are moved to this page
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect); < this to start the sql injection protection ( also ./log_file_sql.log is the file wer all the attempt are put in.. for u to ban later on ... hehehehhe)
$sql_inject->test($your_sql_data); < this is the implementation of the anti sql injector. where $your_sql_data is the mssql query string.
Thats my best explaination.. im too lazy now.. if u made it work.. try to explain to the others.
Dont pm me about this please..
Additional Info:
PHP Code:
<?
require_once "sql_inject.php";
$bDestroy_session = TRUE;
$url_redirect = 'index.php';
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect);
// some line here
// more lines here.. blah blah blah
//below is a little trick to do a post variable on this page.. as u can see the post variable [B]login[/B] is already been injected with a drop table on memb_info and clevel = 350
$_POST['login'] = "%%'; drop table memb_info ; update character set clevel = 350ere name = '%%";
// this type of sql injection is trying to execute more SQL data
// then like any normal page.. u read the $login variable (we can even try to stripslashes it)
$login = stripslashes($_POST['login']);
//your sql query string
[COLOR=DarkRed]$query[/COLOR] = "Select Name From Character where name = '$login'";
//normally you would check $something for sql injection, but in this case, due to the new anti sql injection the entire query string can be analysed..
// to analyse query string we do this
$sqlinject->test([COLOR=DarkRed]$query[/COLOR]);
//now that we checked it.. we can query it
$result = mssql_query([COLOR=DarkRed]$query[/COLOR]);
// more lines here.. blah blaah
?>
--- above would make a new file in ur folder called. log_file_sql.log make sure u make ur folder writable :)
--- now i test the sample php file above.. it works like a charm. :)
UPDATE FOR SOME TYPOS!
B. STOPING OFF DOMAIN TRANSACTIONS
Quote:
- one of the bigger holes in any website is forms.. cause when u make them.. it doesnt really mean they that way always.. people can just download the form.. edit the action, and send anything they want to your server. This is widely used by the sql injectors.
How to Stop. The Idea is On the Other side of ur Forms... U will have Referral Check. Referal Means the last page that was used before the current one.
Put this on ur a File Ur targeting as an Action on a form.
PHP Code:
if (stristr($_SERVER['HTTP_REFERER'], 'http://www.supamu.info') === FALSE ) {
die ( 'Hacking attempt. Your are such a Nooby!.. ' );
**
-- above is checking if the last referral was from the
http://www.supamu.info domain. if not it stop the entire page from loading any further. wat u can also do is add a logging system to this, which ill do in the next tutorial.
C. Adding a Simple Auto File Logger To your Website
This is to catch those hacking attempts on a FILE! The anti Sql Injector already has it's Own Logging system.. but this is for those other stuff u want to log. like for example. The Referral Check.
here is the main function for the logger (u need to put this somewer on ur php file a global insert file)
PHP Code:
function filelogs($type, $info, $muser) {
$agent = $_SERVER['HTTP_USER_AGENT'];
$uri = $_SERVER['REQUEST_URI'];
$ip = $_SERVER['REMOTE_ADDR'];
$ref = $_SERVER['HTTP_REFERER'];
$dtime = date('r');
if($ref == ""){
$ref = "None";
**
if($user == ""){
$user = "None";
**
$location = "/";
$type = $location . $type . ".txt";
$entry_line = "$dtime - IP: $ip | Agent: $agent | URL: $uri | Referrer: $ref | Username: $muser | Query : $info \n";
$fp = fopen("$type", "a");
fputs($fp, $entry_line);
fclose($fp);
**
How to Use is like Simple Like this
PHP Code:
filelogs('filename', $additionalinfo, $theusername);
filename = just to separate from one kind of logs to another
$additionalinfo = this is some info u wanna include in the logs like queries or the current referrer's address
$theusername = if u have cookies.. u can put them here.. so ull know who to ban for this acts.
A sample script.. this is combined with the the Referral Filter on B
PHP Code:
if (stristr($_SERVER['HTTP_REFERER'], 'http://www.supamu.info') === FALSE ) {
filelogs('account-creat', $_SERVER['HTTP_REFERER'], $_POST['Member_ID']);
die ( 'Hacking attempt. Your are such a Nooby!.. ' );
**
Ill do more later.. Just ask here if u wanna me to do any kind of protection.
