Question

I am working freelance on a website that website hacked 3 times before my working.

I am working now and after some chnges I will upload I use these steps for security. some other help full tips will be appreciated.

I thought there is a problem with server because some port was not secure. And I am not able to find and communicate that with server administrator.

I want to make completely secure site from hack:

I use these two functions for prevent with sql injections.

function escape($string) {
    if(get_magic_quotes_gpc()) $string = stripslashes($string);
    return mysql_real_escape_string($string);
}

And some time use:

function remove_spc_chr($str){
        $str=trim($str);

        $arr=array('%','$','/','\\','*','+','=','\'','"','#','@','(',')','^','~','`','&',
                ',',';','\'','?','<','>','!','{','}','[',']');

        $str=str_replace($arr,'',$str);

        $str=strip_tags($str);

        return $str;        
}

And I use for htaccess security this code:

RewriteEngine on
Options -Indexes

Options +FollowSymlinks
RewriteRule ^(.*)\.html$ $1.php [nc]


Options +FollowSymlinks
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} http:.*\/.*\/ [OR]
RewriteCond %{QUERY_STRING} ..*\/ [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteCond %{QUERY_STRING} [^a-z](declare|char|set|cast|convert|delete|drop|exec|insert|meta|script|select|truncate|update)[^a-z] [NC]
RewriteRule (.*) - [F]


<IfModule mod_rewrite.c>
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|aol|slurp|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|aol|yahoo|search|bing)
RewriteCond %{REQUEST_URI} /$ [OR]
RewriteCond %{REQUEST_FILENAME} (html|htm|php|phps|shtml|xml|xhtml|phtml)$ [NC]
</IfModule>




#Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]

#Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]

#Block out any script that includes a script tag in URL
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]


#Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

#Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

#Send all blocked request to homepage with 403 Forbidden error!
#RewriteRule ^(.*)$ index.html [F,L]


#DirectoryIndex index.html

SetEnv TZ America/California
AddDefaultCharset utf-8
DefaultLanguage en-US
LimitRequestBody 10240000

        <FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">
         Order Allow,Deny
         Deny from all
        </FilesMatch>

        <ifmodule mod_php4.c>
         #php_value zlib.output_compression 16386
        </ifmodule>

        AddType image/gif                       .gif .GIF
        AddType image/ief                       .ief
        AddType image/jpeg                      .jpeg .jpg .jpe .JPG
        AddType image/tiff                      .tiff .tifAuthName wapadik.net
        IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

        RewriteCond %{REQUEST_METHOD} (GET) [NC]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http(%3A|:)(/|%2F){2}(.*)$ [NC]
        RewriteRule (.*) /huwad/blocker/blocker1.php   [L]

        RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
        RewriteCond %{QUERY_STRING} ^(.*)(%20SELECT%20|%20INSERT%20|CHAR\(|%20UPDATE%20|%20REPLACE%20)(.*)$ [NC]
        RewriteRule (.*) /huwad/blocker/blocker1.php   [L]

        RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
        RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]

        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ftp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ht%20tp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)htt%20p(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%20(%3A|:)(/|%2F){2}(.*)$ [NC,OR]
        RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)h%20ttp(%3A|:)(/|%2F){2}(.*)$ [NC,OR]

        RewriteCond %{QUERY_STRING} ^(.*)base64_encode(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR]
        RewriteCond %{REQUEST_URI} ^(.*)_vti(.*)$ [OR]
        RewriteCond %{REQUEST_URI} ^(.*)MSOffice(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)/etc/passwd(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)//(.*)$ [OR]
        RewriteCond %{REQUEST_URI} ^(.*)ShellAdresi.TXT(.*)$ [OR]
        RewriteCond %{REQUEST_URI} ^(.*)\[evil_root\]?(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)\.\./\.\./\.\./(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)/proc/self/environ(.*)$
        RewriteRule (.*) /huwad/blocker/blocker1.php   [L]

