PHP shell upload defense and attack. Client side validation using javascript.
(Take a look at "PHP shell upload I" article for an introduction to file uploading.)
Most security vulnerabilities revolve around the attacker providing bad or malformed data to the server machine. As buffer overruns, cross-site scripting attacks, SQL injection attacks, and more.
Anything that comes from a connection needs to be treated as untrusted until correct validation. We can consider two kinds of validations. Client side and server side. The former is the starting point for a proper understanding of the input management. Client side validation is an insecure validation by definition. Used for the benefit of the user only, specially, when the user is an attacker ;-). Javascript, HTML or actionscript validations can be easyly bypassed because they are stored in the attacker machine. Anyhow, it's important to mention that many services use client side validation: - Low security websites. - Flash based services. - Random websites. - Firmware forms. - ...
We all can think that no developer would trust in client side validations, but: 1 - Developers always make mistakes. 2 - Designers don't know what a mistake is. 3 - Developers tend to make the same mistake more than once. 4 - See 1.
For this article I set up a form with common client side validations. I will not cover any code obfuscation, neither swf protection. They are a waste of time for the developer. Attackers have both the time and the knowledge to determine exactly how these systems work. Often, break them is only a matter of time and we don't have much uh?
