Tagged Questions

Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
0answers
15 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
0
votes
1answer
79 views

PHP secure random number generator [on hold]

I just wrote this function and I was curious if anyone could find any flaws in it? It look pretty secure to me but I just want to make sure since I'm no cryptography expert. function ...
-1
votes
1answer
30 views

Nginx doesn't start [on hold]

There is something wrong in this piece of my code. But i cant find the problem already for 3 days. Any idea ? server{ listen 80 default_server; listen [::]:80 default_server ipv6only=on; root ...
0
votes
0answers
21 views

LFI Waf Bypassing help [on hold]

i encountered a LFI, where the WAF strips the slashes and some strings near to it: I tried using a truncated payload, it doesn't works! Example behavior of the app: Payload: ...
-4
votes
2answers
43 views

What is the best exploit of XSS within 100 characters? [on hold]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
1
vote
1answer
40 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
2
votes
1answer
97 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
2
votes
3answers
85 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
2
votes
1answer
61 views

Why protect files with sensative information with .htacces?

I was taught that an important step to securing a website (primarily with PHP) was to store all sensitive information such as database connection info, salt generation, etc. in a separate ...
0
votes
1answer
42 views

PHP altering function inputs [closed]

If $b below is a user input, are there any values that can be passed that may allow for the function inputs to be altered i.e adding a third input? If so are there any specific characters that should ...
0
votes
2answers
99 views

PHP - Need help to understand injected code

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
0
votes
1answer
78 views

AES 128bit decryption using a key longer than 16 bytes

I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt ...
2
votes
2answers
93 views

Attackers posting large HTML pages - just spam? or something more sinister?

More and more, lately - I've seen attackers posting complete HTML pages that seem to have nothing malicious - to php pages that aren't even listening to their POST (sometimes, it's a contact form, ...
5
votes
2answers
750 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
1
vote
1answer
81 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
4
votes
2answers
99 views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
3
votes
1answer
99 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-2
votes
2answers
55 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
2
votes
2answers
42 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
1
vote
1answer
50 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
1
vote
1answer
40 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
1
vote
1answer
88 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
1answer
71 views

Posssible hack on site?

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd. I have done lots of changes on this site ...
0
votes
3answers
963 views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
1
vote
1answer
50 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
4answers
133 views

How to exploit this include_once vulnerability in PHP?

I'm performing static analisys on a PHP code and came across with this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP ...
1
vote
1answer
60 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...
1
vote
3answers
73 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
3
votes
4answers
99 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
0
votes
1answer
32 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
1
vote
1answer
253 views

Why add “***” in user-agent in this malicious code?

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site. $ua = $_SERVER['HTTP_USER_AGENT']; ...
4
votes
1answer
829 views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
0
votes
1answer
78 views

PHP sprintf vulnerability?

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons: Warning: vsprintf() has been disabled for security reasons ...
2
votes
1answer
100 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
2
votes
1answer
99 views

Bypass Text Plain Rule

I want to know if I can allow uploading all types of scripts and add these rules to a virtual host configuration; so please advise and tell me if there will be some exploits that can be used to ...
6
votes
1answer
208 views

Two takes on PHP two way encryption - which one is preferable?

I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions... 1: The first one is derived from the official ...
0
votes
0answers
27 views

Exposing pm.status_path

Do you think it's dangerous to publicly expose PHP-FPM pm.status_path? It displays "Pool Status", "Active Processes status" and "Idle Processes status", showing Script path and Request URI.
2
votes
2answers
82 views

Securing commands

For a project I'm working on, I need to securely send commands between servers. These commands should not be able to be altered, and there should be some security about not being able to just keep ...
3
votes
1answer
287 views

Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
2
votes
1answer
141 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
0
votes
1answer
54 views

Webserver has suspicious file

A webserver I know has this file which is "decrypted" to this file Now my question: What damage can this script do? And how could I inspect it correctly? (The compressed version needs a password and ...
3
votes
0answers
43 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
-1
votes
1answer
46 views

Why injecting a php tag with XSS dosn't work? [closed]

So you all know about the XSS vulnerability but what I cannot understand is how come injecting a <?php ?> tag doesn't work? eg.: suppose there is a Stored XSS vulnerability in the index.php of a ...
-3
votes
1answer
80 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
8
votes
5answers
4k views

Shellshock attack scenario exploiting php

I've seen attack scenarios involving using wget on cgi-scripts, but how about a scenario exploiting a web server php script that issues an exec() or system() call to a bash script? As far as I can ...
1
vote
2answers
87 views

Should I validate authentication form inputs?

I've got a login page with a form where they can input their account's email address and password. I'm doing the following things before even attempting to authenticate a user: Validating the email ...
3
votes
1answer
108 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
1
vote
1answer
106 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
0
votes
0answers
32 views

Filter GET requests with regexp : Whitelist approach

I'm writing a new website with php, there is no backend but users will be able to input search terms through GET queries and I was wondering : is it safe to whitelist query parameters using regexp? ...
0
votes
2answers
54 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...