        RewriteCond %{HTTP_USER_AGENT} @nonymouse|ADSARobot|amzn_assoc|Anarchie|ASPSeek|Atomz|^[^?]*addresses\.com|Advanced\ Email\ Extractor|ah-ha|aktuelles|almaden|Art-Online|AspiWeb|ASSORT|ATHENS|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|big.brother|BlackWidow|bmclient|Boston\ Project|Bot\ mailto:[e-mail]|BravoBrian\ SpiderEngine\ MarcoPolo|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Crescent\ Internet\ ToolPack|cURL|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DirectUpdate|DISCo|Download\ Accelerator|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|echo\ extense|ecollector|efp@gmx\.net|EirGrabber|EmailCollector|Email\ Extractor|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|fastlwspider|FavOrg|Favorites\ Sweeper|Fetch\ API\ Request|FEZhead|FileHound|FlashGet|FlickBot|fluffy|frontpage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go!Zilla|Go-Ahead-Got-It|GornKer|Grabber|GrabNet|Grafula|Green\ Research|Harvest|hhjhj@yahoo|hloader|HMView|HomePageSearch|HTTP\ agent|HTTPConnect|httpdown|http\ generic|HTTrack|^[^?]*iaea\.org|IBM_Planetwide|^[^?]*\.ideography\.co\.uk|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkAgent|InternetSeer\.com|Iria|Irvine|iOpus|IPiumBot\ laurion(dot)com|Jakarta|JBH*Agent|JetCar|JustView|Kapere|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MemoWeb|MCspider|Microsoft\ URL\ Control|MIDown\ tool|minibot\(NaverRobot\)|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|netfactual|netcraft|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NEWT|nicerspro|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OutWit|PackRat|PageGrabber|Papa\ Foto|pavuk|pcBrowser|PersonaPilot|PingALink|Pockey|Program\ Shareware|psbot|PSurf|puf|Pump|PushSite|QRVA|QuepasaCreep|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Shai|sitecheck|SiteMapper|SiteSnagger|SlySearch|SmartDownload|snagger|SpaceBison|Spegla|SpiderBot|SqWorm|Star\ Downloader|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Telesoft|Templeton|traffixer|TrueRobot|TuringOS|TurnitinBot|TV33_Mercator|UIowaCrawler|URL_Spider_Pro|UtilMind|Vacuum|vagabondo|vayala|visibilitygap|vobsub|VoidEYE|vspider|w3mir|web\.by\.mail|Web\ Data\ Extractor|Web\ Downloader|Web\ Image\ Collector|Web\ Sucker|WebAuto|webbandit|Webclipping|webcollector|webcollage|WebCopier|webcraft@bea|WebDAV|webdevil|webdownloader|Webdup|WebEmailExtractor|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WebMiner|WebMirror|webmole|WebReaper|WebSauger|WEBsaver|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|whizbang|WhosTalking|Widow|WISEbot|WUMPUS|Wweb|WWWOFFLE|Wysigot|Xaldon\ WebSpider|XGET|x-Tractor|Zeus.* [OR]

        RewriteCond %{REQUEST_URI} .*((php|my)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR]
        RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]
        RewriteCond %{QUERY_STRING} ^(.*)=/home(.+)?/(.*)/(.*)$ [OR]
        RewriteCond %{QUERY_STRING} ^work_dir=.*$ [OR]
        RewriteCond %{QUERY_STRING} ^command=.*&output.*$ [OR]
        RewriteCond %{QUERY_STRING} ^nts_[a-z0-9_]{0,10}=.*$ [OR]
        RewriteCond %{QUERY_STRING} ^c=(t|setup|codes)$ [OR]
        RewriteCond %{QUERY_STRING} ^act=((about|cmd|selfremove|chbd|trojan|backc|massbrowsersploit|exploits|grablogins|upload.*)|((chmod|f)&f=.*))$ [OR]
        RewriteCond %{QUERY_STRING} ^act=(ls|search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback|cmd|gofile|mkfile)&d=.*$ [OR]
        RewriteCond %{QUERY_STRING} ^&?c=(l?v?i?&d=|v&fnot=|setup&ref=|l&r=|d&d=|tree&d|t&d=|e&d=|i&d=|codes|md5crack).*$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)([-_a-z]{1,15})=(ls|cd|cat|rm|mv|vim|chmod|chdir|mkdir|rmdir|pwd|clear|whoami|uname|tar|zip|unzip|tar|gzip|gunzip|grep|more|ln|umask|telnet|ssh|ftp|head|tail|which|mkmode|touch|logname|edit_file|search_text|find_text|php_eval|download_file|ftp_file_down|ftp_file_up|ftp_brute|mail_file|mysql|mysql_dump|db_query)([^a-zA-Z0-9].+)*$ [OR]
        RewriteCond %{QUERY_STRING} ^(.*)(wget|shell_exec|passthru|system|exec|popen|proc_open)(.*)$
        #RewriteRule  (.*)  /huwad/blocker/blocker3.php  [L]


