#PHP SANDBOX HOW TO#

There will always be a case of false positives or false negatives. I don't think that any whitelist/blacklist approach can ever be 100% accurate. I'm far from being a PHP expert, so my comments are more general rather than specific.

#PHP SANDBOX HOW TO#

In short, I would like to know what elements I should add/delete from the list.Īny other suggestions/advice on how to go about this will be highly appreciated. (I am not sure why they are present in the first place) So, by blocking DNS function calls like dns_check_record and gethostbyname are we restricting the scope of execution for the script unnecessarily. So, we would like our reply to be as close as possible to a real reply. Is this list good enough? Does this make the sandbox secure enough to be made part of the web app honeypot?īeside blocking function calls like this, are there anymore security measures that should be taken? After that, the entire sandbox process gets killed. Here's a complete list of the functions that have been considered.Īlso, the input script is run only for a maximum of 10 seconds in the sandbox. All the others function just return nothing. Some functions such as exec, disk_free_space have been rewritten to send out fake replies. Using the rename_function and override_function, vulnerable PHP functions have been rewritten. In order to build the sandbox, we used the Advance PHP Debugger (ADP). We hope to fool the attacker into believing that this is a genuine response and thus continue with the next step of his attack.

It should run the file in a safe environment and return the result, embedding the output of the PHP script. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. I am working on a PHP sandbox for a Web Application Honeypot.

Php sandbox