13 ms·

If you go to their github page it says the following under security: "On current stage I don't care about login functionality. Put Bike into folder with name li

If you go to their github page it says the following under security: "On current stage I don't care about login functionality. Put Bike into folder with name like 'tASTDKUWYVEjhas' or just use Apache httpauth as workaround." So basically... they have absolutely nothing built in for security, other than hoping you choose a good folder name. Even if you ignore that, this is an all-around poor attempt to be an alternative, let alone compete. UPDATE: Looks like the Bike developer is not trying to be an 'alternative' to phpMyAdmin and whomever made this post either used bad info or think it's an alternative themselves. Either way the guy says it's just supposed to be a lightweight and simple tool... not any sort of alternative. With that said, it's not so bad... but still, security needs to be a higher focus if this thing can access/modify your database.

bigiain 14y ago
"So basically... they have absolutely nothing built in for security …" So I wonder how long before this becomes a trending search query? https://www.google.com.au/search?q=inurl%3A%2Fbike+%22Run+Query%22 https://www.google.com.au/search?q=inurl%3A%2Fbike+%22Run+Qu... (a slightly more refined version of that search, which I'll leave as an exercise for the reader, has already revealed 3 probably exploitable urls, based on the google snippet - I'm not prepared to click the links to confirm…) While I can understand the author writing a tool that scratches his own itch, where that itch doesn't include the need for strong access control for the tool - releasing it in a "default unsafe" configuration seems, ummmm, unwise. I'd suggest perhaps publishing the software with a hardcoded 10..1 ip address as the only address it'll respond to, so that you can't just download and run it with the result of a wide-open access to your databases. If someone's savvy enough to safely use the tool, updating that hardcoded ip address to their own will be obvious, and while opening it up to the world will still be _possible_, at least it'll require some intentional effort.
- justindocanto 14y ago
  i didn't even think of that (the google search). i fear for all the novice developers that use this and do nothing more than just install it and leave it wide open.
iuguy 14y ago
The two simple ways of addressing this are to use some sort of folder level authentication (e.g. htaccess and htpasswd or equivalent) and to make sure it's not referenced in sitemaps or robots.txt, nor linked to from elsewhere on the net.
- justindocanto 14y ago
  Those are nice suggestions and all but I already see one way to abuse this script since it's in the public html folder and pretty much wide open to attack if you can gain access to it. Let's say i see your site has timthumb and it hasn't been updated to the new, more secure, version. Perfect! I'll just use your timthumb to grab your htaccess file and see what folders your hiding. Alright so (theoretically) it looks like you're hiding it under /rj988fh4990j0jgggggf4f thinking I would never know! Clever name, but unfortunately that wasn't enough to stop me from finding it. Next step, since timbthumb can write stuff to a cache folder, thanks to it's wonderful permissions and being able to run things using apache (which has access to your protecte folder)... I'll just copy and/or move your "secret" and "protected" bike folder into the cache folder using a quick php script i plugged into timthumb. Yay! Since Bike can be run pretty much anywhere you put it and just needs to be publically available to use it, now i'm in the clear and i can now access it at /cache/bike. Who needs a shell script when you have timthumb and bike! Let's get SQLing! Granted, this is not going to work for every site using bike since 1) not everybody uses timthumb and 2) a lot of people have updated it and/or have better security than this... but from my experience as a dev a lot of people who use timthumb have no effing clue what theyre doing and are vulernable to these kind of attacks. they know just enough to be dangerous. this app i feel would attract the same crowd who implement scripts like timthumb Personally I dont think this should even exist in the public html folder. it puts you at more risk than it's use justifies. Just to note, as I'm sure this will cross some people's minds... yes, i could gain access to somebodies database config file for say wordpress or joomla just as easy using timbthumb but those typicall dont have a built in interface that lets me run and store queries as i please =P This app needs more security. Update: i just realized i could probably edit the htaccess file if it was writable by apache, using timthumb, in order to disable the protection of the bike folder which would just make accessing it even easier. This just furthers my point that this app needs more security. Depending on 1 simple thing like protecting a folder using your htaccess file is like logging into an account with JUST a password (and no username, no handshake, no api key, no tokens, no nothing).

bigiain 14y ago

"So basically... they have absolutely nothing built in for security …" So I wonder how long before this becomes a trending search query? https://www.google.com.au/search?q=inurl%3A%2Fbike+%22Run+Query%22 https://www.google.com.au/search?q=inurl%3A%2Fbike+%22Run+Qu... (a slightly more refined version of that search, which I'll leave as an exercise for the reader, has already revealed 3 probably exploitable urls, based on the google snippet - I'm not prepared to click the links to confirm…) While I can understand the author writing a tool that scratches his own itch, where that itch doesn't include the need for strong access control for the tool - releasing it in a "default unsafe" configuration seems, ummmm, unwise. I'd suggest perhaps publishing the software with a hardcoded 10..1 ip address as the only address it'll respond to, so that you can't just download and run it with the result of a wide-open access to your databases. If someone's savvy enough to safely use the tool, updating that hardcoded ip address to their own will be obvious, and while opening it up to the world will still be _possible_, at least it'll require some intentional effort.

justindocanto 14y ago
i didn't even think of that (the google search). i fear for all the novice developers that use this and do nothing more than just install it and leave it wide open.

iuguy 14y ago

The two simple ways of addressing this are to use some sort of folder level authentication (e.g. htaccess and htpasswd or equivalent) and to make sure it's not referenced in sitemaps or robots.txt, nor linked to from elsewhere on the net.

justindocanto 14y ago
Those are nice suggestions and all but I already see one way to abuse this script since it's in the public html folder and pretty much wide open to attack if you can gain access to it. Let's say i see your site has timthumb and it hasn't been updated to the new, more secure, version. Perfect! I'll just use your timthumb to grab your htaccess file and see what folders your hiding. Alright so (theoretically) it looks like you're hiding it under /rj988fh4990j0jgggggf4f thinking I would never know! Clever name, but unfortunately that wasn't enough to stop me from finding it. Next step, since timbthumb can write stuff to a cache folder, thanks to it's wonderful permissions and being able to run things using apache (which has access to your protecte folder)... I'll just copy and/or move your "secret" and "protected" bike folder into the cache folder using a quick php script i plugged into timthumb. Yay! Since Bike can be run pretty much anywhere you put it and just needs to be publically available to use it, now i'm in the clear and i can now access it at /cache/bike. Who needs a shell script when you have timthumb and bike! Let's get SQLing! Granted, this is not going to work for every site using bike since 1) not everybody uses timthumb and 2) a lot of people have updated it and/or have better security than this... but from my experience as a dev a lot of people who use timthumb have no effing clue what theyre doing and are vulernable to these kind of attacks. they know just enough to be dangerous. this app i feel would attract the same crowd who implement scripts like timthumb Personally I dont think this should even exist in the public html folder. it puts you at more risk than it's use justifies. Just to note, as I'm sure this will cross some people's minds... yes, i could gain access to somebodies database config file for say wordpress or joomla just as easy using timbthumb but those typicall dont have a built in interface that lets me run and store queries as i please =P This app needs more security. Update: i just realized i could probably edit the htaccess file if it was writable by apache, using timthumb, in order to disable the protection of the bike folder which would just make accessing it even easier. This just furthers my point that this app needs more security. Depending on 1 simple thing like protecting a folder using your htaccess file is like logging into an account with JUST a password (and no username, no handshake, no api key, no tokens, no nothing).