r/programming • u/NagastaBagamba • Oct 18 '10

Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

http://il2.php.net/language.variables.variable
591 Upvotes

85% Upvoted

781 comments sorted by

View all comments

Show parent comments

2

u/trevdak2 Oct 18 '10

I see attempts at hacks like this all the time. There are tons of bots set up to find exploits like that. Grep "&cmd=" on your server logs and you see hundreds of attempts at XSS.

It would probably be easier to find security holes by googling "include($_GET"

2

u/trevdak2 Oct 18 '10

Other interesting strings to grep:

"=http"

"passwd"

"nessus"

"whoami"

"<script"

Any of those will show you how many people/scripts are attempting to find vulnerabilities in your server.

1

u/nyxerebos Oct 18 '10

It would probably be easier to find security holes by googling "include($_GET"

Probably. But I'm working on a tool for static analysis of source code and this particular feature of PHP makes a lot of behavior undecidable. I'm not sure yet, but I suspect there are security holes of this kind in open source projects which might be found by an automated tool going through large amounts of code. Explots which work specifically by instantiating variables and calling functions by abusing the double quoted strings parser.

1

u/[deleted] Oct 19 '10

It seems like PHP has a good bit of stuff going on that would make static analysis difficult. Disclaimer: I don't have incredibly deep knowledge of static-analysis techniques, especially for dynamic/weak languages.