Simple-and-secure-accounts

A simple and secure php login framework with data-filtering and encryption using modern techniques.

Table of contents

• Usage
  • Prerequisites
  • Steps
• Features
• References
• Contributors
• License

Usage

Until we reach version 1.0 the module won't have an interface or full security. However, most features are currently supported or at least partially implemented.

The default user from sql/secure_accounts.sql contains these values:

• Username : testuser
• Email : tester@test.com
• Password : Test123

Prerequisites

Steps

• Change the variables in includes/psl-config.php to match your MySQL database connection.
• Run sql/secure_accounts.sql or add the structure to your MySQL database.

Features

• Setup interface.
  • [ ] Run and modify SQL query
  • [ ] Modify settings
• Users
  • [x] Log in
  • [ ] Two-factor authentication
  • [ ] Remember
  • [x] Register
  • [x] Log out
  • [ ] Profile
    • [ ] Picture
    • [ ] Password reset
    • [ ] E-mail change
  • [ ] Permissions
    • [x] Hidden pages
    • [x] Hidden content
    • [ ] Access based on level
• Protection
  • [x] SQL injection
  • [x] Session hijacking
  • [x] Brute-force attacks
  • [x] XSS
  • [x] Covert timing channel attacks

References

SQL injection

Session hijacking

Brute-force attack

Cross-site Scripting

Covert Timing Channel

Contributors

• Fly-d-e-v

License

This project is licensed under the MIT License. Licenses of tools and dependencies are not included and may vary.