Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQL injection search

github.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: SQL injection search

#32

Post by zapt02 »

astrodust wrote: post #26
soult wrote: post #14

Earlier quoted context omitted.

So a gaping security hole that compromises all data is less important than using a deprecated interface?

For an application with no exposure, arguably it is. When you upgrade to PHP 5.6 and your application grinds to a halt because mysql_query isn't available, you'll be wishing you'd fixed it sooner.

If you're on RHEL/CentOS, 2023 is gonna be a bad year.

(RHEL/CentOS is currently on PHP 5.3 and will stay there for a long time.)

Re: SQL injection search

#33

Post by dsl »

jonny_eh wrote: post #3
thiderman wrote: post #2

Heh, cute. This means Github could probably do some automated means of informing these people that their code is insecure and would be a danger to themselves and their users. I'm not sure if they should, but it's interesting that they could.

There's definitely an opportunity for a service to help developers spot obvious security holes. https://codeclimate.com/ is one I've used but it's Ruby only AFAIK.

Lots of these exist. Check out whitehatsec.com and veracode.com

Re: SQL injection search

#34

Post by dsl »

_pius wrote: post #31
hising wrote: post #19

I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes. Anything that is available today?

https://www.tinfoilsecurity.com/

Tinfoil scans remotely for known vulnerabilities (i.e. WordPress version X has exploit Y). What you really want is source code analysis. WhitehatSec.com and Veracode.com are the two huge players in this space.

Re: SQL injection search

#35

Post by gingerlime »

btipling wrote: post #20
a1a wrote: post #11

While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...

JavaScript version: https://github.com/search?q=extension%3Ajs+html+%2B&type...

this one seems to produce quite a lot of false-positives though, doesn't it?

Re: SQL injection search

#36

Post by kcen »

hising wrote: post #19

I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes. Anything that is available today?

For the Rails folks out there, I have had pretty good luck with Brakeman Scanner in the past.

http://brakemanscanner.org/

Re: SQL injection search

#38

Post by diminoten »

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them.

"We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing.

Why don't you see QA shops popping up like this?

Re: SQL injection search

#40

Post by ams6110 »

diminoten wrote: post #38

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.
Post reply on HN