My website got hacked. The hacker got to the .php files on my server and they included my mysql password in plaintext, like this:>mysql_connect("localhost", "me", "mypass");What's the proper way to do it, anons? Where do I store the password and how do I get this php script to read it then?I never thought someone could access the files directly so it didn't see this as a problem.From what I gathered, he used a vulnerability in the vsFTPd version I use.
>>109403363It depends on how you deploy, but generally your code reads the value from environment variables, which get injected into your server at runtime.
>>109403363Store credentials outside your source/web root with restrictive permissions, preferably manage them with a proper secrets system, use a least-privileged database user, and rotate them. But once somebody owns the machine that legitimately needs the password, there is no clever PHP hiding place that makes the password inaccessible to that attacker. Fix the server compromise first.
>>109403363Put your log in and passes on a thumb drive. Then you shove the thumb drive up your ass. Make sure your shove in deep so your dildo won't damage it when you're ramming it in an out. When you need access just shove your little peepee into a free USB portband BOOM there ya go!!!
>>109403454I do this!
>>109403363>php>ORACLE """mysql""">What's the proper way to do itfor starters, look for an overview of technological advancements in the 21st century bruv
Well firstly, your FTP server was running as its own user, right? Why was that user allowed to read these files? Or run anything else?
>>109403363environment variablesexport $MYSQL_PASSWORD='test';Then in your phpmysql_connect("localhost", "me", getenv('MYSQL_PASSWORD'));
>>109403625Said he on 4chan, a site he loves because it's old
>>109403822which also go hacked recently, kek.it's true, though. he doesn't have to change his tech stack, just keep it up-to-date and know wtf he's doing.
>>109403851People always say 4chan is kino and based because it's stuck in 2008But honestly 4chan is the worst coded site I've ever seenIt's just a single imgboard.php file that's 10k lines longI bet nobody in the world knows how it works.
>>109403363If someone has access to your server then it’s too late and hiding the sql credentials won’t save you from being jam’d.
>>109403363make it so mysql binds to localhost only and restrict access to the local port using selinux or use uds. don't know if mysql supports uds listener though. most shitware doesn't.
>>109403972does ORACLE(TM) mysql not support unix sockets like postgres, so you don't even have tcp exposure to begin with?also, localhost=127.0.0.1 is not good security theater. using another 127.0.0.0/24 address (with a random high port too of course) is better.
>>109403363what is in the database, anon?
>>109404022The Epstein Client List.
>>109404022A collection of all the dildos I’ve purchased over the years, including their size and shape and place of sale. When the hacker found it he made me pay a lot of money to him to stay quiet about it. I’m literally shaking.
>>109404228>I’m literally shaking.Yeah but that's from the vibrating 1.5m long horse dildo anon.
>>109403822>4jeet>a site he loveswho told you that? lol
>>109403363Feels bad manReading the values from environment variables is the simplest. It's not a magic bullet, but it would actually protect you if they could only access the php scripts in the document root and they don't have a shell or remote code execution.I would also containerize everything and give them the least privilege they need.
I hate AI for so many reasons.One reason is that Claude makes hacking so much easier.Claude will analyze all the code on the server and tell you how to exploit it
>>109403851What is there to hack on 4chan? Oh no the bad people now have my IP address and may or may not know I like to browse /e/.>>109403874What's the issue? It just works.
>>109405409>What is there to hack on 4chan? The hacker did it for the lulz. The only thing that really came out of it from what I remember is the source code and janny emails.
>>109403363>The hacker got to the .php fileshow?
>>109405449and fingerprintingHe should have dumped the db, but nooo
>>109408202Did you even read the post
>phpwhat fucking year is it?
>>109409562>umm, it's current year sweaty
>>109403363Host a static site instead.
>>109403664if you do this you have to make sure you properly clear the value after use too otherwise it just stays in memory for anything else to read.
