Speaking at POC 2008
August 3rd, 2008 | by Stefan Esser |
I will present a session at this year’s Power of Community hacking conference in Seoul about vulnerabilities in closed source PHP applications.
Session: Vulnerability Discovery in Closed Source/Encrypted PHP Applications
Security audits of PHP applications are usually performed on a source code basis. However sometimes vendors protect their source code by encrypting their applications with runtime (bytecode-)encryptors. When these tools are used source code analysis is no longer possible and because these tools change how PHP works internally, several greybox security scanning/fuzzing techniques relying on hooks fail, too.This talk will show how different PHP (bytecode-)encryptions work, how the original bytecode can be recovered, how vulnerability discovery can still be performed with only the bytecode available and how feasible PHP bytecode decompilation is.
Unlike my previous talks about PHP Bytecode Analyses at IPC 2007 and PHP London 2008 this talk is not a simple introduction to PHP Bytecode or binary analysis. I will demonstrate how we at SektionEins discover security holes in Closed Source PHP applications when a client ask for this.
See you in Seoul between 13th and 14th November.
서울에서 11월 13일에서 14일에 만나요!