Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
2answers
600 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
1
vote
1answer
82 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
1
vote
1answer
92 views

Before an attacker attempts to exploit eval(), how would they suspect that it is being used by a target application?

I am asking the question in the context of XSS RCE/RFI as a result of server-side eval() exploitation. It is often recommended to avoid using it, but it is not clear to me how one would attempt to ...
3
votes
2answers
212 views

Decoding injected PHP malicious code in my server

I've found on internet similar issues, and I compared the code. This one is different. I recently found out that the CentOS LAMP webserver we use for development in our office was infected by a piece ...
1
vote
3answers
200 views

Using HTTP GET instead of a POST request can leak source code?

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server ...
-1
votes
1answer
47 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? I'...
0
votes
1answer
104 views

Dealing with a malware infected server

I have a web server which is heavily infected by malware. That is, around 12 websites (Outdated CMS) are infected by PHP shells and XSS. My websites are banned and are not accessible anymore. I have ...
3
votes
1answer
171 views

Understanding hack on ecommerce site

I need help in understanding this hack and maybe I can get more information out of it. This script was inserted on our website (maybe through a weak password): eval(atob("string")); the string ...
1
vote
1answer
149 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
-1
votes
1answer
71 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
1
vote
1answer
86 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
-2
votes
2answers
86 views

All my PHP files has injected code in them. What do I do now? [duplicate]

I have like 10 websites on my account using WordPress and some custom coded websites. But all of my website files have this code at the beginning of every PHP file: <?php if(!isset($GLOBALS["\x61\...
-4
votes
1answer
130 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column $...
1
vote
0answers
51 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ),...
7
votes
3answers
1k views

Finding hidden page on webserver [duplicate]

I have a web server with 2 page: index.html and secret.php. The content of index.html is: <html><body><h1>It works!</h1></body></html> You can see the index....
0
votes
2answers
111 views

Wordpress - 3.9 - uploading a php file through media gallery

I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware. There is an app called: iCon2PHP that can merge php ...
4
votes
1answer
217 views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
-7
votes
1answer
120 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere End.....
0
votes
1answer
114 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
0
votes
0answers
335 views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
1
vote
3answers
122 views

vulnerable webapp pentest challenge

So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4. I am ...
1
vote
0answers
206 views

Random script injected in wordpress project [duplicate]

Recently a website in wordpress that is on a server of my customer appears with the script below randomly. Someone knows this pattern of virus/malware/exploit or something like this? <?php $...
3
votes
1answer
427 views

What are PHP allow_url_fopen security risk?

Recently I was reading an article about file_get_contents and HTTPS. One part that caught my attention is: Of course, the allow_url_fopen setting also carries a separate risk of enabling Remote ...
3
votes
2answers
327 views

PHP processing form submission, how can I best protect sensitive information submitted via the form?

I am using PHP 5.6 on Apache 2.4 I have a form that will collect sensitive information about the user that need to be encrypted. My current solution grabs the sensitive information from the POST and ...
2
votes
2answers
44 views

VirtualBox: Opening appliance with 7zip [closed]

We have a PHP application that is inside a virtual machine (turnkey VirtualBox). We developed an installer that downloads virtualbox and imports the appliance. The user executed this installer to get ...
0
votes
2answers
77 views

Testing shellshock with PHP

I have been trying to test shellshock vulnerability on PHP similar to this answer. I am running Apache server with PHP running as mod_php. The PHP version is 5.3.10. I have a phpfile (phptest.php): &...
0
votes
1answer
206 views

Find php file with certain word in it and disable php

I have multiple VPS with at least thousands of accounts in them. My clients' websites are hacked and sending spam emails. I checked the log and found out two types of scritps type1: <?php $d79="...
-1
votes
2answers
248 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
0
votes
1answer
79 views

prevent form submission

Say in my cms I have a few page that only internal personnel could go to that page and submit sensitive information... how do I prevent from people fake a form to submit from that page? Assuming they ...
2
votes
2answers
145 views

PHP input directly to functions

I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source ...
2
votes
0answers
150 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
2answers
146 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
0
votes
3answers
310 views

PHP url pen testing [closed]

hello all I am using a sandbox to start practicing security measures. I get given a URL which calls a filename using the url (/download.php?file=files/read_me.txt) ... I know its possible to get the ...
0
votes
0answers
70 views

best operation mode for Rijndael-256 in PHP

so my question is about the operation mode. In another thread I heard that ECB is bad which makes sense when I read about it, so I wanna change some things at my Crypto to make it better and wanted to ...
0
votes
1answer
53 views

Why does the SQL Injection technique INTO OUTFILE sometimes not work? [closed]

Why does the SQL Injection technique INTO OUTFILE sometimes not work? http://example.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " /var/www/website/...
1
vote
2answers
1k views

Can I rely on openssl_random_pseudo_bytes() being very random in PHP?

I came across an application which needs to generate a random token for each user. It is very important that each generated token is unique. Application code was as follows: $token = md5(...
0
votes
1answer
2k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
-2
votes
2answers
198 views

Is SQL injection still possible after filtering?

I am just reviewing a script I want to use for my website. The author filters all user entered data ($_POST and $_GET) with this function: function XSSCheck($value) { return preg_replace( ...
1
vote
2answers
150 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
1
vote
2answers
46 views

form validation [closed]

To what degree of concern should I take when validating a form? What should be the general line to say enough? Currently, I'm checking form token submit value = match internal hard code input name =...
3
votes
1answer
237 views

bypass file_exists[rfi,lfi] in my code, is it posible?

I've got the following piece of code in my web application: $data = "dir/files/".$_GET['f'].".pdf"; Couple of lines down I got: if(file_exists($data)){ include($data); Could an attacker ...
0
votes
2answers
83 views

Securing php files from external include [closed]

Can anybody externally include my php file in their scripts? E.g. I have a file with classes executing code to db, and is it possible that somebody from external environment includes my php file and ...
0
votes
1answer
323 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing Cross-...
0
votes
2answers
109 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
4
votes
3answers
369 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
2
votes
3answers
239 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
1
vote
1answer
257 views

What is This Script Trying to do [closed]

This Script seems to have been added into my Site Code I want to understand what is it trying to do so I can try to prevent it . <?php /* ===================================================== ...