Cracking Drupal: A Drop in the Bucket
Format: PDF / Kindle (mobi) / ePub
The first book to reveal the vulnerabilities and security issues that exist in the sites that have been built with Drupal?and how to prevent them from continuing Drupal is an open source framework and content management system that allows users to create and organize content, customize presentation, automate tasks, and manage site visitors and contributors. Authored by a Drupal expert, this is the first book to reveal the vulnerabilities and security issues that exist in the sites that have been built with Drupal?and how to prevent them from continuing. The main goal of this guide is to explain how to write code that avoids an attack in the Drupal environment, while also addressing how to proceed if vulnerability has been spotted and then regain control of security.
versions of Drupal (for example, the PHPIDS module was recently abandoned and then picked up by a new maintainer). So while these are recommended as modules Chapter 3 ■ Protecting Your Site with Configuration 41 that provide potential methods to improve the security of the site, you should still review the code yourself for weaknesses prior to installing one of these modules. Also, new modules are created frequently, so you are encouraged to review new modules in the Security category
./sites/default/ settings.php have been made, so you should remove write permissions to them now in order to avoid security risks. 4. After that, you are asked to fill in site-specific information. This information includes a site email address, all the particulars for the administration account, and time zone information. You also get an automatic enabling of Clean (SEO friendly) URLs together with the comforting message, ‘‘Your server has been successfully tested to support this
SecurID token, sometimes referred to as an RSA key fob. Figure 1-3 Insufficient authentication from the Vulnerable module lets an attacker become user 1, or 3, or 30, without any proof. C A U T I O N In the example Vulnerable module, there is a dubious feature that lets any user impersonate any other user on the site simply by specifying the user ID number in the URL at vulnerable/insufficient-authentication/1. Specifying the 1 is especially dangerous because user 1 on a Drupal site is a
MD5 (Message-Digest algorithm 5) hashed version of the password, and the email that was used when the account was created (stored in the init field). You can see the result of this modification in Figure 1-6, where in addition to the normal results you also see sensitive data like the hashed version of the password and email address. With the hashed password and email addresses of a user, an attacker can prey on the fact that most users use a limited number of passwords and try to use that