Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
2answers
89 views

Should I validate authentication form inputs?

I've got a login page with a form where they can input their account's email address and password. I'm doing the following things before even attempting to authenticate a user: Validating the email ...
3
votes
1answer
108 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
1
vote
1answer
107 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
0
votes
0answers
34 views

Filter GET requests with regexp : Whitelist approach

I'm writing a new website with php, there is no backend but users will be able to input search terms through GET queries and I was wondering : is it safe to whitelist query parameters using regexp? ...
0
votes
2answers
54 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...
0
votes
1answer
63 views

Is addslashes + htmlentities sufficiently secure?

I have addslashes(htmlentities($userInput)). It gets inserted into my database. (NOT a mysql db) Is it sufficiently safe from xss? Thank you!
1
vote
2answers
96 views

How To Patch LFI Vulnerability

I'm pretty sure that you all are aware of this vulnerability, but i wonder how to patch this? I have seen this code in a tutorial that it is the way to patch this but still user can access all the ...
16
votes
6answers
4k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
0
votes
2answers
65 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
2
votes
5answers
251 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
2
votes
1answer
111 views

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image. What I'm currently doing is file_get_contents('pic') ...
1
vote
1answer
97 views

Securely send password to script as parameter

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively. ...
7
votes
6answers
443 views

Faster SQL injection prevention

I looked around everywhere and I can't find the answer to my question. I'm using the latest PHP for server-sided scripting and MySQL for my database. The character set is utf8mb4, if that makes a ...
5
votes
1answer
110 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
1
vote
1answer
164 views

Getting null byte injection attacks to work with PHP 5.2.17

I'm trying to understand how null byte injection attacks in PHP code used to work before it was patched in PHP 5.3.4. I have this sample HTML page that is a somewhat modified version of what's shown ...
0
votes
3answers
318 views

SQL injection filter evasion

During manual SQL injection testing I came upon this. Is there any way to bypass these filters that supposedly prevent a UNION based attack? <?php error_reporting(0); include('db.inc.php'); ...
0
votes
1answer
237 views

Someone is trying to hack my PHP server

Today, early in the morning. My dedicated server was slowing because there was numerous requests coming. One error I remember is some message from MYSQL, it said something similar to, ...
2
votes
1answer
89 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
10
votes
2answers
274 views

Obfuscated php code found on the server

I found this piece of code hosted on my website I'm sure it's a malware. Any have an idea what this script does or how to deobfuscate? <?php ...
0
votes
1answer
157 views

RHEL 6: PHP 5.3.3 - Is it inherently insecure?

I am talking about the PHP 5.3.3 package that is available in the Red Hat Enterprise Linux repository, running on Apache. From what I can see, as of RHEL 6, it is the latest version (no updates ...
0
votes
1answer
73 views

Sandbox environment for “php malware” analysis [closed]

I would like to know how can I analyse an obfuscated malware php code ? I heard about cuckoo sandbox, but it seems too overwhelming for this particular task. So I decided to run a Vagrant box, install ...
1
vote
2answers
90 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
1answer
105 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. ...
0
votes
1answer
819 views

sql injection vulnerability to codeigniter

Hello i want to know why this kind of example question never been asked before. i got this code from my college that they say this kind of code is able to prevent sql injection we use codeigniter to ...
0
votes
1answer
370 views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
1
vote
1answer
108 views

Obfuscation alternatives

So I've made a tool for web developers and now I want to sell it, but I don't want all web developers to see my code (PHP). I do know there are PHP Obfuscators, but I don't want to use them, as they ...
0
votes
2answers
75 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
1
vote
1answer
236 views

How can I detect whether a webshell exploit has been run?

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files ...
7
votes
3answers
828 views

Not hashing email registration confirmation link

I sent emails out that contains an email registration confirmation link: http://example.com?create=email%3Djay%40gmail.com%26confirm_key%3D53e321f97c145 I do not hash the link above. Before I sent ...
2
votes
1answer
49 views

Display link to admin section or not?

I have a question and answers site. I have an admin section. From that section I can delete users, threads, responses, and edit various other things. I have some simple code at the start of the admin ...
0
votes
2answers
155 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
6
votes
2answers
817 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
1
vote
3answers
120 views

Security risk stemming from data passed in $_GET superglobal

This is a short but general question. I am relatively new to programming in general. My site, which is predominately written in PHP, will be launched soon and is undergoing some security tightening. ...
-1
votes
1answer
342 views

PHP/Ajax Data transmission security

I'm learning about web security mechanisms. I have developed the following system in PHP and JavaScript: assuming that I have a page named: messages.php which is a real-time chat system. first when ...
0
votes
1answer
241 views

API Key DDOS prevention method

Hi I just wanted some feedback on a DDOS preventing php script that I'm designing. It quite simple and I wanted some feedback on whether you guys think it would be effective. I'm currently using the ...
4
votes
2answers
276 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
1
vote
1answer
58 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
0
votes
0answers
29 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
0
votes
1answer
25 views

Can JS templates for admin-only pages be public

In my page admins-only section is very responsive, so I have to use both server and client side templating. Obviously server side templates are stored outside of web-root and routing takes care of ...
2
votes
1answer
183 views

Encrypted code in hacked wordpress site

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files: http://pastebin.com/nL4i6t8x ...
3
votes
2answers
192 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
0
votes
3answers
227 views

PHP Object Injection Prevention - OWASP

So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use json_* (json_encode and ...
1
vote
2answers
102 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
2
votes
2answers
187 views

PHP shellcode inside /tmp. Is the server compromised?

I have a Debian 7 VPS that runs Nginx, PHP5-FPM and MariaDB. This server runs a couple of WordPress installations, phpMyAdmin and Roundcube Webmail. One is my personal blog running WP 3.9.1 and ...
0
votes
0answers
63 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
2
votes
1answer
171 views

Is this a bot fishing for security vulnerabilities on my site?

I am running a webpage for my family with a feature to track users and guests. Since its all just family stuff no one ever visits this server, and I hardly see more than 2-3 of us logged on at the ...
3
votes
3answers
676 views

Is this a secure way of storing passwords? [duplicate]

So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
29
votes
3answers
1k views

Why do WordPress installations retrieve the crypto secrets remotely on installation?

It seems that WordPress retrieves all the crypto constants remotely (via HTTPS): // setup-config.php $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' ); Are there ...
1
vote
1answer
99 views

Are LFI attacks possible (removing extension) in PHP 5.4.4+?

Wondering if there was a possible attack vector still around for LFI attacks that remove the file extension. Obviously the null byte was fixed in previous PHP versions and no longer works, along with ...
0
votes
3answers
59 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...