Re: [Full-disclosure] How to protect RFI ??

On 26/05/07, Mark Sec <mark.sec@xxxxxxxxx> wrote:


does any1 how to protect about RFI (Remote file inclusion), and what i need
to see over php files ?

-mark

Briefly:
1. Secure your php install - turn off allow_url_fopen and
allow_url_include in php.ini
2. Make sure your PHP app is not vulnerable - an attacker shouldn't be
able to control what's included. This should protect you from local
file inclusion as well.
3. Use suhosin and/or mod_security
4. (maybe) configure your firewall to disallow outbound connections
initiated by the webserver

cheers,
Jamie

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Problem with HTTP Auth
    ... and one php index page with links to the files. ... another solution is that i do not user http auth, protect the php vom ... be okay if other browsers work "normally". ... then check to see if a matching entry in the rewrite map. ...
    (comp.lang.php)
  • Re: password-protection
    ... > password-protected a website by including a password authentication script ... The script checks the login against the ... have used to protect HTML and other downloadable files (e.g., ... PHP script (which can reach into other directories besides the ...
    (comp.lang.php)
  • Re: How to keep passwords secure
    ... I did just that and I created an .htaccess file in the directory to ... allow apache to protect it. ... PHP will occasionally break ... That would be a pretty serious bug in Apache. ...
    (comp.lang.php)
  • Re: can badly coded PHP cause server problems?
    ... Most servers has memory usage limit oper user to protect again these kind of ... PHP also has config for fopento limit user to his dorectory, ...
    (comp.lang.php)
  • PHP header and HTTP auth problem
    ... i have a problem concerning a php script i worte some time ago. ... there are pdf and other downloadable files there ... another solution is that i do not user http auth, protect the php vom ... be okay if other browsers work "normally". ...
    (php.general)