View Single Post
  #4  
Old 03-23-2013, 6:16 PM
ocabj's Avatar
ocabj ocabj is offline
Calguns Addict
 
Join Date: Oct 2005
Location: Riverside
Posts: 7,448
iTrader: 41 / 100%
Default

When I say "web daemon" I'm referring to the actual web server program. Typically, most web servers use Apache HTTPD, or the httpd service. httpd needs to be initially started as root (superuser) in order to bind to a privileged port (e.g. port 80), but all the httpd child processes (if the admin setup apache securely) will run as a non-privileged user. Usually that user is also called 'httpd', 'apache', 'www', or some other reserved username. Since httpd needs to be able to at the very least read your web directory in order to serve it out to the world, you usually have your web docs folder world readable (or at the very least, group readable for the httpd user's group).

Anyway, as long as you don't have any dirs or files that are writeable by the httpd user or httpd user's group, you should be fine, but this of course assumes that the web daemon isn't actually running as root for all child processes. Otherwise, any poorly written php code (especially anything that can write to disk) could potentially give an attacker a way to write to your web docs directory (or any files within).

Shell is basically an interactive interface to execute commands on the system. For example, you might SSH into your server to get to a command line interface. That is a shell. There are some functions in php that can be exploited (if they are not validating input) to invoke shell commands on the web server.
__________________

Distinguished Rifleman #1924
NRA Certified Instructor (Rifle and Metallic Cartridge Reloading) and RSO
https://www.ocabj.net | http://jocabphoto.com

My AR15 Service Rifle - Used for CMP/NRA High Power Service Rifle Competitions
My Eliseo R5 (Remington 700) Tube Gun - Used for NRA High Power (Match Category) Competitions
My M1 Garand Service Rifle - Used for JCG Matches, rebuilt by Dean's Gun Restorations
Reply With Quote