Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

7
votes
4answers
725 views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
1
vote
1answer
394 views

Which digest algorithm to use with creating a public/private key pair

I'm generating a Public/Private key pair in PHP with the following: <?php $config = array( "digest_alg" => "sha512", "private_key_bits" => 4096, "private_key_type" => ...
1
vote
2answers
93 views

What permissions should I give to a MySQL 'user' that searches my databse?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
-1
votes
2answers
102 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
8
votes
3answers
1k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
1
vote
1answer
719 views

Null byte injection on php?

I look for answer, is it possible to perform null byte injection on PHP code, and how vulnerable code should look like. Give me some example, as I noticed that: <?php echo $_GET['get']; will ...
1
vote
2answers
94 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
1
vote
2answers
459 views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
2
votes
2answers
475 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
2answers
89 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
4
votes
2answers
203 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
25
votes
4answers
2k views

Convince the company not to store credit card numbers in our webapp

The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
3
votes
1answer
2k views

Header opening a PDF file, can someone hack a website from there?

Can someone hack a website that uses this kind of header to open a pdf? <?php header("Content-type:application/pdf"); // It will be called downloaded.pdf ...
1
vote
2answers
314 views

How a database connection makes mysqli_real_escape_string more secure?

I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and ...
-1
votes
2answers
129 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
8
votes
2answers
8k views

Protect against POST //cgi-bin/php attacks?

I am being attacked with this cgi injection: POST ...
2
votes
2answers
480 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
4
votes
5answers
11k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
2
votes
1answer
520 views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
0
votes
3answers
330 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
1answer
86 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
0answers
107 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
2answers
109 views

Security on Ubuntu 12.04 LST Server for Business App

I am developing bussines application based on php and mysql on ubuntu 12.04 lts server. I have closed all ports except :80 and php code can be executed only by security login and not using cookies but ...
0
votes
1answer
2k views

Proxy / VPN Quality Check / Detection

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software? I have already tried to use this code, but it doesn't detect all proxies, in fact it detect ...
0
votes
1answer
111 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
8
votes
3answers
953 views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
2
votes
1answer
163 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
12
votes
6answers
2k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?
3
votes
1answer
306 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
0
votes
1answer
239 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
0
votes
1answer
2k views

Generating a TRULY random string in PHP [duplicate]

I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and ...
0
votes
1answer
319 views

Am I correctly preventing XSS in PHP? [duplicate]

While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out ...
1
vote
0answers
51 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth ...
3
votes
2answers
394 views

PHP null byte include failing explation seeked

I am watching a tutorial on YouTube about how to include remote files or local through a standard include command. Here is the code: <?php if(isset($_GET["language"])) { $language = ...
2
votes
2answers
961 views

Is phpseclib a secure and reliable alternative to OpenSSL?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than ...
26
votes
3answers
8k views

How does “check.torproject.org.” know if you're using TOR?

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not. ...
2
votes
1answer
1k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
3
votes
1answer
643 views

Preventing spoofing of remote server with PHP & cURL

I'm writing a PHP script that is requesting confidential data from a remote server. I'm using cURL to get the remote server's certificate information (for its output, please see below). Which array ...
5
votes
3answers
195 views

Can I limit PHP include() to specific directory trees?

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP. But in a directory structure such as this: ├── application │   ├── index.php │   ...
2
votes
2answers
1k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
3
votes
3answers
498 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
1
vote
4answers
4k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
15
votes
4answers
1k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
1
vote
3answers
295 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
0
votes
0answers
23 views

IIS 7.5 WebDav with Student Security [duplicate]

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
4
votes
3answers
2k views

Is it possible for a hacker to bypass upload php file?

I wanna give a filtering system in my script. here it is : <?php $allowedExts = array("gif", "jpeg", "jpg", "png","bmp"); $temp = explode(".", $_FILES["file"]["name"]); $extension = end($temp); ...
9
votes
4answers
526 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
2
votes
0answers
320 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
2
votes
1answer
248 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
0
votes
2answers
821 views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...