Security aspects concerning code written in the programming language PHP which is often used for web applications.
3
votes
4answers
2k views
How is my website vulnerable for sql injections?
I am running a small website where I have published some articles.
I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
1
vote
1answer
578 views
How can log poisoning be successful with a Local File Inclusion attack?
I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
2
votes
1answer
195 views
Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?
My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector?
Will htmlspecialchars be enough?
I don't want to enable JavaScript in PDF.
4
votes
2answers
822 views
openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?
openssl_digest vs hash vs hash_hmac
I want to use SHA512 for storing password.
Which of the above methods are best to use? Why?
What is the difference between SALT & HMAC?
I just read ...
5
votes
1answer
2k views
Is this jQuery ajax call vulnerable to XSS?
If somebody can edit $("#field").val(), can they change the url property here to point to another location?
$.ajax({
url: "http://mywebsite/script?param=" + $("#field").val(),
dataType: "jsonp",
...
2
votes
1answer
111 views
Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?
As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
3
votes
2answers
347 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
4
votes
2answers
3k views
PHP Vulnerability May Halt Millions of Servers - max_input_vars!
Recent version of PHP 5.3.9 has been released a couple days ago, and Hash Collisions have been fixed, most of the servers actually didn't upgrade their server until now, including my website's server.
...
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
10
votes
2answers
1k views
Is strip_tags() horribly unsafe?
I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML!
Is it true?
What can I do to ...
4
votes
3answers
470 views
PHP/JavaScript with RSA
I have a few columns in the database which should be encrypted. I'm wondering if the way I chose to make this system work is ok, and I'm looking forward to hear some opinions:
I chose RSA algorithm ...
4
votes
5answers
4k views
Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL
We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough.
We've begun looking into ...
1
vote
3answers
504 views
list of web session attacks and counter measures
I'm writing a new website with php and I will be using cookies to track user session data. Before I finalise the design I want to make sure that the site is not vulnerable to attacks. I have written a ...
6
votes
2answers
471 views
DB Passwords: More Secure in a PHP App's .ini config files or apache2 environment variables?
I manage a php app whose key variables (such as database server addresses, DB user names and passwords, etc) change depending on their environment (Dev, QA, Production, etc.).
In order to simplify ...
6
votes
1answer
643 views
Do I have to make any more check if I use prepared statements for integers?
I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this:
$stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE.
...
4
votes
4answers
731 views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
12
votes
5answers
3k views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
6
votes
3answers
3k views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
2
votes
1answer
513 views
Can suPHP lead to security issues due to hijacking people's accounts?
Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
3
votes
2answers
2k views
Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?
I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
3
votes
2answers
563 views
Is this algorithm for a random string cryptographically secure?
I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords:
...
1
vote
2answers
760 views
Thoughts on Tiny Encryption Algorithm (TEA, anyone)?
I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites.
Specifically, using the code presented at PHP-einfach.de
Does anyone have any experiences / thoughts / ...
18
votes
4answers
3k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
1
vote
1answer
225 views
Information on the phpMyAdmin probe?
Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php
One of those IP addresses is 74.63.212.48 which I just now found out I could ...
4
votes
4answers
726 views
What security features should a PHP framework have?
What security features would you find useful or expect from a PHP framework? I have a PHP framework that I've developed that I'm going to be releasing as an open source project, but I want to make ...
4
votes
2answers
730 views
Are PHP Sessions based on cookies or a cookie-IP pair?
I have a PHP website and my question is:
If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as ...
9
votes
2answers
2k views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
...
3
votes
1answer
482 views
Which encryption algo should be best for an Android application [duplicate]
Possible Duplicate:
Which type of encryption algorithms android supports, and which would be better?
I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
4
votes
2answers
2k views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
1
vote
2answers
171 views
TCrypto - Comments about design decisions I made?
I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
7
votes
2answers
1k views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
10
votes
1answer
331 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
4
votes
2answers
266 views
Attack vectors in POSTing variables from one php script to the next?
I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
5
votes
6answers
718 views
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code.
Sometimes though, the avoidance of ...
9
votes
3answers
548 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
11
votes
4answers
448 views
what to do after suspected intrusion on hobby webserver
I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
3
votes
3answers
787 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
3
votes
2answers
3k views
Testing PHP form injection
I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:
if( $_POST["var"] != "" ) {
print ...
11
votes
3answers
497 views
Getting a manual security code review done - What to watch out for?
We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process.
We did specify what kind of tests he should be ...
12
votes
2answers
1k views
How to do Ajax securely?
This question is inspired by this security question http://security.stackexchange.com/questions/1707
What are the threats in using Ajax? (Please note I am talking about security threats, not ...
1
vote
1answer
289 views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script / SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
...
4
votes
1answer
446 views
How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
What is CSRF?
I need a basic definition that is not just lifted from Wikipedia.
I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.
I am using a ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
5
votes
1answer
384 views
Good Security tool for PHP- Suhosin vs Spike vs PHPIDS
Do I have to check/test my code beforehand, or do these tools inform me when an attempt is being made in real time? Secondly, which one should I go for -- Suhosin or Spike or PHPIDS or a combo? What ...
6
votes
1answer
276 views
how to configure edit-restricted mediawiki
I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user.
I am planning to create a very restricted ...
7
votes
3answers
316 views
What security features should be present in every web-based CMS?
What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?
Please note: I'm looking ...
7
votes
3answers
386 views
Finding security consultant for doing in-depth code review?
We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
6
votes
2answers
506 views
GET with additional parameters leads to “code injection” in html displayed
We got a security review done of our PHP code and the security company sent this in their report:
Request
GET ...
6
votes
5answers
1k views
Why do people say that PHP is inherently insecure?
I've heard it said that PHP is inherently insecure. Is this true? Why?
