Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

22
votes
6answers
59k views

Is it possible for a hacker to download a php file without executing it first?

I have a php website where everything is in the public_html\ folder, including an includes folder with config and classes. I told my developer to move it away from public folder but he said there is ...
2
votes
3answers
375 views

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

I am working on a web application that would include some custom development and got a bit concerned about code theft. So the question I wanted to ask is whether it is - generally speaking - possible ...
2
votes
2answers
44 views

VirtualBox: Opening appliance with 7zip [closed]

We have a PHP application that is inside a virtual machine (turnkey VirtualBox). We developed an installer that downloads virtualbox and imports the appliance. The user executed this installer to get ...
0
votes
2answers
75 views

Testing shellshock with PHP

I have been trying to test shellshock vulnerability on PHP similar to this answer. I am running Apache server with PHP running as mod_php. The PHP version is 5.3.10. I have a phpfile (phptest.php): &...
0
votes
1answer
205 views

Find php file with certain word in it and disable php

I have multiple VPS with at least thousands of accounts in them. My clients' websites are hacked and sending spam emails. I checked the log and found out two types of scritps type1: <?php $d79="...
-1
votes
2answers
239 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
2
votes
1answer
3k views

Uploading images safe of XSS, php code and virus

I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not ...
2
votes
2answers
140 views

PHP input directly to functions

I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source ...
2
votes
0answers
141 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
2answers
127 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
8
votes
3answers
3k views

PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?

For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
0
votes
3answers
291 views

PHP url pen testing [closed]

hello all I am using a sandbox to start practicing security measures. I get given a URL which calls a filename using the url (/download.php?file=files/read_me.txt) ... I know its possible to get the ...
0
votes
0answers
69 views

best operation mode for Rijndael-256 in PHP

so my question is about the operation mode. In another thread I heard that ECB is bad which makes sense when I read about it, so I wanna change some things at my Crypto to make it better and wanted to ...
0
votes
1answer
53 views

Why does the SQL Injection technique INTO OUTFILE sometimes not work? [closed]

Why does the SQL Injection technique INTO OUTFILE sometimes not work? http://example.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " /var/www/website/...
0
votes
2answers
305 views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
0
votes
1answer
1k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
5
votes
2answers
683 views

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image. What I'm currently doing is file_get_contents('pic') (...
-2
votes
2answers
193 views

Is SQL injection still possible after filtering?

I am just reviewing a script I want to use for my website. The author filters all user entered data ($_POST and $_GET) with this function: function XSSCheck($value) { return preg_replace( ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
0
votes
2answers
145 views

Standard AES vs additional parameters with Rijndael - what is more secure?

I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks. The problem is that I ...
4
votes
3answers
354 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
1
vote
2answers
45 views

form validation [closed]

To what degree of concern should I take when validating a form? What should be the general line to say enough? Currently, I'm checking form token submit value = match internal hard code input name =...
3
votes
1answer
218 views

bypass file_exists[rfi,lfi] in my code, is it posible?

I've got the following piece of code in my web application: $data = "dir/files/".$_GET['f'].".pdf"; Couple of lines down I got: if(file_exists($data)){ include($data); Could an attacker ...
0
votes
2answers
83 views

Securing php files from external include [closed]

Can anybody externally include my php file in their scripts? E.g. I have a file with classes executing code to db, and is it possible that somebody from external environment includes my php file and ...
2
votes
1answer
224 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
0
votes
1answer
287 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing Cross-...
0
votes
2answers
98 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
2
votes
3answers
211 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
3
votes
0answers
143 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
2
votes
2answers
396 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
1
vote
1answer
252 views

What is This Script Trying to do [closed]

This Script seems to have been added into my Site Code I want to understand what is it trying to do so I can try to prevent it . <?php /* ===================================================== ...
-2
votes
1answer
111 views

Preventing LFI with user input

I need a script to look for logs which are in separate files for each user so that I can get all the log data. Right now I have something like this: public function getLog($name) { if (is_file($...
2
votes
2answers
321 views

PHP code in user session LFI filtered out

Firstly, I make the obligatory disclaimer that everything I am doing here is legitimate and pre-authorized, etc., etc. For those unfamiliar with user session local file inclusion in PHP, there's a ...
20
votes
5answers
4k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there. ...
8
votes
6answers
38k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
4
votes
1answer
360 views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
3
votes
1answer
77 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
2
votes
1answer
170 views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
-3
votes
1answer
168 views

{PHP} SQL Injection [duplicate]

Please note: this isn't a duplicate!!! Why? You can use ' but You don't know how :) I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { if($str[$i]...
2
votes
1answer
159 views

Protect against cgi-bin/php attacks centos

I am facing some strange attack while I was checking Apache logs: OST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%...
36
votes
5answers
7k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
3
votes
2answers
100 views

Concepts of a secure note sharing system

I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive ...
-2
votes
1answer
99 views

Using a index.php script in my iOS app, what should I do to secure it?

I am really new using web servers and security. I have just written a backend for my iOS app in PHP. It's hosted on a Linode apache server. The index.php us located at http://www.example.com/API/. I'm ...
3
votes
2answers
204 views

What measures must be taken to securely authenticate from web traffic to a WebSocket connection?

Obviously TLS is a must for any and all secure authentication. Please turn your paranoia settings up to 11 for this. Background: (In case people are unfamiliar with the WebSocket (WS) protocol and ...
2
votes
3answers
197 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
1
vote
1answer
162 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
0
votes
0answers
136 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
0
votes
1answer
203 views

Securing SQL injection for my PHP files [closed]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...
1
vote
2answers
699 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...