Security audit

[andybraren]

• Strip zero-width characters and any display tricks, which could lead to malicious things being pasted elsewhere
• Kirby considerations for user-uploaded files and text sanitization
• https://news.ycombinator.com/item?id=16728207
• JS
  • https://gomakethings.com/preventing-cross-site-scripting-attacks-when-using-innerhtml-in-vanilla-javascript/
• Collections
  • Hacker101, a bunch of video lessons on web-related security stuff. XSS, sessions, file uploading, etc.
• Building Secure JavaScript Applications by Gergely Nemeth

Server configuration

• Containerization
  • Watch this Cyber Frontiers video with Christian Johnson (21:20)
• Use strip_tags() and esc() on all user input
• Password reset implementation in ShopKit explained
• Double check password reset implementation
  • https://forum.getkirby.com/t/kirby-panel-forgot-password/2192
• Prevent code execution within user-editable directories
• Secure VPS access
• https://code.tutsplus.com/tutorials/5-helpful-tips-for-creating-secure-php-applications--net-2260
• How Discourse tries to keep password hashes secure
• How to defend your website with ZIP bombs
• PHP security
• https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
• Content security policy
  • https://githubengineering.com/githubs-csp-journey/
• https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet
• http://php.net/manual/en/security.php
• https://www.sitepoint.com/8-practices-to-secure-your-web-app/
• https://www.smashingmagazine.com/2017/04/secure-web-app-http-headers/
• The potential for CDN resource providers to track your visitors
• https://www.smashingmagazine.com/2017/04/secure-web-app-http-headers/
• http://phpsecurity.readthedocs.io/en/latest/Cross-Site-Scripting-(XSS).html
• Cross-site scripting
  • Demo
• Use rel="noopener" on any user-created links
• https://securitycafe.ro/2015/01/05/understanding-php-object-injection/
• Security Headers
• https://snyk.io/blog/known-vulnerabilities-in-javascript/
• https://scotthelme.co.uk/csrf-is-dead/
• https://forum.getkirby.com/t/kirby-htaccess-rules-moved-to-kirby-secrets/5474/3
• https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers
• https://paragonie.com/blog/2016/10/guide-automatic-security-updates-for-php-developers
• http://recursive.codes/blog/post/9
• https://blogs.dropbox.com/tech/2017/03/preventing-cross-site-attacks-using-same-site-cookies/
• https://ma.ttias.be/caa-checking-becomes-mandatory-ssltls-certificates/
• Firewall
  • DigitalOcean Cloud Firewall
  • http://www.wpbeginner.com/plugins/best-wordpress-firewall-plugins-compared/
• https://www.digitalocean.com/community/tutorials/how-to-perform-security-audits-with-lynis-on-ubuntu-16-04
• Look into Sub-Resource Integrity, and HSTS
• SSL / HTTPS
  • A Complete Guide To Switching From HTTP To HTTPS, massive step-by-step guide with a good explanation of each part, although it's clear that using something like Let's Encrypt is far easier.
• PHP code audit
  • RIPS security maybe, and check out their holiday calendar
• https://www.digitalocean.com/community/tutorials/automating-initial-server-setup-with-ubuntu-18-04
• https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers

Create a good honeypot

• https://stackoverflow.com/questions/43379125/prevent-php-web-contact-form-spam
• https://stackoverflow.com/questions/2387496/how-to-prevent-robots-from-automatically-filling-up-a-form
• https://stackoverflow.com/questions/15319942/preventing-bot-form-submission
• https://stackoverflow.com/questions/36227376/better-honeypot-implementation-form-anti-spam
• https://stackoverflow.com/questions/26452716/how-to-create-a-nuclear-honeypot-to-catch-form-spammers
• https://nedbatchelder.com/text/stopbots.html
• Making it time-based, one field has the time of request and isn’t easily changed, and 15 seconds need to pass before the comment is saved? Although, people copy and paste sometimes. Tricky.