I think you missed my point, they need an almost root mysql user to
access the database so that they can create and drop databases and
tables and they need their document root directory to be writable by
the webserver as they create random files all over the place.
Robin
On 8/19/06, crazy frog crazy frog <i.m.crazy.frog@gmail.com> wrote:
Hi,
there are few websites which claims to decode the encrypted php files
but they wil charge you some amount.they also have a demo option which
u can use.
another thing is tht mysql does not need to be run as root and whole
root directory does needs to be writable.
regards,
-CF
http://www.secgeeks.com
On 8/19/06, Robin Wood <dninja@gmail.com> wrote:
> Hi
> I've been asked to install a compiled php app on a server I manage and
> I'm not happy with the way it has been built so I'm looking for a way
> to do check through the code but, as it is compiled I can't just view
> it.
>
> Is there an easy way to decompile php? I've had a google and found a
> couple of services offering to decompile individual pages but nothing
> for full sites.
>
> I'm not sure what compiler was used but this app requires the zend
> optimizer to run.
>
> Things I'm not happy about:
> Needs full write access to the whole of its web root, it seems to
> create files and directories all over the place.
> Needs almost root mysql access, the only thing it doesn't need is
> grant privileges! It created databases when you add new data into the
> site.
> I've found XSS on the authors site and on this app - I've reported
> this to the author who after claiming to be big on security asked me
> to explain XSS and still hasn't fixed the problem a few weeks later.
>
> I've got permission to test the app but I'm not being paid for it so
> I'd much rather do a code review than full test on each page, that way
> I can patch anything I find or make other provisions to protect from
> the problem.
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire was recently named the worldwide market leader in Web
> application security assessment tools by both Gartner and IDC.
> Download a free trial of AppScan today and see why more customers choose
> AppScan then any other solution. Try it today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
> --------------------------------------------------------------------------
>
>
--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
"oh yeah oh yeah...
another wannabe, in hackerland!!!"
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire was recently named the worldwide market leader in Web
application security assessment tools by both Gartner and IDC.
Download a free trial of AppScan today and see why more customers choose
AppScan then any other solution. Try it today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------
