| 01:00.19 | *** join/#uphpu Lone_Wanderer (n=Dan@wsip-70-167-207-68.ph.ph.cox.net) |
| 01:00.23 | *** mode/#UPHPU [+v Lone_Wanderer] by ChanServ |
| 01:16.44 | *** join/#uphpu _psychic_ (n=_psychic@raisinbread.fttp.xmission.com) |
| 01:16.44 | *** mode/#UPHPU [+v _psychic_] by ChanServ |
| 01:27.06 | mindjuju | wow, an unsolicited feelski will get you 1 - 15 years -- http://www.sltrib.com/news/ci_13553967?source=rss |
| 01:32.47 | Lone_Wanderer | Man, I'm going to have to stop grabbing the breasts of every cute girl I walk past. |
| 01:32.58 | mindjuju | :) |
| 01:33.40 | Lone_Wanderer | Man I don't know why she complained. He sounds like a fantastic guy who's just misunderstood. |
| 01:34.53 | mindjuju | heh |
| 01:36.48 | mindjuju | i know this may sound bad, but i'm not sure a feelski is worth a year in prison. i think it's worth being taken out back and roughed up + kick in the crotch by the girl, but a year? |
| 01:37.51 | herlo | it's the law these days. It's all messed up |
| 01:38.17 | herlo | murderers get 6months |
| 01:38.23 | mindjuju | i mean, i could even see giving the girl a pair of doc martins and giving her 10 feet running before the flying ninja kick to nuts |
| 01:39.51 | Lone_Wanderer | I think that's going too far. |
| 01:39.56 | Lone_Wanderer | A bit of roughing up would do it. |
| 01:40.37 | mindjuju | yup |
| 01:42.08 | optikal | mindjuju: Hey, who was the biker dude at UTOSC? Reddish hair, glasses, kinda short? |
| 01:42.13 | Lone_Wanderer | HarleyPig? |
| 01:42.20 | DexterTheDragon | bmac2 |
| 01:42.25 | optikal | Sounds like the kind of name he'd have... |
| 01:42.51 | Lone_Wanderer | It also sounds like how I've heard HarleyPig described but honestly I've never met him. |
| 01:42.59 | mindjuju | optikal, biker dude is bmac2 |
| 01:43.09 | optikal | http://www.flickr.com/photos/nearn/2812294971/in/set-72157607030769442/ |
| 01:43.10 | optikal | That guy |
| 01:43.19 | mindjuju | yup |
| 01:43.21 | mindjuju | that's barry |
| 01:43.29 | optikal | werd, thanks. Need to talk to him about a rack he said he had for slae. |
| 01:43.30 | optikal | *sale. |
| 01:44.03 | mindjuju | he's ususally in #utos, but he's ont there now |
| 01:44.21 | mindjuju | if you PM me your email addy i'll introduce and ask him to contact you |
| 01:44.28 | optikal | werd, I'll keep an eye out for him. Thanks |
| 01:44.31 | optikal | aah oke, I'll do that too. |
| 02:01.09 | *** join/#uphpu _psychic_ (n=_psychic@raisinbread.fttp.xmission.com) |
| 02:01.09 | *** mode/#UPHPU [+v _psychic_] by ChanServ |
| 02:49.54 | *** join/#uphpu Utah_Dave (n=David@12.51.53.162) |
| 02:49.54 | *** mode/#UPHPU [+o Utah_Dave] by ChanServ |
| 02:58.02 | *** join/#uphpu mindjuju (n=mindjuju@mail.billgood.us) |
| 02:58.02 | *** mode/#UPHPU [+o mindjuju] by ChanServ |
| 03:09.40 | *** join/#uphpu justincarmony_ (n=justinca@c-98-202-44-233.hsd1.ut.comcast.net) |
| 03:09.40 | *** mode/#UPHPU [+v justincarmony_] by ChanServ |
| 03:24.43 | *** join/#uphpu wps (n=wps@208.53.47.251) |
| 03:24.43 | *** mode/#UPHPU [+o wps] by ChanServ |
| 03:34.44 | *** part/#uphpu queensmetro (n=DontSpam@user-387h7sc.cable.mindspring.com) |
| 03:57.20 | macnewbold | okay, here's a fun database question for you all |
| 03:57.27 | Utah_Dave | ok |
