Security aspects concerning code written in the programming language PHP which is often used for web applications.
4
votes
1answer
399 views
172.16.33.197, 127.0.0.1 IP addresses in visitor logs
I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
0
votes
2answers
410 views
Running Apache as system service on Windows 2003 R2 64-bit
Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website.
So what I did - I uploaded file test.php ...
0
votes
3answers
416 views
Viewing the configuration.php
My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario).
...
2
votes
3answers
591 views
User data encryption/decryption in a database (PHP)
I was wondering which is the best way to encrypt and decrypt user data in a database, to make it much more secure as it is possible?
I was reading about AES but I would like to know if is really the ...
1
vote
1answer
246 views
Implementing SRP Challenge login system *with SSL* (Using PHP)
My question: Anyone knows how to implement SRP / Diffie-Hellman authentication in PHP (or if this has already been done)?
(Some details)
I'm using CodeIgniter with TankAuth (both latest version)
...
6
votes
1answer
754 views
PHP crypt() trims the salt as it would be too long
I am using Blowfish with PHP crypt() for password hashing but I noticed something weird. Quoting PHP documentation:
CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$",
"$2x$" or ...
2
votes
1answer
93 views
Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?
There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
1
vote
1answer
128 views
Is it possibel to inject php code to roundcube errors log file via LFI vulnerability? [closed]
i tried to inject php code to roundcube errors log file, with no success. i think there is something filtering injected php code.
5
votes
4answers
563 views
Protecting against CSRF when a form is being submitted via an AJAX call
I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
6
votes
2answers
664 views
when to use nonce?
I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
3
votes
3answers
500 views
optimal way to salt password?
A good way to salt password?
I have read a few answers related to salting password. But I started to get confused.
I came across few functions people used to generate salt like:
mcrypt_create_iv()
...
2
votes
1answer
129 views
Safe User Login Questions
I need help determining how safe the login is. First of all, I have been reading this:
The Definitive Guide To Forms based Website Authentication
It's really well written, great information most of ...
8
votes
5answers
1k views
Why is php not used for banking sites or for a banking transaction?
Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site.
...
4
votes
4answers
355 views
Is not checking the src url a vulnerability?
By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
3
votes
1answer
127 views
Malicious php scripts in word press theme folder?
I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
2
votes
2answers
401 views
How to make a simple file integrity checker
I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes.
The problem ...
2
votes
2answers
302 views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
2
votes
2answers
180 views
Can the `system` function pose severe security threats on a shared hosting server?
I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects.
So I created a ticket and asked them to enable it. This is what ...
3
votes
1answer
360 views
Where and How is data stored in a session?
Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored?
If I store an object of a class, in ...
3
votes
3answers
1k views
Do you need to encrypt session data?
I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
-1
votes
1answer
1k views
How to hack linux from phpMyAdmin? [closed]
I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit.
i encoded the ...
4
votes
3answers
187 views
Security risks using tmpfile() for sensitive data in PHP
What are the primary concerns when storing sensitive data in PHP's temporary directory via tmpfile()? For instance:
Could this data be recovered from HDD by a malicious admin?
Could the admin easily ...
16
votes
4answers
745 views
How to convince coworkers to not store credit card numbers ourselves
The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
2
votes
2answers
226 views
Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
3
votes
3answers
225 views
PRNG: Does combining insecure algos help?
Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...
3
votes
2answers
176 views
Do LAMP log files sometimes contain sensitive information?
I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
3
votes
1answer
678 views
Header opening a PDF file, can someone hack a website from there?
Can someone hack a website that uses this kind of header to open a pdf?
<?php
header("Content-type:application/pdf");
// It will be called downloaded.pdf
...
4
votes
1answer
333 views
Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server
We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a ...
2
votes
1answer
305 views
Can /etc/passwd file be accessed on a cpanel shared hosting account?
Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
10
votes
1answer
605 views
How to properly secure a $_GET in PHP?
I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
3
votes
3answers
1k views
How insecure are PHP's rand functions?
There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here.
I understand those functions are insecure, but how insecure are they?
...
8
votes
1answer
414 views
Why do attackers bother (trivially) obfuscating their source code?
A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:
...
2
votes
2answers
459 views
How to add safety to login page
I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types ...
6
votes
2answers
122 views
HTTP daemon and Webroot permissions
We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.
I have ...
2
votes
2answers
111 views
Any solution to passing a penetration test for an outdated php web application without upgrading the application?
A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
7
votes
3answers
552 views
Should IP addresses be validated to prevent SQL Injection?
In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses.
Should I validate user IP addresses before using ...
1
vote
2answers
268 views
Strange Pharma Spam Site resulting from DAT file created by SQL Injection?
Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
3
votes
3answers
4k views
How can I use this path bypass/exploit Local File Inclusion?
I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
0
votes
2answers
614 views
How to filter POST requests before they reach PHP on Apache?
I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
10
votes
4answers
466 views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
4
votes
3answers
2k views
PHP crypt() or phpass for storing passwords?
When storing passwords, should I use PHP's built in crypt or phpass?
If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
8
votes
1answer
371 views
PHP 5.3.9 Vulnerability Help
This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits.
This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
3
votes
1answer
816 views
Will session_regenerate_id() without true parameter improves security? Should I use it right before login?
I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below:
When we ...
29
votes
3answers
1k views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
4
votes
2answers
948 views
How do I protect user data at rest?
I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
2
votes
1answer
48 views
How to install client securely?
I'm writing a program in PHP that sends data from one master to many clients (all Joomla websites). When the client software is installed, it should send a message to the master identifying itself, ...
2
votes
2answers
173 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
16
votes
5answers
402 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
5
votes
2answers
634 views
Could this login form be “hacked” to allow access?
We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:
$email=$_POST['email'];
...
1
vote
3answers
278 views
Login System Security Suggestions
I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup:
nonce to check if the login originated from our login form
session and cookie auth mixed - in ...
