From: Brad Lhotsky (lhotskybmail.nih.gov)
Date: Tue Oct 17 2006 - 10:01:27 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Well, it's good to hear that you're the one doing the pentesting.
However, the MagicQuotes does not solve the problem, it bandaids it.
The problem is bad programming, and regardless of the Magic Quotes, if
the programmers developing the app are writing code like that, the
chances are, Magic Quotes isn't going to take it from "insecure" to
"Secure", it'll just slide it ever so trivially closer to "secure".

Rest assured, that there will be projects like Hardened-PHP and
mod_security that will work with PHP6 to bandaid fix most common
programmer errors. It's those interesting logic problems that people
who write "Select * from table where field=$value" introduce that will
ultimately leave the app insecure and open to attack.

DokFLeed wrote:
> Hi,
> I think you got my email wrong, this code isn't what I wrote, this code
> is a sample of a careless programmer who does not care about security
> issues, and fairly weak in development itself, however, you can not
> compromise his server because it has magic quotes on.
> I have done lots of pen-testing and came across many websites, that even
> if they are hacked, the server is saved because of magic quotes.
> I hope that explains my argument.
>
> so let me put it this way, since the discussion moved from the How to Why.
> with a vulnerable weak code like that, and magic quotes are on, how can
> you get access to the server, knowing that you can inject to SELECT,
> INSERT statements , again with magic quotes on!
>
> cheers
> DokFLeed
>
>
> ----- Original Message ----- From: "Brad Lhotsky"
> <lhotskybgrc.nia.nih.gov>
> To: "DokFLeed" <dokfleeddokfleed.net>
> Cc: <webappsecsecurityfocus.com>; "Steve Slater"
> <slaterhandsonsecurity.com>
> Sent: Tuesday, October 17, 2006 1:21 AM
> Subject: Re: Magic Quotes
>
>

--
Brad Lhotsky <lhotskybgrc.nia.nih.gov>
NCTS Computer Specialist
Phone: 410.558.8006
"Freedom, Privacy, Security. Choose Two."

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web
application security assessment tools by both Gartner and IDC. Download a
free trial of AppScan today and see why more customers choose AppScan
then any other solution.

https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008YTO
--------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]