van7hu

Site audits are one of the services that some of our clients have requested from us in the past. While a site audit might be done with a specific objective in mind, there's always a common reason: find, understand, and fix any potential holes or problems that could cause a service outage on the site, or on the server where it is hosted. In some cases, that's the only reason, whereas in other cases the outcome of the audit will inform a more important decision, such as a platform or server move, or a site rebuild, to name a few. Depending on the goal of an audit, the things to look at on the site might change a bit: is it a performance audit, a security one, or a general review to check the overall status of the site and the feasibility of keep evolving it in an efficient way? This post covers the details concerning security audits in particular, although some of the practices mentioned here do not belong exclusively to the realm of security, and will be equally needed in othe...

accepted To build this list I used 2 sources.  A Study In Scarlet  and  RATS . I have also added some of my own to the mix and people on this thread have helped out. Edit:  After posting this list I contacted the founder of  RIPS  and as of now this tools searches PHP code for the use of every function in this list. Most of these function calls are classified as Sinks. When a tainted variable (like $_REQUEST) is passed to a sink function, then you have a vulnerability. Programs like  RATS  and  RIPS  use grep like functionality to identify all sinks in an application. This means that programmers should take extra care when using these functions, but if they where all banned then you wouldn't be able to get much done. " With great power comes great responsibility. " --Stan Lee Command Execution exec - Returns last line of commands output passthru - Passes commands output directly to the browser system ...