Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
0answers
19 views

How can I create many-to-one keys in Doctrine/Zend/PHP?

I'm using Zend with Doctrine 2 to store data in a database. For a given user, I encrypt the data with a randomly-generated key specific to that user, and encrypt the key with that user's password ...
1
vote
1answer
122 views

How can I control all my website's requests? [closed]

I need to manage my website's requests. Because of both I need to detect suspect requests and block that IP and calculate the number of users which visit my website. So I've created a table like this:...
2
votes
2answers
2k views

www-data is sending rogue mails through sendmail. How do I find the source?

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account. As of yesterday ~19:00 CET, ...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
0
votes
1answer
90 views

Virus suspicion on website built with PHP Codeigniter [duplicate]

I have received a website, which uses Codeigniter, to modify. The problem is, sometimes when I refresh the main page, a strange file named "download" with the Windows icon will start to download. I'm ...
1
vote
1answer
448 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
2
votes
2answers
204 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
1
vote
0answers
37 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
7
votes
3answers
17k views

Generating an unguessable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation e-...
2
votes
1answer
118 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
3
votes
2answers
64 views

How to accept user input for use in terminal safely?

I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified. // Get ...
39
votes
7answers
5k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
4
votes
1answer
132 views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
2
votes
1answer
162 views

How to bypass PHP username and password check in this CTF challenge?

I'm preparing for this CTF challenge I'll be participating in next week, and I ran across this problem online which I can't manage to solve. I only have control of the variables $user and $pass that ...
-4
votes
3answers
64 views

How to pass website firewall, in PHP? [closed]

Recently, I have posted a question, (http://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question. In this answer, he said: "So the ...
1
vote
2answers
86 views

How does a PHP application get nulled and how to avoid it

As so many others, I've been a victim of having a PHP product of mine be nulled and put available on the internet to download freely. The purpose of this question is to try to make it more difficult ...
5
votes
1answer
499 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
1
vote
1answer
97 views

Password Encryption For PHP 5.3 or Should We Update to 5.5+?

I'm trying to hash passwords for our company site. After testing on a local Apache server that has PHP 5.5.9 and everything working as expected, I went to test on our live server being hosted by ...
5
votes
2answers
223 views

How can someone upload a PHP file to a server without an upload form?

I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the ...
0
votes
1answer
36 views

Are path traversals attacks possible with invalid directories between?

Let's say I can control the variable $path and the full path is generated as follows: $full_path = "./valid_dir/docs/" . trim($path) ; readfile($full_path) ; where docs a non existent dir in the ...
2
votes
2answers
148 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
4
votes
2answers
111 views

How much can an attacker do/obtain in PHP with the execution of one function?

I am collecting ideas to illustrate a case I've seen once where an attacker basically could get to a situation simplified as follows (not kidding): <?php $fcall = $_GET['fcall']; $fcall(); ...
1
vote
0answers
92 views

Decryption with two-way authentication

We have a Customer who wants his sensitive user-data stored with an encryption. These are the basic requirements: Sensitive user-data is stored in a database using encryption A remote-attacker who ...
1
vote
2answers
103 views

Is header('Location: ../page.php?param='.$param); vulnerable to unvalidated redirects?

I have reviewed a web application built on PHP. It redirects to different pages this way: $param = $_POST['param']; header('Location: ../page.php?param='.$param); Is it vulnerable to unvalidated ...
20
votes
4answers
8k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
38
votes
6answers
5k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole? ...
0
votes
0answers
20 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
1answer
86 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = '...
1
vote
2answers
91 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
1
vote
2answers
1k views

Can I rely on openssl_random_pseudo_bytes() being very random in PHP?

I came across an application which needs to generate a random token for each user. It is very important that each generated token is unique. Application code was as follows: $token = md5(...
3
votes
2answers
85 views

What are the best practices for trusting connection sources in open source software?

Quite concise, but I'll elaborate with an example: Lets say I have a simple app written in C# and i want to know how many people a day open the app. the easiest solution would be to simply have a ...
6
votes
1answer
290 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
3
votes
1answer
122 views

Offering a privacy scenario with PHP mcrypt library

first of all, sorry if my question is not clear, because English is not my first language. Anyway, let-me explain the concept I'm struggling to solve as the best solution. I have some guys, and they ...
5
votes
1answer
136 views

How to share an encryption key between different PHP applications?

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application ...
3
votes
1answer
244 views

Why is Norton Safe Web flagging my site as dangerous when it reports on PHP files/urls that don't exist?

I'm in a bit of a quandary over Norton Safe Web's rating of my company's website. My question is: is it possible for someone to fool Norton Safe Web into thinking that our website has PHP files which ...
4
votes
4answers
320 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
0
votes
2answers
101 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
0
votes
2answers
151 views

Execute PHP inside PNG using curl

I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file. <?=$_GET[0]($_POST[1]);?&...
9
votes
2answers
132 views

Is it possible to disable all PHP functions not used in my application?

I want to secure my PHP installation. I can disable some functions, like system(), exec() etc using disable_functions in php.ini. But I can forget to disable some dangerous functions. Is it possible ...
-4
votes
1answer
65 views

Good site/account security tips and practices [closed]

I'm working on site security for my website. However I'm having trouble making the security better. How can I increase the site security? How can I increase user security? Now, when I say user ...
1
vote
2answers
170 views

Should I use one CSRF token per page or per form?

Is it safe to use one CSRF token per form on my page, ex: <form> <input type="hidden" name="token" vale="<?=$data['login_token'];?>" />" </form> <form> <input ...
5
votes
3answers
120 views

Bypass directory traversal filter in PHP?

I have a legacy PHP app, which has code similar to this: <?php $doc = $_GET['doc']; if (preg_match('#\.\./#', $doc)) { header("HTTP/1.1 403 Forbidden"); die(); } $content = ...
-2
votes
2answers
86 views

All my PHP files has injected code in them. What do I do now? [duplicate]

I have like 10 websites on my account using WordPress and some custom coded websites. But all of my website files have this code at the beginning of every PHP file: <?php if(!isset($GLOBALS["\x61\...
118
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
0
votes
1answer
61 views

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments. Let's say I POST the following: <?php echo "xy"; /* arbitrary php code */ ...
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
4
votes
2answers
249 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (a wordpress site) for a friend got hacked and all php pages had added code at the bottom in the form of echo base64_encode(...);. Thus there were unwanted ads on very ...
0
votes
0answers
42 views

PHP null byte exploit through cookie [duplicate]

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
0
votes
0answers
69 views

null byte injection no response from environ

I have a challenge I'm working and I need some advice please. I found 2 null byte injection points on the web service, both of which gives me the contents of /ets/passwd when I do old ../../../../../...
1
vote
2answers
82 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...