Hacking Prevention

[leke]

I have been lurking here for a while and I have noticed some people
writing about problems with their sites being hacked.

As I am fairly new to this scene so I don't want to fall into
vulnerable coding styles early on or even worse have my first site used
as some type of porthole for spammers.

Can anyone recommend a good book or online resource about web site
hacking prevention. Even something along the lines of how to hack web
sites would also do the job.

Cheers,
L.

[Philip Ronan]

"leke" wrote:

Can anyone recommend a good book or online resource about web site
hacking prevention. Even something along the lines of how to hack web
sites would also do the job.

A good place to start is <http://www.hudzilla.org/phpbook/read.php/17_0_0>,
which seems to cover most of the security issues in PHP.

You should also be very careful with any scripts written by third parties,
and make sure you always have the latest version running. Thousands of
websites were wiped out last year by a worm that exploited a security hole
in the phpBB bulletin board script, for example.

Google will probably give you plenty of other references for common
practices like email header injection, SQL injection, referer spam, and
protecting email addresses.

The Apache module mod_security can deal with many of these problems:
<http://www.modsecurity.org/>

--
phil [dot] ronan @ virgin [dot] net
http://vzone.virgin.net/phil.ronan/

[Dikkie Dik]

I just read "Innocent Code", and I can recommend it.

See: http://innocentcode.thathost.com/

Best regards

leke wrote:

I have been lurking here for a while and I have noticed some people
writing about problems with their sites being hacked.

As I am fairly new to this scene so I don't want to fall into
vulnerable coding styles early on or even worse have my first site used
as some type of porthole for spammers.

Can anyone recommend a good book or online resource about web site
hacking prevention. Even something along the lines of how to hack web
sites would also do the job.

Cheers,
L.

[Chung Leong]

Philip Ronan wrote:

A good place to start is <http://www.hudzilla.org/phpbook/read.php/17_0_0>,
which seems to cover most of the security issues in PHP.

That's not a terribly good resource in my opinion. Everyone who calls
hiding the presence of PHP a form of security measure should look up
"security by obscurity" at Wikipedia. The section on register_globals
misses the bigger issue as well. The fundamental problem is the
reliance on global variables--a poor programming practice in general.

[Philip Ronan]

"Chung Leong" wrote:

Philip Ronan wrote:

A good place to start is <http://www.hudzilla.org/phpbook/read.php/17_0_0>,
which seems to cover most of the security issues in PHP.

That's not a terribly good resource in my opinion. Everyone who calls
hiding the presence of PHP a form of security measure should look up
"security by obscurity" at Wikipedia. The section on register_globals
misses the bigger issue as well. The fundamental problem is the
reliance on global variables--a poor programming practice in general.

Actually I have to agree with you there. I bookmarked the site a long time
ago, but after I posted the link here I went back and read through a few
pages. Let me know if you find a better resource.

--
phil [dot] ronan @ virgin [dot] net
http://vzone.virgin.net/phil.ronan/