Prevent your app from being hacked by
Jean-KévinDu62
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5622779/Webp.net-resizeimage.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6323462/shutterstock_hacker_kid.jpg)
Sylvain Combraque
Developer at les-tilleuls.coop
Security auditor free time
API Platform contributor
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5585352/fc354cd579fd5639f07c50822bb88e71.jpg)
@Darkweak
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5585364/1024px-Octicons-mark-github.svg.png)
@Darkweak_dev
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593136/twitter.png)
Les-tilleuls.coop
Self-managed since 2011
35 people, 2000% in 8 years
jobs@les-tilleuls.coop
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5622779/Webp.net-resizeimage.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593228/1280px-React-icon.svg.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593234/thumb_bigger_formation-elasticsearch.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593233/logo-2.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593232/logo.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593231/2000px-Go_Logo_Aqua.svg.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593229/1300px-Docker_container_engine_logo.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593253/API-platform.png)
"You should use Wordpress, it's secure"
![](https://media2.giphy.com/media/WrNfErHio7ZAc/giphy.gif)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6251351/WordPress-logotype-simplified.png)
Back to the past
mysql_connect
PDO::Query
SELECT *
FROM table
WHERE id = $id
Need to fetch data from database ?
![](https://media1.giphy.com/media/qXzuT3DMwdNGU/giphy.gif)
ORM (such as CakePHP ORM)
Better use
Prepared requests
Need to define a url with identifier ?
/category.php?id=1
![](https://media1.giphy.com/media/qXzuT3DMwdNGU/giphy.gif)
/category?id=1
Url rewrite is better
/category/1
Cool my app is now secure
Not really
![](https://media1.giphy.com/media/quj5jGCrP6new/giphy.gif)
Going further with hacker attack
Prevent your app from bruteforce attack
Login example
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6266946/Capture_d_écran_2019-06-17_à_23.13.22.png)
Login example
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6266945/Capture_d_écran_2019-06-17_à_23.13.34.png)
Login example
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6266947/Capture_d_écran_2019-06-17_à_23.13.44.png)
My reaction
![](https://media0.giphy.com/media/ZP9QaumB9RWuc/giphy.gif)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6267086/fail2ban-logo.jpg)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385711/iptables.png)
Fail regex example
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385717/Capture_d_écran_2019-07-24_à_00.45.03.png)
Form security
"God created CSRF"
Symfony
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385744/Capture_d_écran_2019-07-24_à_00.57.13.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385743/Capture_d_écran_2019-07-24_à_00.57.40.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385745/Capture_d_écran_2019-07-24_à_00.58.25.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6385746/Capture_d_écran_2019-07-24_à_00.58.41.png)
PWA / SPA
On form load
Request
Generate
Send
API
CSRF Token
Client
On form submit
Submit
Verification
Return
API
CSRF Token
Response
Summary
- ORM (or prepared requests)
- URL rewriting
- Fail2ban
- CSRF
But if a hacker succeed to connect to the server...
Dockerize your app
Will be closed to container itself
Can't expand to system or other containers
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593229/1300px-Docker_container_engine_logo.png)
Dockerize your app
Define ACL in your containers
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5593229/1300px-Docker_container_engine_logo.png)
Link fail2ban to containers
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6404037/Capture_d_écran_2019-07-30_à_19.02.05.png)
Link fail2ban to containers
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6404034/Capture_d_écran_2019-07-30_à_19.01.06.png)
Link fail2ban to containers
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6404033/Capture_d_écran_2019-07-30_à_18.59.53.png)
Are you developing
real-time apps and push data to clients ?
Websocket ?
You have to recode the security
Doesn't use TLS cert by default
Duplex connection
Custom protocol
Use server sent events
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6267228/Untitled.jpg)
MERCURE
What else ?
(Not Nespresso)
Improve basic PHP security
with Symfony's security component
- security-core
- security-http
- security-csrf
- security-guard
R.U.D.Y Attack
or
DDoS Attack ?
Be secure from
Use free and simple service
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/5613957/1200px-Logo_Cloudflare.svg.png)
Do you allow user to upload files and to display them ?
Webshell exploit
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6269265/Capture_d_écran_2019-06-18_à_14.01.48.png)
Main points to counter this exploit
File integrity
Limit extensions
No encoded payload into this
No escaped characters
What about Man In The Middle (MITM) ?
![](https://i.ytimg.com/vi/Ua9bUqdjWBc/maxresdefault.jpg)
Then protect your local network
And your devices
Any tools to test your app/network
SQLMap
Fuzz
Nmap
Hydra
Slowhttptest
MSFConsole
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6269287/nmap.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6269288/metasploit.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6269289/sqlmap-feature.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6269291/0-3.png)
"Best exploits are humans"
Mr Robot
Wants to know more on containerized services management
![](https://s3.amazonaws.com/media-p.slid.es/uploads/835108/images/6388496/CarteForum2019-SCOMBRAQUE.png)
![](https://media1.giphy.com/media/7K3p2z8Hh9QOI/giphy.gif)
Questions
deck
By darkweak
deck
- 405