Hello all
My apologies if this is in the wrong newsgroup. I recently got a new web
hosting client who has a very large website, 90% of all his website files
are .php Now my problem is that they are not very good/secure php
programmers, his site was hacked 3 times already , i am sure through his
php scripts, now my question is , is there such a thing as a php scanner to
check for possible exploits/vunerablebilities? I mean you typ in a URL and
thsi magical program will check it for basic exploit possibilities?
somthing along those lines
Thanks any help apprciated

Begin <q6-dnViyVZbyUs7eRVn-jQ@teksavvy.com>
2005-10-17, Fred <newsgroup@stupidguytalkwrote:
My apologies if this is in the wrong newsgroup. I recently got a new web
hosting client who has a very large website, 90% of all his website files
are .php Now my problem is that they are not very good/secure php
programmers, his site was hacked 3 times already , i am sure through his
.php scripts,

If you want to keep the client, is it worth it question is up to
you to answer-- I'd start with containing the site as much as possible.
chroot(8) it, put it in a jail(8), or use differently named facilities
that do largely the same on your platform of choice. The idea is to not
let rogue programs and people out of the little sandbox that contains
the webserver and php, and various facilities do this in various
degrees.

Also, php can be configured such that it is much less insecure, altough
that may require altering the scripts. If they're that insecure it is
likely that needs to be done anyway. You probably have to work with them
on that. I'd consider making it a condition of keeping the client, or
upping the fees to put them on their dedicated jailed box that is easily
restored whenever something happens, and at hopefully no others will be
affected.

now my question is , is there such a thing as a php scanner to
check for possible exploits/vunerablebilities? I mean you typ in a URL and
thsi magical program will check it for basic exploit possibilities?
somthing along those lines

There might very well be scanning tools, but there's no magic involved.
Even the best tools may not catch everything and there are no tools that
can *solve* programmer stupidity. A good grasp of how php works and
where its main weaknesses are will do much more. Some of the things you
can indeed change at the php.ini level, but not all.

When you say jail , should i assume you mean "open_basedir" in php, meaning
he can not run or go out of whatever it is? As i do have this restricted to
his home dir, btu i guess if one of his scripts is exploitable the hacker
can do stuff form within this jail? But not outside then? so he could not
say modify the /etc/passwd ?

Thanks for your reply