Go Back   vb.org Archive > vBulletin Article Depository > Read An Article > vBulletin 3 Articles
Reload this Page A mere config.php encoding is useless
FAQ Members List Calendar Search Today's Posts Mark Forums Read
A mere config.php encoding is useless
Milad's Avatar
Milad
Join Date: Apr 2005
Posts: 663

 

Syro
Show Printable Version Email this Page Subscription
Milad Milad is offline 06-04-2006, 10:00 PM
Some developers say: "To protect yourself from hackers attacks, encode your config.php" and some other advices.

The mere encoding that is applied to config.php isn't enough.

Because if the hacker has the ability to (create or edit) and excute php files on your filesystem, he would be able to read your config.php variables even if config.php is encoded.

This is very simple and powerful script, it reads your encoded config.php, treats the $config array, and dissplays the variables in nice table.

PHP Code:
// HERE IS THE PATH TO CONFIG.PHP
include('./354/includes/config.php');

echo '<table cellspacing="0" cellpadding="3" align="center" width="500" style="background: #D1D1E1; color: #000000; border: 1px solid #0B198C;">';

foreach ($config as $key => $value)
{
    echo '<tr><td colspan="2" align="center" style="background: #5C7099; color: #FFFFFF; font: bold 10pt verdana, geneva;">' . $key . '</td></tr>';

    foreach ($value as $key2 => $value2)
    {
        echo '<tr><td width="50%" style="background: #E1E4F2; color: #000000;">' . $key2 . '</td><td width="50%" style="background: #F5F5FF; color: #000000;">' . ($value2 ? $value2 : '&nbsp;') . '</td></tr>';
    }
}

echo '</table>'; 
The output will be like this:


This doesn't mean that vBulletin is insecure, this can be applied to any script.

The solution is at your host, so choose an excellent host.

Don't forget to protect your directories.
Reply With Quote
  #2  
Old 06-05-2006, 02:43 PM
Hellcat Hellcat is offline
 
Join Date: May 2003
Location: Germany
Posts: 560
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by Milad
Because if the hacker has the ability to (create or edit) and excute php files on your filesystem, [...]
....you have a problem anyway!

Noone should be able to create random files on your filesystem in the first place.
This can only be done via pretty unsecure uploading scripts or such....
Always be carfull with those!
Reply With Quote
  #3  
Old 06-05-2006, 04:33 PM
HaMaDa4eVeR's Avatar
HaMaDa4eVeR HaMaDa4eVeR is offline
 
Join Date: Jun 2004
Location: Sudan
Posts: 107
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by Milad

The solution is at your host, so choose an excellent host.

Don't forget to protect your directories.
you're right you can easly print the value of config file
PHP Code:
echo $config['Database']['dbname']; 
and you will get the name of db.

but happience if you change the name of the variable $config,
rename $config['Database']['dbname']; to $myconfig['Database']['dbname'];
and change the class files
but what's the solution !!!

by anther meaning, what do you meant "excellent host",
explain more if you can

thanks
Reply With Quote
  #4  
Old 06-06-2006, 09:36 AM
Milad's Avatar
Milad Milad is offline
 
Join Date: Apr 2005
Location: Syro
Posts: 663
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Hellcat said : "This can only be done via pretty unsecure uploading scripts or such...."

And if your host is not profissional, you will face some problems with him.

A friend of mine, had givem me my config.php, and I was confused about this, I don't have any upload script on my site but ecdownloads only, and it's secure.

I don't allow members to upload files at risk rates.

He could to create files in my active 777 directories.

So I moved to a new host. and protected my active 777 directories.

Thanks
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 10:38 AM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.03668 seconds
  • Memory Usage 2,245KB
  • Queries Executed 18 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (2)bbcode_php
  • (2)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_article
  • (1)navbar
  • (4)navbar_link
  • (120)option
  • (4)post_thanks_box
  • (4)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (4)post_thanks_postbit_info
  • (3)postbit
  • (4)postbit_onlinestatus
  • (4)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete