Hackish PHP Pranks and Tricks

by Flenov, Michael

• ISBN13: 9781931769525
• ISBN10: 1931769524
• Edition: CD
• Format: Paperback
• Copyright: 2006-02-01
• Publisher: A-List Pub

Summary

Concentrating on PHP script programming, this book considers Web security and optimization from the hacker's point of view. The many utilities used by hackers and written with PHP, examples of secure applications and algorithms for scripts, new ways of writing real hacking programs for the Web and nonstandard PHP programming techniques and possibilities. Programmers will also learn what tricks to expect from a hacker and how to create the most effective protection system possible are all discussed in detail.

Author Biography

Michael Flenov is the author of Hackish C++ Pranks & Tricks and Hackish PC Pranks & Cracks.

Table of Contents

Introduction	1	(6)
Acknowledgments	3	(1)
Book Structure	3	(4)
Chapter 1: Hackers and PHP	7	(18)
1.1. Who Are Hackers?	7	(3)
1.2. How Do You Become a Hacker?	10	(5)
1.3. What Is PHP?	15	(1)
1.4. How Does PHP Work?	16	(3)
1.5. Server and Client Technologies	19	(1)
1.6. Installing PHP	20	(5)
Chapter 2: PHP Basics	25	(98)
2.1. PHP Commands	26	(5)
2.2. Connecting Files	31	(5)
2.3. Printing	36	(1)
2.4. Coding Conventions	36	(12)
2.4.1. Comments	37	(1)
2.4.2. Sensitivity	38	(2)
2.4.3. Variables	40	(4)
2.4.4. Main Operations	44	(2)
2.4.5. Scope	46	(1)
2.4.6. Constants	47	(1)
2.5. Controlling Program Execution	48	(11)
2.6. Loops	59	(7)
2.6.1. The for Loop	59	(3)
2.6.2. The while Loop	62	(1)
2.6.3. Endless Loops	63	(1)
2.6.4. Controlling Loops	64	(2)
2.7. Terminating Programs	66	(1)
2.8. Functions	67	(5)
2.9. Main Functions	72	(5)
2.9.1. The substr Function	72	(1)
2.9.2. The strlen Function	73	(1)
2.9.3. The strpos Function	74	(2)
2.9.4. The preg_replace Function	76	(1)
2.9.5. The trim Function	77	(1)
2.10. Arrays	77	(2)
2.11. Handling Errors	79	(1)
2.12. Transmitting Data	80	(12)
2.12.1. Environmental Variables	80	(1)
2.12.2. Passing Parameters	81	(3)
2.12.3. The GET Method	84	(3)
2.12.4. The POST Method	87	(2)
2.12.5. Parameter Vulnerability	89	(2)
2.12.6. Hidden Parameters	91	(1)
2.13. Storing User Parameters	92	(12)
2.13.1. Sessions	93	(5)
2.13.2. Cookies	98	(5)
2.13.3. Cookie Security	103	(1)
2.14. Files	104	(19)
2.14.1. Opening Files	105	(1)
2.14.2. Closing Files	106	(1)
2.14.3. Reading Data	106	(3)
2.14.4. More File-Reading Functions	109	(1)
2.14.5. Writing Data	110	(1)
2.14.6. Positioning in Files	111	(2)
2.14.7. File Properties	113	(2)
2.14.8. Managing Files	115	(1)
2.14.9. Managing Directories	116	(1)
2.14.10. Reading Directories	117	(6)
Chapter 3: Security	123	(86)
3.1. Complex Defense	123	(7)
3.2. Access Rights	130	(7)
3.2.1. Script Rights in the System	130	(1)
3.2.2. Database Server Access Rights	130	(2)
3.2.3. Remote Connection Rights	132	(1)
3.2.4. Script File Access Permissions	133	(1)
3.2.5. Strong Passwords	134	(1)