| 03:57.40 | macnewbold | i have a table that has rows with an upper limit on the number of days, and a value |
| 03:58.11 | macnewbold | i.e. up to 60 days, value is 10, up to 150 days, value is 8, up to 270 days value is 6 |
| 03:58.17 | macnewbold | i need to join against that table |
| 03:58.39 | macnewbold | making a row with a days value of 261 join against 270 |
| 03:58.57 | macnewbold | i.e. the lowest number that is greater than my days value |
| 03:59.19 | macnewbold | it sounds kind of like a subquery, but i keep thinking it ought to be possible with a join |
| 03:59.31 | macnewbold | i've got it pulling _all_ the rows >= my limit |
| 03:59.56 | macnewbold | but need to reduce it down now to just the one value for each row I'm examining |
| 03:59.59 | macnewbold | hm |
| 04:00.47 | Utah_Dave | Hmm. Fun question |
| 04:01.30 | macnewbold | aha |
| 04:01.43 | macnewbold | with the right group by, I can get it to use the min or the max of the values from that table |
| 04:04.48 | Utah_Dave | nice |
| 04:24.06 | *** join/#uphpu Jacolyte (n=blaine@unaffiliated/jacolyte) |
| 04:26.47 | *** join/#uphpu justincarmony (n=justinca@98.202.44.233) |
| 04:26.47 | *** mode/#UPHPU [+v justincarmony] by ChanServ |
| 05:59.51 | *** part/#uphpu Utah_Dave (n=David@12.51.53.162) |
| 12:59.17 | *** join/#uphpu jtsnow (n=chatzill@VDSL-151-118-128-100.DNVR.QWEST.NET) |
| 14:44.21 | *** join/#uphpu redroy (n=Adium@66.60.105.178) |
| 15:07.49 | *** join/#uphpu fungus (n=olsonl@bromine.sosstaffing.com) |
| 15:07.49 | *** mode/#UPHPU [+o fungus] by ChanServ |
| 15:09.42 | *** join/#uphpu justincarmony (n=justinca@c-98-202-44-233.hsd1.ut.comcast.net) |
| 15:09.42 | *** mode/#UPHPU [+v justincarmony] by ChanServ |
| 15:15.34 | justincarmony | DexterTheDragon: yay! CAD returns to the main story! :P |
| 15:30.47 | DexterTheDragon | justincarmony: yay |
| 15:39.57 | *** join/#uphpu SunSparc (n=sparky@173-8-91-177-Utah.hfc.comcastbusiness.net) |
| 15:39.57 | *** mode/#UPHPU [+v SunSparc] by ChanServ |
| 15:45.20 | *** join/#uphpu _psychic_ (n=_psychic@173.8.91.177) |
| 15:45.23 | *** mode/#UPHPU [+v _psychic_] by ChanServ |
| 16:22.50 | utahcon | hmmm... Friday... Star Wars in Concert ... might be worth attending http://www.starwarsinconcert.com/ |
| 16:48.39 | utahcon | quiet in here |
| 16:51.58 | DexterTheDragon | ~loud utahcon |
| 16:52.51 | utahcon | ~lart DexterTheDragon |
| 16:52.51 | ibot | executes killall -TERM DexterTheDragon |
| 16:52.56 | utahcon | bam! |
| 16:52.57 | utahcon | take that |
| 16:58.26 | utahcon | justincarmony: DexterTheDragon: I actually like Tim's tangents. |
| 16:58.58 | justincarmony | I do too, I was just starting to get a itch to hear more about the characters |
| 16:59.06 | utahcon | yeah |
| 16:59.18 | utahcon | I am hoping he goes back and fills in the 7 days :D |
| 17:00.20 | utahcon | Tarantino style. |
| 17:00.21 | utahcon | :d |
| 17:06.00 | justincarmony | LOL |
| 17:33.45 | *** join/#uphpu synic (n=squish@pdpc/supporter/student/synic) |
| 17:33.45 | *** mode/#UPHPU [+v synic] by ChanServ |
| 17:33.53 | *** part/#uphpu synic (n=squish@pdpc/supporter/student/synic) |
| 19:03.07 | *** join/#uphpu trevynm (n=trevynme@173.127.60.27) |
