PHP environment security auditing tool modeled after the phpinfo() function
License
bigdeej/PhpSecInfo
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
## PHPSECINFO _see LICENSE for copyright and license info_ Mailing List for bug reports, feedback, etc: http://lists.phpsec.gcosoftware.com/mailing ### WHAT IS PHPSECINFO? PHPSecInfo is a PHP environment security auditing tool modeled after the phpsecinfo() function. From a single function call, PHPSecInfo runs a series of tests on your PHP environment to identify potential security issues and offer suggestions. It can be useful as part of a multilayered security approach. #### WHAT IS PHPSECINFO NOT? * It is not a replacement for secure coding practices * It does not audit PHP code * It is not comprehensive test for either your hosting environment or your web application * It is not the "final word." PHPSecInfo identifies *potential* problems and offers suggestions for improvement. Your environment may _require_ certain settings that trigger cautions or warnings. ### HOW DO I USE PHPSECINFO? The simplest way: * Uncompress and upload the contents of the archive to your web server's document root * Open a browser and view the index.php file where you've uploaded the files (probably something like http://www.yourdomain.com/phpsecinfo/index.php) ### WHAT DO I DO IF I GET A NOTICE OR WARNING? Read the explanation of the result carefully. Research the issue on-line -- resources like the php.net official docs and the PHP Security Guide are very useful. Investigate why your environment is set up in such a way. If there's not a compelling reason to keep it as-is, you should probably A by no means comprehensive list of resources to get your started: Web Sites: http://www.php.net/manual/en/security.php http://phpsec.org/projects/guide/ http://phpsec.gcosoftware.com/projects/phpsecinfo/guide/ Books: http://phparch.com/pgps http://phpsecurity.org/ http://apachesecurity.net/ ### HOW CAN I CUSTOMIZE THE OUTPUT OF PHPSECINFO? PHPSecInfo is intended to be used as a self-contained tool. However, you can obtain the test results in an array and then present this data in your preferred format. Example: <code> require_once('PhpSecInfo/PhpSecInfo.php'); // instantiate the class $psi = new PhpSecInfo(); // load and run all tests $psi->loadAndRun(); // grab the results as a multidimensional array $results = $psi->getResultsAsArray(); echo "<pre>"; echo print_r($results, true); echo "</pre>"; // grab the standard results output as a string $html = $psi->getOutput(); // send it to the browser echo $html; </code> ### HOW CAN I OFFER FEEDBACK, REPORT BUGS, COMPLAIN, ETC.? The best way is to follow our project on Github: https://github.com/bigdeej/PhpSecInfo
About
PHP environment security auditing tool modeled after the phpinfo() function
Resources
License
Stars
Watchers
Forks
Packages 0
No packages published