Re: How to determine which PHP-script allows spamming?

Kurt Seifried wrote:
>> The culprit turned out to be  some guy who, instead of creating links 
>> to his web-pages decided to include them.
>> This happened in the form of http://domain/index.php?p=/bla/data.html
>> Of course, "p" could be overwritten and some guy was loading a 
>> php-mailer from various geocities and yahoo pages, which our server 
>> dutifully parsed...
>> We could only shake our heads in disbelieve. This had cost us 
>> countless hours of (until now) fruitless work.
> 
> One relatively easy way to prevent this type of problem is to disallow 
> your web server from making outgoing connections to port 80 TCP (i.e. do 
> not allow it to request things). If you want to be really anal simply 
> disallow any outgoing connection attempts for TCP SYN, this will prevent 
> all sorts of naughtiness from your webserver. Plus when you do see 
> blocked outgoing connections you will know something is up and can 
> correlate it with web logs/etc.

That is a nice and clean global solution.

With PHP you can also turn off fopen-wrappers which will disallow 
including remote content. IMHO that should be the default, and allowing 
it would be strictly per-virtualhost basis after auditing the security 
of the code in question...

-ka