Web Security

Thet Aung Min Latt

Managing Director

Diamond Intelligence Co., Ltd

thetaung@diamondconsultantgroup.com

Finding the flaw

• Stolen user credentials

• Weak passwords

• Code vulnerabilities

• Dangerous configurations

In the public

• ext:sql intext:@gmail.com intext:password

• inurl:/backup intitle:index of backup intext:*sql

• intext:phpMyAdmin SQL Dump filetype:sqlintext:INS...

• inurl:.php? intext:CHARACTER_SETS,COLLATIONS, ?intitle:phpmyadmin

Owning your box

• The cost

• The responsibility

Shell

• Shell

Know it

• Recognize a backdoor

• File name patterns/location

• File modification date

• File permissions/ownership

• File contents

• Log analysis

File

File contents

The Log

Strange URL in access log

• http://www.Victim-website.com.mm/mailto.php

• http://www.Victim-website.com.mm/mailto.php?symlink&symlinkserver

• http://www.Victim-website.com.mm/mailto.php?database

• http://www.Victim-website.com.mm/mailto.php

• http://www.Victim-website.com.mm/aboutus_photo/2005068737dunush.php

Malicious Redirect Code Within

The .htaccess File

Advice

• Only administer your website from a deviceyou trust is free of malware.

• Do not administer your site from a free Wi-Fi hotspot

• Keep your website up to date

• Use strong passwords and change them on aregular basis.

• Back up your site at least once a month.

Tip

• Curious

• Everything is test

Reference

• blog.malwarebytes.org

Q&A

Thanks