| 19:03.39 | trevynm | I have a task to audit a website for security |
| 19:03.43 | trevynm | they get hacked once a day |
| 19:03.50 | trevynm | and restoring the mysql database fixed the probelm |
| 19:03.55 | trevynm | I suspect sql injection |
| 19:04.02 | trevynm | anyone whant to help? |
| 19:04.16 | trevynm | know of any fast ways to identify the expoit? |
| 19:08.10 | unum | look through the php code for an insert |
| 19:08.42 | unum | look for any code that is being submitted to the website and then redisplayed |
| 19:10.23 | trevynm | unum: k |
| 19:15.19 | fungus | All input from a user should be inspected and validated |
| 19:15.27 | fungus | *All* input |
| 19:16.16 | fungus | _POST _GET _COOKIE _SERVER etc. |
| 19:16.25 | unum | http://xkcd.com/327/ |
| 19:16.30 | trevynm | fungus: anyway to automate the test? |
| 19:17.09 | fungus | you could search your code for references to these superglobals, and read the code around them to make sure they are validated |
| 19:17.48 | trevynm | its not my code... and I dont know how big the code base is yet |
| 19:17.52 | trevynm | getting that info |
| 19:18.07 | unum | you forgot _REQUEST |
| 19:19.05 | fungus | and _FILES |
| 19:20.25 | unum | http://www.areino.com/hackeando/ |
| 19:20.33 | orsonj | I usually prefer to do escaping right before the data goes into the database |
| 19:21.04 | unum | but escaping won't protect you against all attacks |
| 19:21.08 | fungus | escaping is not validation |
| 19:21.12 | orsonj | I know |
| 19:21.13 | unum | exactly |
| 19:21.31 | orsonj | I prefer to do escaping right before it goes into whatever it needs to go to. |
| 19:22.04 | orsonj | addslashes doesn't work for html and htmlentities doesn't work for databases, so I do the correct escaping before it goes in. |
| 19:22.22 | fungus | safest is always to validate every time you access user provided data |
| 19:23.27 | fungus | use your framework's validation features, or build your own validation library to make it easy |
| 19:23.53 | fungus | $user = validate_username($_COOKIE['username']); |
| 19:24.01 | trevynm | Im downloading the code |
| 19:24.05 | trevynm | I doubt there is a framework |
| 19:24.27 | trevynm | I was hoping there was some automated crawlers that can identify all form inputs |
| 19:24.34 | trevynm | or somethign |
| 19:25.21 | fungus | I haven't heard of any tools, but you will come pretty close by searching for the superglobals mentioned. |
| 19:25.26 | unum | grep :) |
| 19:25.32 | fungus | that is... unless they have register_globals=On |
| 19:25.52 | orsonj | you might look into ht://check it does crawling. I don't know about checking for forms, but it may be a start. |
| 19:29.02 | fungus | a quick google search returns some interesting results: |
| 19:29.04 | fungus | http://pixybox.seclab.tuwien.ac.at/pixy/ |
| 19:29.10 | fungus | http://www.acunetix.com/vulnerability-scanner/index.htm |
| 19:29.28 | trevynm | fungus: thanks |
| 19:42.03 | trevynm | I may be missing something |
| 19:42.15 | trevynm | but the suer posts a text feild with name 'cart' |
| 19:42.22 | trevynm | and he accesses teh POST var with $cart |
| 19:42.33 | trevynm | and I dont see _POST in his code anyplace |
| 19:42.58 | trevynm | tryign to find out if he is doin gany slashes or validation on those vars |
