<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Error Reporting</title>
</head>
<body><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="security.database.sql-injection.html">SQL Injection</a></div>
<div class="next" style="text-align: right; float: right;"><a href="security.globals.html">Using Register Globals</a></div>
<div class="up"><a href="security.html">Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div><hr /><div id="security.errors" class="chapter">
<h1>Error Reporting</h1>
<p class="para">
With PHP security, there are two sides to error reporting. One is
beneficial to increasing security, the other is detrimental.
</p>
<p class="para">
A standard attack tactic involves profiling a system by feeding
it improper data, and checking for the kinds, and contexts, of the
errors which are returned. This allows the system cracker to probe
for information about the server, to determine possible weaknesses.
For example, if an attacker had gleaned information about a page
based on a prior form submission, they may attempt to override
variables, or modify them:
<div class="example" id="example-339">
<p><strong>Example #1 Attacking Variables with a custom HTML page</strong></p>
<div class="example-contents">
<div class="htmlcode"><pre class="htmlcode"><form method="post" action="attacktarget?username=badfoo&amp;password=badfoo">
<input type="hidden" name="username" value="badfoo" />
<input type="hidden" name="password" value="badfoo" />
</form></pre>
</div>
</div>
</div>
</p>
<p class="para">
The PHP errors which are normally returned can be quite helpful to a
developer who is trying to debug a script, indicating such things
as the function or file that failed, the PHP file it failed in,
and the line number which the failure occurred in. This is all
information that can be exploited. It is not uncommon for a php
developer to use <span class="function"><a href="function.show-source.html" class="function">show_source()</a></span>,
<span class="function"><a href="function.highlight-string.html" class="function">highlight_string()</a></span>, or
<span class="function"><a href="function.highlight-file.html" class="function">highlight_file()</a></span> as a debugging measure, but in
a live site, this can expose hidden variables, unchecked syntax,
and other dangerous information. Especially dangerous is running
code from known sources with built-in debugging handlers, or using
common debugging techniques. If the attacker can determine what
general technique you are using, they may try to brute-force a page,
by sending various common debugging strings:
<div class="example" id="example-340">
<p><strong>Example #2 Exploiting common debugging variables</strong></p>
<div class="example-contents">
<div class="htmlcode"><pre class="htmlcode"><form method="post" action="attacktarget?errors=Y&amp;showerrors=1&amp;debug=1">
<input type="hidden" name="errors" value="Y" />
<input type="hidden" name="showerrors" value="1" />
<input type="hidden" name="debug" value="1" />
</form></pre>
</div>
</div>
</div>
</p>
<p class="para">
Regardless of the method of error handling, the ability to probe a
system for errors leads to providing an attacker with more
information.
</p>
<p class="para">
For example, the very style of a generic PHP error indicates a system
is running PHP. If the attacker was looking at an .html page, and
wanted to probe for the back-end (to look for known weaknesses in
the system), by feeding it the wrong data they may be able to
determine that a system was built with PHP.
</p>
<p class="para">
A function error can indicate whether a system may be running a
specific database engine, or give clues as to how a web page or
programmed or designed. This allows for deeper investigation into
open database ports, or to look for specific bugs or weaknesses
in a web page. By feeding different pieces of bad data, for example,
an attacker can determine the order of authentication in a script,
(from the line number errors) as well as probe for exploits that
may be exploited in different locations in the script.
</p>
<p class="para">
A filesystem or general PHP error can indicate what permissions
the web server has, as well as the structure and organization of
files on the web server. Developer written error code can aggravate
this problem, leading to easy exploitation of formerly "hidden"
information.
</p>
<p class="para">
There are three major solutions to this issue. The first is to
scrutinize all functions, and attempt to compensate for the bulk
of the errors. The second is to disable error reporting entirely
on the running code. The third is to use PHP's custom error
handling functions to create your own error handler. Depending
on your security policy, you may find all three to be applicable
to your situation.
</p>
<p class="para">
One way of catching this issue ahead of time is to make use of
PHP's own <span class="function"><a href="function.error-reporting.html" class="function">error_reporting()</a></span>, to help you
secure your code and find variable usage that may be dangerous.
By testing your code, prior to deployment, with <strong><code>E_ALL</code></strong>,
you can quickly find areas where your variables may be open to poisoning
or modification in other ways. Once you are ready for deployment,
you should either disable error reporting completely by setting
<span class="function"><a href="function.error-reporting.html" class="function">error_reporting()</a></span> to 0, or turn off the error
display using the <var class="filename">php.ini</var> option <em>display_errors</em>,
to insulate your code from probing. If you choose to do the latter,
you should also define the path to your log file using the
<em>error_log</em> ini directive, and turn
<em>log_errors</em> on.
<div class="example" id="example-341">
<p><strong>Example #3 Finding dangerous variables with E_ALL</strong></p>
<div class="example-contents">
<div class="phpcode"><code><span style="color: #000000">
<span style="color: #0000BB"><?php<br /></span><span style="color: #007700">if (</span><span style="color: #0000BB">$username</span><span style="color: #007700">) { </span><span style="color: #FF8000">// Not initialized or checked before usage<br /> </span><span style="color: #0000BB">$good_login </span><span style="color: #007700">= </span><span style="color: #0000BB">1</span><span style="color: #007700">;<br />}<br />if (</span><span style="color: #0000BB">$good_login </span><span style="color: #007700">== </span><span style="color: #0000BB">1</span><span style="color: #007700">) { </span><span style="color: #FF8000">// If above test fails, not initialized or checked before usage<br /> </span><span style="color: #0000BB">readfile </span><span style="color: #007700">(</span><span style="color: #DD0000">"/highly/sensitive/data/index.html"</span><span style="color: #007700">);<br />}<br /></span><span style="color: #0000BB">?></span>
</span>
</code></div>
</div>
</div>
</p>
</div>
<hr /><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="security.database.sql-injection.html">SQL Injection</a></div>
<div class="next" style="text-align: right; float: right;"><a href="security.globals.html">Using Register Globals</a></div>
<div class="up"><a href="security.html">Security</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div></body></html>
