Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

6
votes
8answers
681 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
2
votes
1answer
571 views

Can /etc/passwd file be accessed on a cpanel shared hosting account?

Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
9
votes
1answer
855 views

Why do attackers bother (trivially) obfuscating their source code?

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example: ...
6
votes
2answers
201 views

HTTP daemon and Webroot permissions

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user. I have ...
2
votes
2answers
145 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
7
votes
3answers
15k views

How can I use this path bypass/exploit Local File Inclusion?

I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
10
votes
3answers
1k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
4
votes
3answers
5k views

PHP crypt() or phpass for storing passwords?

When storing passwords, should I use PHP's built in crypt or phpass? If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
10
votes
4answers
1k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
2
votes
1answer
667 views

Advice if safe from mail header injection PHP [duplicate]

Possible Duplicate: PHP mail() Header Injection Prevention Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
8
votes
1answer
467 views

PHP 5.3.9 Vulnerability Help

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits. This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
3
votes
3answers
1k views

How can I make it more difficult for a user to create multiple accounts?

I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts. What all of a user can be traced? I'm thinking: IP address Mac address ...
3
votes
1answer
3k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we ...
5
votes
2answers
3k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
5
votes
2answers
4k views

Why don't we use MAC address instead of IP address?

I can use the system function in PHP to get the MAC address of site visitors (probably most of you know). Why do we use IP addresss to check whether someone is stealing a cookie or not? Does the ...
2
votes
2answers
322 views

How to properly secure OO PHP CMS?

I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
2
votes
1answer
64 views

How to install client securely?

I'm writing a program in PHP that sends data from one master to many clients (all Joomla websites). When the client software is installed, it should send a message to the master identifying itself, ...
1
vote
3answers
537 views

Login System Security Suggestions

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup: nonce to check if the login originated from our login form session and cookie auth mixed - in ...
4
votes
1answer
252 views

php security courses

I got asked today by my boss if I wanted to do some php security courses, however I am not even sure other than the zend securing php applications course if any exist could any one provide any links ...
4
votes
2answers
194 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
4
votes
3answers
595 views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
3
votes
1answer
143 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...
3
votes
3answers
346 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering that is there any necessity to do that if we've already cast it? $num = (int) $num; can we use real_escape() ...
3
votes
3answers
6k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
2
votes
3answers
4k views

How to fix specific XSS issues in URL via php?

I am using Netsparker community edition for checking my app for any general security holes. I'm getting a lot of following XSS probable issue areas: my_php_file.php?nsextt=" ...
6
votes
4answers
570 views

Is there any chance PHP developers themselves implement backdoors in PHP core?

This is not a concern that I personally have,no! In my job environment I've heard from programmers and non programmers that PHP developers always put secret backdoors in PHP that no one has access to ...
8
votes
2answers
2k views

PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?

For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
3
votes
2answers
2k views

sanitizing input/output in php/codeigniter

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output. Background: Users can submit reviews to the site, ...
5
votes
1answer
954 views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
5
votes
1answer
496 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
4
votes
3answers
423 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
2
votes
1answer
321 views

Malicious(?) PHP / BASH Script. What is it?

I'm not sure if this is against the rules of the site. If it is, please let me know and I'll delete the question. I've seen variations of this script floating around recently. What the heck is it, ...
2
votes
2answers
411 views

PHP socket_connect Stack Overflow

In the desciption of the vulnerability: Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to ...
6
votes
2answers
498 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
2
votes
4answers
2k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
3answers
294 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
40
votes
5answers
5k views

Password security in databases - today still best practice? [duplicate]

Possible Duplicate: Which password hashing method should I use? There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am ...
1
vote
0answers
566 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
5
votes
3answers
628 views

Is there a good reason to turn off phpinfo()?

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
2
votes
1answer
953 views

Help in understanding a PHP exploit code found on a wordpress application

I've found this code in base 64 on all php files of one of my client's sites (wordpress) and I'm trying to understand what it does. I'm also trying to figure out if it was an application exploit or a ...
6
votes
2answers
201 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
4
votes
4answers
823 views

Database Security Best Practices for E-Commerce Site [duplicate]

Possible Duplicate: Securing an E-commerce site I'm developing an e-commerce site in a LAMP environment. Is it advisable to separate data on to different servers (i.e. to have one server as ...
6
votes
2answers
1k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
8
votes
5answers
915 views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
3
votes
2answers
499 views

How can a cracker get past through this regexp?

I recently had a chat with a cracker and he told me that he can get past uri regexp checking. I'm checking if the path_info matches my regexp and after that I match that to my routing table. If there ...
4
votes
3answers
489 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
2
votes
1answer
136 views

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
1
vote
0answers
176 views

How anonymous used UTF-16 ASCII to fool PHP escaping [duplicate]

Possible Duplicate: How anonymous used UTF-16 ASCII to fool PHP escaping (Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
3
votes
4answers
4k views

How is my website vulnerable for sql injections?

I am running a small website where I have published some articles. I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
1
vote
1answer
2k views

How can log poisoning be successful with a Local File Inclusion attack?

I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...