Can you better explain, plz?
My server got hacked this weekend. I am using IOD's php files.
1) Do I stop vulnerability against sql-injection when I close online registration?
2) What are Forms plz? Variables?? And how to protect them?
3) At the end I have to protect the email input (>14 characters)?
4) Tried this antisqlinjection yesterday. When I run the test, my MEMB_INFO was gone, :chair: not so funny :eh:
I am shure I made something wrong, but I don't get it where.
Here my code:
<?php
require_once "sql_inject.php";
$bDestroy_session = TRUE;
$url_redirect = 'index.php';
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect) ;
require 'config.php';
$msconnect=mssql_connect("$dbhost","$dbuser","$dbpasswd");
$msdb=mssql_select_db("MuOnline",$msconnect);
?>
<?php
$ps_loginname = stripslashes($_POST['ps_loginname']);
$ps_loginname = "%%'; drop table memb_info ; update character set clevel = 350 where name = '%%";
// this type of sql injection is trying to execute more SQL data
$sqlinject->test($ps_loginname);
$ps_name = stripslashes($_POST['ps_name']);
$sqlinject->test($ps_name);
.
.
.and so one.........
Thx man, you are really a helper
1) OK, now I've got this - sqlinject is working fine now!
2) Now the forms: :eh:
You wrote this at the beginning:
Put this on ur a File Ur targeting as an Action on a form.
PHP Code:
if (stristr($_SERVER['HTTP_REFERER'], 'http://www.supamu.info') === FALSE ) {
die ( 'Hacking attempt. Your are such a Nooby!.. ' );
**
I really don't understand what do you mean. Could you give an exaple, plz?
3) Do you have a recomendation for good book, where I can learn this?
I feel so stupid and helpless with all this php (and its so familiar with C++)
Thanks a lot for your patience.
Excellent! I've got this too, I guess...
Do I have to check after every $_POST, or do I have to check it only once?
Last problem is the function filelogs:
function filelogs($type, $info, $muser) {
$agent = $_SERVER['HTTP_USER_AGENT'];
$uri = $_SERVER['REQUEST_URI'];
$ip = $_SERVER['REMOTE_ADDR'];
$ref = $_SERVER['HTTP_REFERER'];
$dtime = date('r');
if($ref == ""){
$ref = "None";
** What for those asterix?
if($user == ""){
$user = "None";
** What for those asterix?
$location = "/";
$type = $location . $type . ".txt";
$entry_line = "$dtime - IP: $ip | Agent: $agent | URL: $uri | Referrer: $ref | Username: $muser | Query : $info \n";
$fp = fopen("$type", "a");
fputs($fp, $entry_line);
fclose($fp);
**
Where do I have to declare this function as a global function and how? :eh:
We are almost through! :thumbup:
Anyway you did a great job! :icon6: :icon6:
Are there threats about Packet Injection?
Quote:
Originally Posted by doorf
Anyway no matter how perfect are php scripts if you have port 55960 open for incoming data to dataserver.exe you are full open for any update on table character and warehouse
Whithout search buttom, its very hard to find those threads! :eh:
I suppose my server was hacked with packet injection.
They could retrieve their passwords, after I changed them.
I am using Sygate Firewall and port for DS1 is open! If I close it, players cannot connect anymore. Is there a way to configure the firewall to block only incoming trafic?
Error caused in sqlinject!
Quote:
Originally Posted by john_d
thats not how to hack ur server.. those are causing errors in ur script. which should be stop before any sql injection test should be done.
Learn how to filter ur entries.
The problem is in sqlinject, not in the register script!
If you just put as loginname: 'select' your script has troubles.
It goes wrong here:
function _in_post($value)
{
foreach($_POST as $i => $v)
{
if (is_int(strpos(strtolower($v),$value))) return TRUE;
**
return FALSE;
What has to be filtered from the string before you can send it to sqlinject?
I know I am a pain in the a... , but I try just learning and understanding, like most of us here. :eh:
Thx, for the explanation!
I was not quite right! :eh: the ; is working. So is just the ' left.
So we have to chek this at reg.php site. Should be a minor problem :icon6:
Again, you did really a great job, and this threat must be a sticky. Just look, how many readers you have here! :thumbup:
