Re: testing compiled php

["Robin Wood" <dninja () gmail com>]

I think you missed my point, they need an almost root mysql user to
access the database so that they can create and drop databases and
tables and they need their document root directory to be writable by
the webserver as they create random files all over the place.

Robin

On 8/19/06, crazy frog crazy frog <i.m.crazy.frog () gmail com> wrote:
> Hi,
> there are few websites which claims to decode the encrypted php files
> but they wil charge you some amount.they also have a demo option which
> u can use.
> another thing is tht mysql does not need to be run as root and whole
> root directory does needs to be writable.
> regards,
> -CF
> http://www.secgeeks.com
>
> On 8/19/06, Robin Wood <dninja () gmail com> wrote:
> > Hi
> > I've been asked to install a compiled php app on a server I manage and
> > I'm not happy with the way it has been built so I'm looking for a way
> > to do check through the code but, as it is compiled I can't just view
> > it.
> >
> > Is there an easy way to decompile php? I've had a google and found a
> > couple of services offering to decompile individual pages but nothing
> > for full sites.
> >
> > I'm not sure what compiler was used but this app requires the zend
> > optimizer to run.
> >
> > Things I'm not happy about:
> > Needs full write access to the whole of its web root, it seems to
> > create files and directories all over the place.
> > Needs almost root mysql access, the only thing it doesn't need is
> > grant privileges! It created databases when you add new data into the
> > site.
> > I've found XSS on the authors site and on this app - I've reported
> > this to the author who after claiming to be big on security asked me
> > to explain XSS and still hasn't fixed the problem a few weeks later.
> >
> > I've got permission to test the app but I'm not being paid for it so
> > I'd much rather do a code review than full test on each page, that way
> > I can patch anything I find or make other provisions to protect from
> > the problem.
> >
> > Robin
> >
> > -------------------------------------------------------------------------
> > Sponsored by: Watchfire
> >
> > Watchfire was recently named the worldwide market leader in Web
> > application security assessment tools by both Gartner and IDC.
> > Download a free trial of AppScan today and see why more customers choose
> > AppScan then any other solution. Try it today!
> >
> > https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
> > --------------------------------------------------------------------------
> >
> >
>
>
> --
> ting ding ting ding ting ding
> ting ding ting ding ding
> i m crazy frog :)
> "oh yeah oh yeah...
>  another wannabe, in hackerland!!!"

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. 
Download a free trial of AppScan today and see why more customers choose 
AppScan then any other solution. Try it today!
 
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------