Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

4
votes
1answer
2k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...
0
votes
1answer
50 views

Safest way to access data from an SQL server

I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
0
votes
1answer
31 views

Any vulnerabilities in user input to web Server running Apache and PHP?

There is understandably a lot of emphasis on sanitizing user input handed off to PHP on a web server and numerous opinions on doing it. Can someone please confirm there is no security problems with ...
3
votes
2answers
63 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
3
votes
1answer
42 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
8
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
5
votes
2answers
177 views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
0
votes
1answer
61 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
5
votes
1answer
71 views

How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

PHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new ...
1
vote
1answer
52 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
-5
votes
2answers
108 views

Is this something exploitable in this code?

Is there any possibility to pass this weak comparison? Can user input a file with an extension not contained in $allowed and get past the security check? $allowed = array('txt','docx'); if ...
1
vote
1answer
63 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
1
vote
4answers
180 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
1
vote
1answer
32 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
1
vote
1answer
46 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
1
vote
2answers
86 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
4
votes
1answer
91 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
6
votes
1answer
58 views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
-1
votes
1answer
51 views

Using and creating a custom 2 way encryption function [closed]

I am trying to create a 2 way encryption function using PHP. As yet I do not have a very good system at all, it is severely flawed and highly insecure, it is using a substitute cipher running from ...
2
votes
1answer
41 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
4
votes
2answers
342 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... ...
-1
votes
1answer
40 views

Token in URL changes on click [closed]

Logging into OpenCart admin, I find a token in its URL: http://localhost/opencart/admin/index.php?route=common/dashboard&token=xOHq2UzQ0YwKTubXgxNpGFySmAA9W90z The synchronizer token pattern is ...
1
vote
1answer
31 views

Logout CSRF Protection [duplicate]

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
0
votes
1answer
42 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do ...
5
votes
1answer
81 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
8
votes
1answer
61 views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilites with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
3
votes
0answers
92 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
-4
votes
2answers
54 views

php malware file-names [closed]

The following is a list malware php file-names that I found on my server some time ago, looking at the source these were clearly to allow a hacker to take full control of my server. I'm posting these ...
1
vote
1answer
71 views

WordPress site is infected with malware, cannot find dropper [duplicate]

I am in a bit of an annoying situation. I inherited responsibilities of a WordPress multisite once managed from from other contractors and that site has been infected with virus dropping malware. I ...
1
vote
2answers
63 views

Application that uses USB token to assign user on a server

I have the following situation: One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password; When the user is logged he ...
1
vote
1answer
43 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
26
votes
7answers
4k views

How to replace SSL/TLS?

I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS) The data that ...
4
votes
2answers
98 views

Saving Personal Information (Name, Address, Phone, Email) in MySQL Database

I'm going to build a web app for people to sign up and pay for a membership. The transaction information will all be processed through Authorize.NET but we save the rest of the information (Name, ...
2
votes
0answers
61 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
0
votes
1answer
170 views

AngularJS - Can a response from an $http.post to PHP be modified?

I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the ...
2
votes
2answers
101 views

Using mutiple keys to encrypt the same text with the password as a key but someone changes their password

I want to make a messaging social network but am worried about the NSA wiretapping all my members at once without merit like they wanted to do with Lavabit. I've found a way to encrypt messages using ...
0
votes
2answers
271 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
1
vote
1answer
61 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
1
vote
1answer
77 views

Before an attacker attempts to exploit eval(), how would they suspect that it is being used by a target application?

I am asking the question in the context of XSS RCE/RFI as a result of server-side eval() exploitation. It is often recommended to avoid using it, but it is not clear to me how one would attempt to ...
3
votes
2answers
106 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
1
vote
3answers
113 views

Using HTTP GET instead of a POST request can leak source code?

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server ...
-1
votes
1answer
38 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? ...
0
votes
1answer
47 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
3
votes
1answer
149 views

Understanding hack on ecommerce site

I need help in understanding this hack and maybe I can get more information out of it. This script was inserted on our website (maybe through a weak password): eval(atob("string")); the string ...
1
vote
1answer
57 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
6
votes
4answers
991 views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
-1
votes
1answer
64 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
1
vote
1answer
54 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
-4
votes
1answer
86 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column ...