Security aspects concerning code written in the programming language PHP which is often used for web applications.
4
votes
1answer
112 views
Need to ephemerally store third-party password
One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained.
Ideally, when using my web service the ...
1
vote
5answers
303 views
Site backdoor & eval()
I'm running a Joomla 1.7 site which was hacked today. Below script did the hack.
...
2
votes
2answers
124 views
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp
I'm building this webapp where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to ...
0
votes
1answer
61 views
Getting hmac_sha to work between Erlang and PHP
I am trying to get an implementation based on the AWS signed http request API to work between Erlang and PHP. But I can't get it to work.
The core approach is that you constructed a canonical version ...
5
votes
1answer
291 views
My site just got hit with a SQL injection attack, how can I tell what they were doing?
So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
3
votes
1answer
179 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
-1
votes
1answer
108 views
How Do Spammers Exploit Mailto Fields?
I was interested in finding out how spammers can target my Mailto link to send out spams.
mailto:foo@domain.com?subject=foo
Is it just a case of appending
?from=foo?to=victim1;victim2;victim3
to ...
-5
votes
2answers
232 views
PHP injection on 777 file [closed]
Some one has modified a PHP file, which had permissions set to 777, on my VPS server.
How can someone do that without administrative access to the server?
What information I can give you?
I know ...
-1
votes
1answer
64 views
setting up website for logged in users, anyone, and files no one should see (via the web) [closed]
I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
3
votes
2answers
93 views
Fixing the high-bit problem in PHP's crypt() implementation
I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
1
vote
1answer
397 views
aes cfb 128 decryption /encryption problem between Erlang and PHP
Update 2 - it works
Thanks to Tom Leek for his answer.
The CFB mode of mycrypt for Rijndael uses a 8-bit feedback loop and not a feedback loop the length of the key/iv.
You have to force it to use ...
3
votes
7answers
1k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
3
votes
3answers
122 views
SQLi-protection ORDER BY
What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable?
I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too ...
1
vote
2answers
272 views
What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?
I know injections and XSS are ...
1
vote
1answer
131 views
Are there modules to harden Symfony 2 sessions?
We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
0
votes
2answers
77 views
What is the best way to generate keys in phpseclib?
I am using phpseclib implementation AES and HMAC. But I dont know the best way to create random keys for these.
What is the best way to do?
Is there any built in function in phpseclib to create keys ...
32
votes
1answer
2k views
default.php file found on the server, is this a security threat?
I found a file named "default.php" on the server with following code
eval(gzinflate(base64_decode(
...
1
vote
1answer
194 views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
5
votes
2answers
217 views
Secure PHP upload form & storage
I am building a PHP application that allows uploads of files (.doc/pdf etc) for review by a staff member.
Some of these files will be somewhat confidential so I need to protect them.
Now the best ...
0
votes
2answers
195 views
CMS security issues
I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language.
So my question is, on what security issues I must pay attention when ...
0
votes
3answers
110 views
Maintain sensitive key between requests
EDIT: Reworked question. Previous version too poorly asked.
On my website users write sensitive messages that must be kept secret.
The entire user area is over SSL, so the communication between user ...
1
vote
4answers
950 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
3
votes
2answers
196 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
0
votes
2answers
182 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
2
votes
2answers
167 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
2
votes
3answers
188 views
Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?
I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
25
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
0
votes
2answers
172 views
Is this code vulnerable?
I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code?
<?php
if(isset($_SESSION['id'])){
// get data ...
1
vote
2answers
629 views
Strongest cryptographic algorithm available in PHP 5.3
Which options are available in the default installation and which ones by third-parties like extensions or frameworks?
P.S. By Cryptography I mean algorithms which could be decrypted, not one-way ...
2
votes
1answer
107 views
unix malicious scripts/ksh execution
I'm wondering whether my architecture poses a security risk.
Details:
The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions.
I have a ...
3
votes
2answers
218 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
1
vote
1answer
75 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
2answers
470 views
should i use urandom or openssl_random_pseudo_bytes?
I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security?
$salt = sha1(openssl_random_pseudo_bytes(23));
or
$seed = '';
$a = ...
12
votes
3answers
465 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
-2
votes
1answer
382 views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
7
votes
2answers
159 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
8
votes
2answers
278 views
Key management scheme in PHP that is compliant with NIST SP 800-57
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management
I wonder if there're any open-source or commercial PHP solutions ...
5
votes
1answer
159 views
Using sudo to secure git deployment via web script
I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.
Briefly, how it works it:
I commit to Bitbucket
Bitbucket POSTs to a ...
2
votes
1answer
134 views
Lamp server sandbox for testing malicious php script
Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
3
votes
4answers
278 views
Safari downloaded my php source once. Should I worry?
I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!!
This hosting site has never done that before - .php scripts have always executed.
I can't duplicate ...
21
votes
5answers
2k views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
6
votes
2answers
2k views
php.ini security setting after attack
My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options.
here is my settings:
file_uploads = Off
...
-2
votes
1answer
100 views
Encode my php script [ Help ] [closed]
I wanna encode my php script .
<?php
echo "Hello world"
?>
1) base 64 method is so simple.
2) eval gzinflate base64_decode is also unlike.
3) Byterun is also simple .
I wanna make double ...
2
votes
6answers
270 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
16
votes
5answers
402 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
4
votes
4answers
355 views
Is not checking the src url a vulnerability?
By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
0
votes
1answer
167 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
0
votes
1answer
291 views
Is it possible to spoof the last proxy of an X-Forwarded-For Header?
I'm using a firefox plugin https://addons.mozilla.org/en-US/firefox/addon/x-forwarded-for-header/ to spoof the X-Forwarded-For Header to 8.8.8.8.
For the following php page:
echo ...
3
votes
3answers
640 views
Starting a secure php session
I have been looking into creating secure php sessions for use in a login script for a week or so now. So far I have not found a concrete resource to base my work off, reading StackOverflow all I have ...
