Re: testing compiled php

["crazy frog crazy frog" <i.m.crazy.frog () gmail com>]

Hi,
there are few websites which claims to decode the encrypted php files
but they wil charge you some amount.they also have a demo option which
u can use.
another thing is tht mysql does not need to be run as root and whole
root directory does needs to be writable.
regards,
-CF
http://www.secgeeks.com

On 8/19/06, Robin Wood <dninja () gmail com> wrote:
> Hi
> I've been asked to install a compiled php app on a server I manage and
> I'm not happy with the way it has been built so I'm looking for a way
> to do check through the code but, as it is compiled I can't just view
> it.
>
> Is there an easy way to decompile php? I've had a google and found a
> couple of services offering to decompile individual pages but nothing
> for full sites.
>
> I'm not sure what compiler was used but this app requires the zend
> optimizer to run.
>
> Things I'm not happy about:
> Needs full write access to the whole of its web root, it seems to
> create files and directories all over the place.
> Needs almost root mysql access, the only thing it doesn't need is
> grant privileges! It created databases when you add new data into the
> site.
> I've found XSS on the authors site and on this app - I've reported
> this to the author who after claiming to be big on security asked me
> to explain XSS and still hasn't fixed the problem a few weeks later.
>
> I've got permission to test the app but I'm not being paid for it so
> I'd much rather do a code review than full test on each page, that way
> I can patch anything I find or make other provisions to protect from
> the problem.
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire was recently named the worldwide market leader in Web
> application security assessment tools by both Gartner and IDC.
> Download a free trial of AppScan today and see why more customers choose
> AppScan then any other solution. Try it today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
> --------------------------------------------------------------------------


--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
"oh yeah oh yeah...
another wannabe, in hackerland!!!"

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. 
Download a free trial of AppScan today and see why more customers choose 
AppScan then any other solution. Try it today!
 
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------