WebApp Sec mailing list archives
testing compiled php
From: "Robin Wood" <dninja () gmail com>
Date: Fri, 18 Aug 2006 20:18:17 +0100
Hi I've been asked to install a compiled php app on a server I manage and I'm not happy with the way it has been built so I'm looking for a way to do check through the code but, as it is compiled I can't just view it. Is there an easy way to decompile php? I've had a google and found a couple of services offering to decompile individual pages but nothing for full sites. I'm not sure what compiler was used but this app requires the zend optimizer to run. Things I'm not happy about: Needs full write access to the whole of its web root, it seems to create files and directories all over the place. Needs almost root mysql access, the only thing it doesn't need is grant privileges! It created databases when you add new data into the site. I've found XSS on the authors site and on this app - I've reported this to the author who after claiming to be big on security asked me to explain XSS and still hasn't fixed the problem a few weeks later. I've got permission to test the app but I'm not being paid for it so I'd much rather do a code review than full test on each page, that way I can patch anything I find or make other provisions to protect from the problem. Robin ------------------------------------------------------------------------- Sponsored by: WatchfireWatchfire was recently named the worldwide market leader in Web application security assessment tools by both Gartner and IDC. Download a free trial of AppScan today and see why more customers choose AppScan then any other solution. Try it today! https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------
Current thread:
- testing compiled php Robin Wood (Aug 18)
- Re: testing compiled php Attila-Mihaly Balazs (Aug 20)
- Re: testing compiled php Robin Wood (Aug 21)
- Re: testing compiled php crazy frog crazy frog (Aug 20)
- Re: testing compiled php Robin Wood (Aug 21)
- Re: testing compiled php Attila-Mihaly Balazs (Aug 20)