[Quarterbore]

Originally Posted by greyhat

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2

I have been studing hacker's tools and there are a number of them that are purpost built fo get a config file and try to find the password and username. Then, I have seen scripts go one step further and try using the Usename and Password to access cpanel!

Anybody with a cpanel username or password that can be figured out by your database connections would be very wise to evaluate that cpanel password based on what I have seen.

The problem is these hackers just need to find one file that lets them upload a script and then they can get access to your config files and from there they get your database. If they can get FTP or CPANEL access too, well damn your are going to get hurt!

Hiding config files looks like a good idea to me the more I try to study the tools hackers use.

I am working on a project to look for fulnerable situations as well as scan for potential hacker scripts that could be on your server. I have quite a bit more to do but I found this thread looking for things I need to include in the script. In essense, I have a server side spider that can be installed in any directory including those by .htaccess permissions and the goal is to identify hacker tools when they are installed as well as potentially identify scripts that hackers might get if they managed to get a file on your server.

Oh well, I am tagging this as I want to change my config locations.