<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>PHP Programming &#187; Security</title>
	<atom:link href="http://www.idontplaydarts.com/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.idontplaydarts.com</link>
	<description>A blog about Linux, Apache, MySQL, PHP and web application security</description>
	<lastBuildDate>Thu, 29 Jul 2010 14:08:22 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>MongoDB is vulnerable to SQL injection (in PHP at least)</title>
		<link>http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/</link>
		<comments>http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/#comments</comments>
		<pubDate>Thu, 29 Jul 2010 12:24:46 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[MySQL]]></category>
		<category><![CDATA[PHP]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Injection]]></category>
		<category><![CDATA[MongoDB]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=512</guid>
		<description><![CDATA[Its a misconception amongst some PHP programmers that because MongoDB doesn&#8217;t use SQL (all queries are passed in as either BSON or PHP objects which have been converted into BSON) it isn&#8217;t vulnerable to SQL injection. It is pretty easy to show that if your lazy and complacent when you code you can leave yourself [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Skills shortage leaves Australian Computer Society open to attack.</title>
		<link>http://www.idontplaydarts.com/2010/01/skills-shortage-leaves-australian-computer-society-open-to-attack/</link>
		<comments>http://www.idontplaydarts.com/2010/01/skills-shortage-leaves-australian-computer-society-open-to-attack/#comments</comments>
		<pubDate>Fri, 22 Jan 2010 03:04:40 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[HTML]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[ACS]]></category>
		<category><![CDATA[CSRF]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[XSS]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=475</guid>
		<description><![CDATA[According to the Australian Computer Society and DIAC (The department for immigration) there is a massive shortage in Australia of &#8220;Computing Professionals specialising in Network Security/Firewall/Internet Security&#8221;. 
No surprise there, whats more of a shocker is that the very people who assess the skills of would be migrants to Australia can&#8217;t even secure their own [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2010/01/skills-shortage-leaves-australian-computer-society-open-to-attack/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>How not to advertise for a PHP programming job</title>
		<link>http://www.idontplaydarts.com/2009/10/how-not-to-advertise-for-a-php-programming-job/</link>
		<comments>http://www.idontplaydarts.com/2009/10/how-not-to-advertise-for-a-php-programming-job/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 16:31:17 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[PHP]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[CSRF]]></category>
		<category><![CDATA[CSS]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[HTML]]></category>
		<category><![CDATA[Web development]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=451</guid>
		<description><![CDATA[So I got an email today for a job in Tower Hill (thats central london).  The job came with a simple programming test to write a script that parsed a tab separated file and produced a batch script as the output. They kindly provided a working copy of their solution on their website so [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/10/how-not-to-advertise-for-a-php-programming-job/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Secure your wifi connection using SSL + mod_proxy</title>
		<link>http://www.idontplaydarts.com/2009/10/secure-your-wifi-connection-using-ssl-mod_proxy/</link>
		<comments>http://www.idontplaydarts.com/2009/10/secure-your-wifi-connection-using-ssl-mod_proxy/#comments</comments>
		<pubDate>Mon, 05 Oct 2009 15:52:16 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[apache]]></category>
		<category><![CDATA[mod_proxy]]></category>
		<category><![CDATA[Proxy]]></category>
		<category><![CDATA[ssh]]></category>
		<category><![CDATA[tunnels]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=411</guid>
		<description><![CDATA[Being ultra paranoid about using other peoples Wifi connections I&#8217;ve come up with a solution to make things a little safer. Its by no means new having been around for quite a while but it works well. Ive setup Apache on my web server to act as a proxy server for connections originating from 127.0.0.1. [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/10/secure-your-wifi-connection-using-ssl-mod_proxy/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Disable google translate</title>
		<link>http://www.idontplaydarts.com/2009/09/disable-google-translate/</link>
		<comments>http://www.idontplaydarts.com/2009/09/disable-google-translate/#comments</comments>
		<pubDate>Fri, 25 Sep 2009 10:09:19 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[HTML]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=396</guid>
		<description><![CDATA[Got a problem with dodgy users from obscure countries causing havoc on your website? I recently noticed a huge number of people using Google translate to access a website. If you want to prevent people using Google translate on your website you can use.