| 19:43.08 | trevynm | not sure how he is getting POST array into variables |
| 19:47.19 | stderr | trevynm: likely a use of import_request_variables() |
| 19:47.29 | trevynm | stderr: ok |
| 19:47.30 | trevynm | Ill look |
| 19:47.47 | stderr | http://php.net/manual/en/function.import-request-variables.php |
| 19:48.15 | trevynm | yeah not in there code |
| 19:48.19 | trevynm | but yes something liek that |
| 19:49.38 | fungus | if the php.ini config file on the server has it's "register_globals = On" then all variables in _POST, _GET, _COOKIE are automatically set |
| 19:50.02 | trevynm | yeah I be thats what it is |
| 19:50.06 | trevynm | fungus: ^ |
| 19:50.23 | fungus | That is going to be even harder to track down now. good luck. |
| 19:50.51 | fungus | http://php.net/manual/en/security.globals.php |
| 20:01.05 | *** join/#uphpu Jacolyte (n=blaine@unaffiliated/jacolyte) |
| 20:10.01 | macnewbold | trevynm: after you process all your incoming vars, you could redo an "extract()" on each of those superglobals arrays, in the same order that register globals would do it (there's an ini var you could check), and overwrite the vars it created via register globals |
| 20:16.26 | trevynm | macnewbold: nice |
| 20:24.11 | trevynm | http://www.hennesseyperformance.com/phpinfo.php |
| 20:24.13 | trevynm | Boo |
| 20:35.02 | *** join/#uphpu stderr (n=stderr@truedat.org) [NETSPLIT VICTIM] |
| 20:35.02 | *** join/#uphpu pelaofeliz (n=PelaoFel@67.108.236.230) [NETSPLIT VICTIM] |
| 20:35.02 | *** join/#uphpu opapo_ (n=daniel@205.118.116.89) [NETSPLIT VICTIM] |
| 20:47.53 | trevynm | macnewbold: fungus stderr unum , its pretty bad, so we are seling them a WP conversion becuase there stuff is so old and has big securty hoels. |
| 20:47.57 | trevynm | thanks for your help. |
| 20:54.34 | macnewbold | yeah, wp would be a huge upgrade for an old and broken site |
| 20:54.51 | macnewbold | i had to help transfer hosting on a site that was oscommerce from about 2004 I think |
| 20:55.07 | macnewbold | couldn't even get it to work on php5 hardly |
| 20:55.18 | macnewbold | required register_globals, etc. |
| 20:55.51 | macnewbold | it was old and junky, customized, and buggy, especially in parts that weren't used on their old server but that they now needed |
| 20:58.24 | trevynm | macnewbold: yeah, not fun |
| 20:58.26 | trevynm | thanks again |
| 20:58.33 | macnewbold | np good luck |
| 21:05.16 | stderr | good luck trevyn |
| 21:39.09 | *** part/#uphpu trevynm (n=trevynme@173.127.60.27) |
| 21:58.59 | *** join/#uphpu redroy (n=Adium@66.60.105.178) |
| 21:59.42 | *** join/#uphpu redroy (n=Adium@66.60.105.178) |
| 22:02.34 | *** join/#uphpu jtsnow (n=chatzill@VDSL-151-118-128-100.DNVR.QWEST.NET) |
| 22:07.53 | *** join/#uphpu jtsnow (n=chatzill@VDSL-151-118-128-100.DNVR.QWEST.NET) |
| 22:28.50 | *** join/#uphpu redroy (n=Adium@66.60.105.178) |
| 22:29.12 | *** part/#uphpu redroy (n=Adium@66.60.105.178) |
| 22:35.44 | *** join/#uphpu justincarmony (n=justinca@c-98-202-44-233.hsd1.ut.comcast.net) |
| 22:35.44 | *** mode/#UPHPU [+v justincarmony] by ChanServ |
| 22:47.25 | *** join/#uphpu beandog (n=steve@gentoo/developer/beandog) |
| 22:47.25 | *** mode/#UPHPU [+v beandog] by ChanServ |