5 ms·
An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo(). Authenticating something like th
by i336_ 10y ago
An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo().
Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...)
As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.
- iamjason89 10y agoSince system() PHP function didn't directly work, do you think he would have been able to gain full access as he suggested?
- i336_ 10y agoIt would probably have required a bit of thought, but PHP can access databases, (presumably) alter files, and the like; so while full UNIX shell access might not have been possible, practically speaking PHP could have done a lot of damage on its own.
- lsaferite 10y agoI've seen a colleague use a SHA1 hash as a filename to a phpinfo() script for sites as part of deployment. It's auto-generated for each instance and recorded for later use. While adding some additional layer, like a query param, would be even better, for read-only nature of the script it was deemed acceptable.