Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

-2
votes
1answer
346 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
0
votes
1answer
331 views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
1
vote
1answer
426 views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
1
vote
3answers
164 views

How to minimise risk to sensitive data in temp files in shared hosting environment before encryption?

openssl_pkcs7_encrypt() requires the data to be encrypted to be read from a file and so unfortunately it requires sensitive data to be written to temporary file before being encrypted. In a shared ...
1
vote
1answer
591 views

Which digest algorithm to use with creating a public/private key pair

I'm generating a Public/Private key pair in PHP with the following: <?php $config = array( "digest_alg" => "sha512", "private_key_bits" => 4096, "private_key_type" => ...
8
votes
4answers
973 views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
-1
votes
2answers
117 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
1
vote
2answers
1k views

Null byte injection on php?

I look for answer, is it possible to perform null byte injection on PHP code, and how vulnerable code should look like. Give me some example, as I noticed that: <?php echo $_GET['get']; will ...
10
votes
4answers
2k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
1
vote
2answers
109 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
2
votes
2answers
697 views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
1
vote
2answers
100 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
4
votes
2answers
242 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
2
votes
2answers
585 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
2answers
110 views

What permissions should I give to a MySQL 'user' that searches my database?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
1
vote
2answers
369 views

How a database connection makes mysqli_real_escape_string more secure?

I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and ...
-1
votes
2answers
164 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
2
votes
2answers
700 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
8
votes
2answers
10k views

Protect against POST //cgi-bin/php attacks?

I am being attacked with this cgi injection: POST ...
1
vote
4answers
439 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
1answer
109 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
0answers
121 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
2answers
133 views

Security on Ubuntu 12.04 LST Server for Business App

I am developing bussines application based on php and mysql on ubuntu 12.04 lts server. I have closed all ports except :80 and php code can be executed only by security login and not using cookies but ...
5
votes
2answers
890 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
0
votes
1answer
117 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
2
votes
1answer
209 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
3
votes
1answer
412 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
0
votes
1answer
305 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
0
votes
1answer
2k views

Generating a TRULY random string in PHP [duplicate]

I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and ...
0
votes
1answer
482 views

Am I correctly preventing XSS in PHP? [duplicate]

While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out ...
1
vote
0answers
75 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth ...
2
votes
1answer
715 views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
3
votes
3answers
568 views

PHP null byte include failing explation seeked

I am watching a tutorial on YouTube about how to include remote files or local through a standard include command. Here is the code: <?php if(isset($_GET["language"])) { $language = ...
-3
votes
2answers
422 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
6
votes
1answer
7k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
5
votes
3answers
246 views

Can I limit PHP include() to specific directory trees?

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP. But in a directory structure such as this: ├── application │   ├── index.php │   ...
2
votes
2answers
2k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
2
votes
2answers
1k views

Is phpseclib a secure and reliable alternative to OpenSSL?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than ...
1
vote
4answers
5k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
3
votes
3answers
563 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
1
vote
3answers
369 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
1
vote
1answer
249 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
4
votes
0answers
369 views

How to prevent ASCII Encoded / Binary String SQL injection in CodeIgniter

I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ...
9
votes
4answers
555 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
2
votes
1answer
332 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
4
votes
3answers
3k views

Is it possible for a hacker to bypass upload php file?

I wanna give a filtering system in my script. here it is : <?php $allowedExts = array("gif", "jpeg", "jpg", "png","bmp"); $temp = explode(".", $_FILES["file"]["name"]); $extension = end($temp); ...
0
votes
2answers
1k views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
1
vote
0answers
35 views

Removing PHP Shell from server [duplicate]

I have looked at a few other questions related to this but nothing specifically answered what I was wondering about. Say for example you have a server that is infected with a php shell such as c99. ...
10
votes
3answers
457 views

has scrypt withstood the test of time?

I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...
6
votes
1answer
478 views

Web Applications terminate strings on null-byte

I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string ...