3.2.6. Search Systems	135	(2)
3.3. How Scripts Are Cracked	137	(5)
3.4. Script Protection Fundamentals	142	(8)
3.4.1. A Real-Life Error	143	(4)
3.4.2. Security Recommendations	147	(2)
3.4.3. Tuning PHP	149	(1)
3.5. Checking Data Validity	150	(6)
3.6. Regular Expressions	156	(14)
3.6.1. PHP Regular Expression Functions	157	(1)
3.6.2. Using PHP Regular Expressions	158	(6)
3.6.3. Using Perl Regular Expressions	164	(3)
3.6.4. Perl Regular Expression Functions	167	(2)
3.6.5. Summary	169	(1)
3.7. Data to Filter and Filtering Methods	170	(3)
3.8. Databases	173	(16)
3.8.1. Database Fundamentals	173	(2)
3.8.2. SQL-Injection Attack	175	(9)
3.8.3. SQL File Operations	184	(1)
3.8.4. Safe Database Practices	185	(3)
3.8.5. False Protection	188	(1)
3.9. File Operations	189	(1)
3.10. Cryptography	190	(5)
3.10.1. Symmetric Encryption	190	(2)
3.10.2. Asymmetric Encryption	192	(1)
3.10.3. Irreversible Encryption	193	(1)
3.10.4. Encryption Practices	193	(2)
3.11. Cross-Site Scripting Attack	195	(1)
3.12. Flood Attack	196	(3)
3.12.1. Protecting against Flooding	196	(1)
3.12.2. Protecting against Vote Padding	197	(2)
3.13. Defacing	199	(2)
3.14. Keeping Logs	201	(1)
3.15. Unauthorized Changes	202	(1)
3.16. The Administrator Panel	202	(2)
3.17. The Dangerous REQUEST_URI Variable	204	(1)
3.18. Summary	204	(5)
Chapter 4: Optimization	209	(28)
4.1. Algorithm	210	(1)
4.2. Weak Spots	211	(2)
4.3. Databases	213	(12)
4.3.1. Optimizing Queries	213	(6)
4.3.2. Optimizing Databases	219	(1)
4.3.3. Selecting Necessary Data	220	(2)
4.3.4. Becoming on a First Name Basis with the System	222	(2)
4.3.5. Optimizing the Server	224	(1)
4.4. Optimizing PHP	225	(6)
4.4.1. Buffering Output	225	(1)
4.4.2. Buffering Pages	226	(3)
4.4.3. Fast Functions	229	(2)
4.5. Optimization versus Security	231	(6)
Chapter 5: Working with PHP	237	(62)
5.1. Uploading Files to the Server	237	(6)
5.2. Checking File Content	243	(3)
5.3. Forbidden Area	246	(24)
5.3.1. Web Server Authentication	246	(7)
5.3.2. Using Apache Access Rights to Secure Scripts	253	(1)
5.3.3. Custom Authentication Systems	254	(9)
5.3.4. Registration	263	(5)
5.3.5. Strong Passwords	268	(2)
5.3.6. Protecting the Connection	270	(1)
5.4. Authorization	270	(2)
5.5. Network Operations	272	(7)
5.5.1. Domain Name System Operations	272	(1)
5.5.2. Protocols	273	(1)
5.5.3. Sockets	274	(5)
5.6. Port Scanners	279	(3)
5.7. A Low-Level File Transfer Protocol Client	282	(4)
5.8. A Ping Utility	286	(3)
5.9. Email	289	(6)
5.9.1. Simple Mail Transfer Protocol	290	(2)
5.9.2. The mail Function	292	(2)
5.9.3. Connecting to the Simple Mail Transfer Protocol Server	294	(1)
5.9.4. Email Service Security	295	(1)
5.10. Protecting Links	295	(1)
5.11. PHP and Hackers	296	(3)
Conclusion	299	(2)
Bibliography	301	(2)
Appendix 1: Structured Query Language Fundamentals	303	(6)
Selecting Data	305	(4)
Manipulating Data	309	(1)
Appendix 2: The CD-ROM Description	309	(2)
Index	311