Chris Shiflett wrote:
You might find these resources helpful:
http://education.nyphp.org/phundamentals/PH_spoofed_submission.php
http://shiflett.org/talks/oscon2004/php-security/36
Hope that helps.
Just wanted to chime in to the list and to Chris.
I've been mulling the example in the second link
On Fri, 13 Aug 2004 12:39:07 -0700 (PDT), in php.general
[EMAIL PROTECTED] (Chris Shiflett) wrote:
http://shiflett.org/talks/oscon2004/php-security/36
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby
Peter Brodersen wrote:
http://shiflett.org/talks/oscon2004/php-security/36
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only returns 0-9 and a-f
On Wed, 18 Aug 2004 17:59:34 -0700, in php.general
[EMAIL PROTECTED] (John Holmes) wrote:
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only
--- Peter Brodersen [EMAIL PROTECTED] wrote:
http://shiflett.org/talks/oscon2004/php-security/36
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
That's incorrect. An MD5 is a
On Wed, 18 Aug 2004 15:26:34 -0700 (PDT), in php.general
[EMAIL PROTECTED] (Chris Shiflett) wrote:
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
That's incorrect. An MD5 is a
* Thus wrote Peter Brodersen:
On Wed, 18 Aug 2004 17:59:34 -0700, in php.general
[EMAIL PROTECTED] (John Holmes) wrote:
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only returns 0-9 and a-f characters.
From the manual: http://php.net/md5
string md5 (
--- Peter Brodersen [EMAIL PROTECTED] wrote:
raw_output is set to true, meaning that md5() will not just return a
hexdump of the digest, but a raw binary format, which could contain
quotes and other special characters.
I see your mistake now. That second argument is for the uniqid() function.
On Wed, 18 Aug 2004 15:57:26 -0700 (PDT), in php.general
[EMAIL PROTECTED] (Chris Shiflett) wrote:
I see your mistake now. That second argument is for the uniqid() function.
Have another look and pay close attention to parentheses. :-)
My arch enemy, Parenthesis, we meet again. And I can see
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only returns 0-9 and a-f characters.
From the manual: http://php.net/md5
string md5 ( string
Peter Brodersen wrote:
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that? md5() only returns 0-9 and a-f characters.
From the manual: http://php.net/md5
string md5
--- Gerard Samuel [EMAIL PROTECTED] wrote:
http://education.nyphp.org/phundamentals/PH_spoofed_submission.php
http://shiflett.org/talks/oscon2004/php-security/36
Hope that helps.
Just wanted to chime in to the list and to Chris.
Hi. :-)
I've been mulling the example in the
Peter Brodersen wrote:
On Wed, 18 Aug 2004 17:59:34 -0700, in php.general
[EMAIL PROTECTED] (John Holmes) wrote:
$token = md5(uniqid(rand(), true));
.. is a pretty bad idea, since the output could include quotes,
newlines, low-ascii-characters, thereby messing up the form.
How do you figure that?
Chris Shiflett wrote:
This doesn't provide any benefit that I can see, but I'm ready to admit
that I might be missing something. If the token is captured, the
conditional statement can still be bypassed, because the value of
$some_hidden_key isn't necessary for this at all.
Anyway, I'm a bit
On Fri, 13 Aug 2004 18:57:24 -0400, Gerard Samuel
[EMAIL PROTECTED] wrote:
Chris Shiflett wrote:
You might find these resources helpful:
http://education.nyphp.org/phundamentals/PH_spoofed_submission.php
http://shiflett.org/talks/oscon2004/php-security/36
Hope that helps.
Nobody Special wrote:
With curl I can automate pretty much any web site, you can't tell the
difference between it and somebody using a browser. You are better
off worrying about sanatizing the incoming data then securing the
form. Let your session handling and login stuff take care of that.
[snip]
I've read (at least on 2 occasions) that one can secure their forms, to
ensure that the form came from the site, and not via a script kiddie.
Not the method where one puts a graphic of random text to copy to the
form, but via a hidden field.
It has to do with having a hidden field of data,
On Friday 13 August 2004 02:57 pm, Gerard Samuel wrote:
I've read (at least on 2 occasions) that one can secure their forms, to
ensure that the form came from the site, and not via a script kiddie.
Not the method where one puts a graphic of random text to copy to the
form, but via a hidden
--- Jay Blanchard [EMAIL PROTECTED] wrote:
[snip]
I've read (at least on 2 occasions) that one can secure their forms, to
ensure that the form came from the site, and not via a script kiddie.
Not the method where one puts a graphic of random text to copy to the
form, but via a hidden field.
* Thus wrote Gerard Samuel:
I've read (at least on 2 occasions) that one can secure their forms, to
ensure that the form came from the site, and not via a script kiddie.
Not the method where one puts a graphic of random text to copy to the
form, but via a hidden field.
It has to do with
On Fri, 13 Aug 2004 15:36:34 -0400, James E Hicks III
[EMAIL PROTECTED] wrote:
On Friday 13 August 2004 02:57 pm, Gerard Samuel wrote:
I've read (at least on 2 occasions) that one can secure their forms, to
ensure that the form came from the site, and not via a script kiddie.
Not the method
Chris Shiflett wrote:
You might find these resources helpful:
http://education.nyphp.org/phundamentals/PH_spoofed_submission.php
http://shiflett.org/talks/oscon2004/php-security/36
Hope that helps.
Thanks. These are doable..
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit:
23 matches
Mail list logo