&#60;meta name=&#8221;google&#8221; value=&#8221;notranslate&#8221; /&#62;

In your HTML page inside the head section. Users [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/09/disable-google-translate/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Detecting a fake email address using Markov chains</title>
		<link>http://www.idontplaydarts.com/2009/08/detecting-a-fake-email-address-using-markov-chains/</link>
		<comments>http://www.idontplaydarts.com/2009/08/detecting-a-fake-email-address-using-markov-chains/#comments</comments>
		<pubDate>Sat, 22 Aug 2009 09:29:47 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[MySQL]]></category>
		<category><![CDATA[PHP]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Email Addresses]]></category>
		<category><![CDATA[fraud]]></category>
		<category><![CDATA[Markov]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=364</guid>
		<description><![CDATA[Markov chains are a set of states where any state is only dependant on the previous state. These can be used to generate &#8220;real-looking&#8221; words from a given set of text. By the same methods we can decide if a string is a valid word or a load of garbage by assessing each letter and [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/08/detecting-a-fake-email-address-using-markov-chains/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Defeating open proxy servers</title>
		<link>http://www.idontplaydarts.com/2009/08/defeating-open-proxy-servers/</link>
		<comments>http://www.idontplaydarts.com/2009/08/defeating-open-proxy-servers/#comments</comments>
		<pubDate>Thu, 20 Aug 2009 22:25:38 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[PHP]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[fraud]]></category>
		<category><![CDATA[Proxy]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=361</guid>
		<description><![CDATA[I&#8217;ve recently been in a situation where lots of users were abusing a website using a series of open proxies. They were using these open proxies to commit large volumes of fraud. A static list of known proxies can help to combat this issue but you end up fighting a loosing battle trying to keep [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/08/defeating-open-proxy-servers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Mitigating the insider threat</title>
		<link>http://www.idontplaydarts.com/2009/06/mitigating-the-insider-threat/</link>
		<comments>http://www.idontplaydarts.com/2009/06/mitigating-the-insider-threat/#comments</comments>
		<pubDate>Thu, 25 Jun 2009 22:44:47 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[Insider threat]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=229</guid>
		<description><![CDATA[If you look at the number of hacking incidents that have been reported 58% of the incidents are known or suspected to have come from outsiders, 27% from insiders, and 15% from an unknown origin.
That is to say it is the very employees of an organisation are responsible for about 30% of the over all [...]]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/06/mitigating-the-insider-threat/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Problems with DKIM keys and PostFix</title>
		<link>http://www.idontplaydarts.com/2009/06/problems-with-dkim-keys-and-postfix/</link>
		<comments>http://www.idontplaydarts.com/2009/06/problems-with-dkim-keys-and-postfix/#comments</comments>
		<pubDate>Fri, 19 Jun 2009 18:43:33 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[DKIM]]></category>
		<category><![CDATA[Postfix]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=223</guid>
		<description><![CDATA[I've been trying to get dkimproxy.out to work with postfix - which I've managed to do. The only issue is that it doesn't seem to be signing the messages correctly - not quite sure whats wrong.]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/06/problems-with-dkim-keys-and-postfix/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Breaking a CAPTCHA &#8211; rules for good design</title>
		<link>http://www.idontplaydarts.com/2009/06/breaking-a-captcha-rules-for-good-design/</link>
		<comments>http://www.idontplaydarts.com/2009/06/breaking-a-captcha-rules-for-good-design/#comments</comments>
		<pubDate>Sun, 07 Jun 2009 16:10:08 +0000</pubDate>
		<dc:creator>Phil</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Captcha]]></category>
		<category><![CDATA[PHP GD]]></category>
		<category><![CDATA[Web development]]></category>

		<guid isPermaLink="false">http://www.idontplaydarts.com/?p=122</guid>
		<description><![CDATA[The main problem with the Captcha is that sometimes the people who implement them are lazy or have no knowledge about how create an image that a computer would find hard to decode. Captchas must be generated server side and over the last few months I have seen an increase in the number of client-side captchas generated by software such as Adobe Flex. If you generate a Captcha client side it is not secure.]]></description>
		<wfw:commentRss>http://www.idontplaydarts.com/2009/06/breaking-a-captcha-rules-for-good-design/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
