Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
2answers
1k views

Implementing SRP Challenge login system *with SSL* (Using PHP)

My question: Anyone knows how to implement SRP / Diffie-Hellman authentication in PHP (or if this has already been done)? (Some details) I'm using CodeIgniter with TankAuth (both latest version) ...
1
vote
1answer
1k views

Path Truncation not working in PHP while exploiting LFI

From what I understand in PHP '/etc/passwd/' or '/etc/passwd/./././' should be treated just the same as '/etc/passwd' I am using PHP 5.4 and this does not seem to be true: php -r ...
6
votes
2answers
945 views

Modern, security-conscious, PHP book?

I posted this on StackOverflow and they redirected me here. Sorry if this isn't the correct area! After creating a simple login system and trying to protect it against things like SQL injection, ...
1
vote
4answers
251 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
4
votes
3answers
1k views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
-1
votes
1answer
392 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if ...
3
votes
2answers
2k views

How could attackers exploit $_SERVER['HTTP_REFERER']

I've been warned that PHP's $_SERVER['HTTP_REFERER'] is a common attack vector for websites. What are ways that attackers exploit this function? How can I guard against them?
2
votes
1answer
507 views

Configuration settings for sessions in php

I recently found the following configuration settings: use-strict-mode hash-bits-per-character hash-function and I have some questions about them: Use-strict-mode says the following: ...
15
votes
5answers
6k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
8
votes
3answers
879 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
1
vote
3answers
459 views

Is this a secure function for checking if a user has not stolen a session cookie?

As an exercise for class, I'm creating a class that manages user sessions. The session details are stored in a database and also there is a $_SESSION[user_id] variable to carry in between pages. The ...
1
vote
0answers
97 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
0
votes
2answers
780 views

Are PHAR archives secure?

I want to send the new releases of my application in encrypted, signed archives to the server. Are PHAR archives a good solution to do that? Is PHAR secure enough?
1
vote
1answer
145 views

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)?

Is it possible to add backdoor to a file with the same size and crc32 checksum (4bytes)? (The file does not contain byte code, it contains program code as text. The language is PHP.)
7
votes
2answers
3k views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
10
votes
6answers
10k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
0
votes
1answer
610 views

Php Session ID, http VS https [duplicate]

So I was doing some tests with the php session ID cookie. I know that data is stored on the server however, a cookie with a unique ID is stored so that the server can recognize the client while ...
11
votes
3answers
2k views

How to deobfuscate this PHP malware?

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
0
votes
1answer
1k views

Email Spoofing Modified Headers

I have be reading more and more about email spoofing and was curious how some things are done. I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, ...
6
votes
1answer
312 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
19
votes
4answers
9k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
0
votes
1answer
219 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
2
votes
1answer
4k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
0
votes
3answers
5k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
36
votes
6answers
5k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
4
votes
3answers
1k views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
6
votes
3answers
6k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
36
votes
6answers
7k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
1
vote
2answers
1k views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
3
votes
2answers
181 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
7
votes
1answer
1k views

Does Heartbleed affect servers if OpenSSL was only used to generate the certificate?

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module. Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that ...
1
vote
4answers
6k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
9
votes
3answers
24k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
2
votes
1answer
714 views

PHP and max_input_vars configuration

I am looking into php's max_input_vars setting How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates ...
4
votes
1answer
2k views

Do PHP frameworks such as Zend, symfony and CakePHP provide default protection against cross site scripting?

ASP.NET MVC provides default protection against cross site scripting. Just wondering, if PHP frameworks do the same?
0
votes
2answers
384 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
1
vote
0answers
2k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
1answer
230 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
2
votes
4answers
5k views

Malicious code in image. Harmful?

In my website, a user can upload his profile picture. After analysis of some pictures, I have found some pictures with malicious PHP code, just like the upload script. As an example, I have found a ...
-1
votes
1answer
225 views

Secure a string in PHP [closed]

What do you think it's the best method to secure a string in PHP? I speak of hiding its content and avoid malicious changes by the user, but be able to recover the information. We can use the ...
1
vote
4answers
1k views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
4
votes
3answers
7k views

How secure is ionCube compiled code?

I use ionCube to keep the code I write concealed for my customers. If I would store a password inside the code and compile (not encrypt) it with ionCube encoder, would it be possible for a potential ...
1
vote
3answers
3k views

Email activation string with MD5'd random number and email secure?

For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address. $key = ...
2
votes
1answer
681 views

php crypt - trailing dollar sign - extract only the salt part from hash - padding the salt

I am reading up on PHP's crypt() function. I have a few questions on it - What is the significance of the trailing '$' sign at the end of the salt string that I see in most examples. The manual ...
1
vote
1answer
387 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
-1
votes
1answer
2k views

MCRYPT_RIJNDAEL_256 max key allow? [closed]

maximun key for MCRYPT_RIJNDAEL_256 ? mcrypt_encrypt( MCRYPT_RIJNDAEL_256, <<==hash_hmac using sha512==>>, $text, MCRYPT_MODE_ECB, $iv ) Warning: mcrypt_encrypt(): Size of key is too large for ...
1
vote
0answers
2k views

blueimp jQuery-File-Upload getting PHP Hacked [closed]

I really like this upload package and want to use it, but from the time I set it up on my server, I've been hacked twice by something called the AnonGhost virus (anonghost.com). I tracked the ...
-8
votes
4answers
645 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
7
votes
1answer
9k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
2
votes
1answer
194 views

How can I store information securely when I can't use crypt or a hash?

I'm creating an application for Google Glass (technically it's Glassware, but whatever). The user will do the following steps when going through setup for the Glassware: Go to my website, redirected ...