ErrorDocument 400 /index.html
ErrorDocument 403 /index.html
ErrorDocument 404 /index.html
ErrorDocument 405 /index.html
ErrorDocument 408 /index.html
ErrorDocument 500 /index.html
ErrorDocument 502 /index.html
ErrorDocument 504 /index.html

        <Files 403.shtml>
        order allow,deny
        allow from all
        </Files>

Htaccess Reference

I check variable proper before using in query.

If there is and security step that will be help full for me?

Kindly Answer security steps if there is a problem or any hole.

Answer 1

I’ll start by focussing on this function you quoted:

function escape($string) {
    if(get_magic_quotes_gpc()) $string = stripslashes($string);
    return mysql_real_escape_string($string);
}

The intent here is good, but there are some major problems, largely due to the use of obsolete PHP techniques.

• Firstly, Magic Quotes is deprecated. The most recent versions of PHP (5.4) have removed the get_magic_quotes_gpc() function entirely. PHP 5.3 includes it but throws a deprecation warning.

  If you’re using PHP 5.4, this code won’t work at all.

  If you’re using PHP 5.3, you should already have noticed the error messages being produced. You can set PHP to ignore them, but it’s not a good idea. You should make sure that magic quotes is switched off, and you can drop this line of code.

  If you’re using PHP 5.2 or earlier, you need to upgrade. 5.2 was been unsupported for two years now, and has known security issues that will never be patched.

• Secondly, the mysql_xxx() functions are deprecated. They are considered obsolete and insecure, and will be removed from future PHP versions. It is strongly recommended not to use them any more; one should switch to either the mysqli_xx() functions or the PDO library.

  Depending on the quality (and size) of the code, this may be a big task, but it is important if you’re trying to make the code more secure.

  As an added bonus, both the mysqli and PDO extensions provide a SQL technique called Prepared Queries, which allows you to build your SQL queries without having to manually escape the parameters. This is considered current best practice, as a complete replacement to using the escape_string functions. Again, this will be quite a bit of work to implement into an existing system, but may be worth it in the name of security.

Now, the second function you’re using to prevent SQL injection:

function remove_spc_chr($str){ ... }

Categorically, this will not work. If you’re relying on this function to do the same job as the escape() function, it is very easily hackable. There are a number of ways that a hacker could use to bypass this code, including having null characters in a the string, and depending on the character encoding you’re using, there are a number of ways to use non-ASCII characters to attack a DB which would also not be picked up here. Always use the proper escaping mechanism for data being sent to the DB (or prepared queries, as detailed above).

Re the htaccess code you’ve provided, I can see what you’re doing here, trying to block certain SQL and PHP keywords. None of it should be necessary if the script itself is properly secured. In particular, the SQL keywords should be perfectly safe if the queries in the code are properly escaped/prepared. Plus many SQL keywords are common English words, so blocking them could cause problems for people posting legitimate text into the forms on your site.

The other problem you have with everything you’ve quoted is that it only deals with a handful of fairly specific attacks (most of which, from what I can tell, are not likely to be the attack that has compromised the site). There are a lot of attack vectors that you haven’t dealt with.

I suggest getting some more solid protection in place. If your server is not running the PHP Suhosin extension, then you should upgrade the PHP version to include that. This is a general security hardening extension for PHP. It can do a lot of things to help secure a PHP site, but for you, I would say that a key feature is the ability to disable insecure PHP features and functions, such as the exec() and system() functions. This alone will make a big difference to the ability to hack your site, without any code changes being necessary for you at all.