Tagged Questions

Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
2answers
369 views

How to stop a (malicious) endless loop

Few days ago someone tried to crack my site using a Remote File Inclusion attack. The attack was blocked by my Web Application Firewall, but I was curious about the file. So I downloaded it started to ...
2
votes
3answers
470 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
1k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
3
votes
1answer
583 views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
8
votes
3answers
8k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
3
votes
3answers
564 views

Stop code injections into page code

I started a topic HERE on the stackoverflow site, but was refered here. I did get some info there, but think it need's more indepth input. So hopefuly people here can help. I have a few domains ...
17
votes
2answers
6k views

Risks of a php image upload form

So I have a client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated ...
0
votes
1answer
2k views

Proxy / VPN Quality Check / Detection

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software? I have already tried to use this code, but it doesn't detect all proxies, in fact it detect ...
0
votes
2answers
175 views

how to find injected code in SQL

Recently one of my sites is hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in database. I cleaned up many of them. But I am ...
5
votes
3answers
764 views

Setting a limit on password recovery attempts

in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie. $attempts = ...
1
vote
1answer
2k views

ASP.net vs PHP security? [closed]

I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file ...
0
votes
1answer
428 views

Is it secure to use a custom written Php extension for handling + hashing (db) keys?

I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it ...
-2
votes
1answer
578 views

Admin area in my php website is vulnerable to sql injection without login [closed]

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. ...
15
votes
4answers
3k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
2
votes
4answers
407 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
4
votes
3answers
546 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
4
votes
4answers
778 views

Site constantly getting infected

I am the webmaster of some websites running Typo3, 2 of which are getting infected constantly. These 2 sites are being owned by the same client. Something happens on those 2 sites that causes ...
16
votes
2answers
870 views

PHP attack string in access logs

So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I ...
4
votes
1answer
207 views

What are possible consequences for applications that depends on Safe Mode for security?

PHP finally removed safe_mode feature: Safe Mode Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. The PHP safe mode is an attempt to solve the ...
2
votes
2answers
632 views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which ...
2
votes
2answers
419 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
4
votes
1answer
298 views

Need to ephemerally store third-party password

One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained. Ideally, when using my web service the ...
2
votes
2answers
243 views

What are the security risks when users upload their HTML and javascript to AWS S3 and the content is used in a webapp?

I'm building this web app where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to ...
1
vote
5answers
794 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
5
votes
1answer
2k views

My site just got hit with a SQL injection attack, how can I tell what they were doing?

So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
4
votes
1answer
724 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
-1
votes
1answer
249 views

How Do Spammers Exploit Mailto Fields?

I was interested in finding out how spammers can target my Mailto link to send out spams. mailto:foo@domain.com?subject=foo Is it just a case of appending ?from=foo?to=victim1;victim2;victim3 to ...
1
vote
1answer
196 views

Getting hmac_sha to work between Erlang and PHP

I am trying to get an implementation based on the AWS signed http request API to work between Erlang and PHP. But I can't get it to work. The core approach is that you constructed a canonical version ...
-5
votes
2answers
513 views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...
-1
votes
1answer
159 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
3
votes
2answers
257 views

Fixing the high-bit problem in PHP's crypt() implementation

I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
3
votes
1answer
2k views

aes cfb 128 decryption /encryption problem between Erlang and PHP

Update 2 - it works Thanks to Tom Leek for his answer. The CFB mode of mycrypt for Rijndael uses a 8-bit feedback loop and not a feedback loop the length of the key/iv. You have to force it to use ...
3
votes
3answers
172 views

SQLi-protection ORDER BY

What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable? I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too ...
1
vote
2answers
952 views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
2
votes
1answer
691 views

Are there modules to harden Symfony 2 sessions?

We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
0
votes
2answers
336 views

What is the best way to generate keys in phpseclib?

I am using phpseclib implementation AES and HMAC. But I dont know the best way to create random keys for these. What is the best way to do? Is there any built in function in phpseclib to create keys ...
33
votes
1answer
4k views

default.php file found on the server, is this a security threat?

I found a file named "default.php" on the server with following code eval(gzinflate(base64_decode( ...
2
votes
1answer
1k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
6
votes
2answers
2k views

Secure PHP upload form & storage

I am building a PHP application that allows uploads of files (.doc/pdf etc) for review by a staff member. Some of these files will be somewhat confidential so I need to protect them. Now the best ...
0
votes
2answers
314 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
0
votes
3answers
165 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
5
votes
5answers
15k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
3
votes
2answers
330 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
2
votes
3answers
423 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
1
vote
6answers
6k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
4
votes
2answers
1k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
0
votes
2answers
194 views

Is this code vulnerable?

I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code? <?php if(isset($_SESSION['id'])){ // get data ...
4
votes
2answers
3k views

Strongest cryptographic algorithm available in PHP 5.3

Which options are available in the default installation and which ones by third-parties like extensions or frameworks? P.S. By Cryptography I mean algorithms which could be decrypted, not one-way ...
1
vote
1answer
147 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
4
votes
2answers
3k views

should i use urandom or openssl_random_pseudo_bytes?

I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...