Tagged Questions

Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

3
votes
2answers
361 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
3
votes
1answer
2k views

Header opening a PDF file, can someone hack a website from there?

Can someone hack a website that uses this kind of header to open a pdf? <?php header("Content-type:application/pdf"); // It will be called downloaded.pdf ...
4
votes
1answer
471 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...
2
votes
1answer
558 views

Can /etc/passwd file be accessed on a cpanel shared hosting account?

Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
10
votes
1answer
2k views

How to properly secure a $_GET in PHP?

I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
5
votes
3answers
3k views

How insecure are PHP's rand functions?

There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here. I understand those functions are insecure, but how insecure are they? ...
9
votes
1answer
836 views

Why do attackers bother (trivially) obfuscating their source code?

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example: ...
3
votes
2answers
671 views

How to add safety to login page

I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types ...
6
votes
2answers
200 views

HTTP daemon and Webroot permissions

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user. I have ...
2
votes
2answers
145 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
10
votes
3answers
1k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
1
vote
2answers
352 views

Strange Pharma Spam Site resulting from DAT file created by SQL Injection?

Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
7
votes
3answers
15k views

How can I use this path bypass/exploit Local File Inclusion?

I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
0
votes
3answers
3k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
10
votes
4answers
1k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
4
votes
3answers
5k views

PHP crypt() or phpass for storing passwords?

When storing passwords, should I use PHP's built in crypt or phpass? If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
8
votes
1answer
463 views

PHP 5.3.9 Vulnerability Help

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits. This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
3
votes
1answer
3k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we ...
33
votes
3answers
3k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
5
votes
2answers
3k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
2
votes
1answer
62 views

How to install client securely?

I'm writing a program in PHP that sends data from one master to many clients (all Joomla websites). When the client software is installed, it should send a message to the master identifying itself, ...
2
votes
2answers
318 views

How to properly secure OO PHP CMS?

I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
21
votes
5answers
921 views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
5
votes
2answers
784 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
1
vote
3answers
526 views

Login System Security Suggestions

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup: nonce to check if the login originated from our login form session and cookie auth mixed - in ...
2
votes
1answer
652 views

Advice if safe from mail header injection PHP [duplicate]

Possible Duplicate: PHP mail() Header Injection Prevention Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
3
votes
1answer
252 views

php security courses

I got asked today by my boss if I wanted to do some php security courses, however I am not even sure other than the zend securing php applications course if any exist could any one provide any links ...
3
votes
1answer
139 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...
4
votes
3answers
584 views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
3
votes
3answers
6k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
23
votes
5answers
2k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
2
votes
3answers
1k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
6
votes
4answers
569 views

Is there any chance PHP developers themselves implement backdoors in PHP core?

This is not a concern that I personally have,no! In my job environment I've heard from programmers and non programmers that PHP developers always put secret backdoors in PHP that no one has access to ...
8
votes
2answers
2k views

PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?

For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
3
votes
2answers
2k views

sanitizing input/output in php/codeigniter

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output. Background: Users can submit reviews to the site, ...
2
votes
3answers
3k views

How to fix specific XSS issues in URL via php?

I am using Netsparker community edition for checking my app for any general security holes. I'm getting a lot of following XSS probable issue areas: my_php_file.php?nsextt=" ...
4
votes
2answers
190 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
5
votes
1answer
922 views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
4
votes
3answers
420 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
2
votes
1answer
318 views

Malicious(?) PHP / BASH Script. What is it?

I'm not sure if this is against the rules of the site. If it is, please let me know and I'll delete the question. I've seen variations of this script floating around recently. What the heck is it, ...
3
votes
3answers
329 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering that is there any necessity to do that if we've already cast it? $num = (int) $num; can we use real_escape() ...
7
votes
3answers
1k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf ...
3
votes
3answers
1k views

How can I make it more difficult for a user to create multiple accounts?

I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts. What all of a user can be traced? I'm thinking: IP address Mac address ...
2
votes
2answers
401 views

PHP socket_connect Stack Overflow

In the desciption of the vulnerability: Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to ...
6
votes
2answers
487 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
3answers
289 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
5
votes
3answers
612 views

Is there a good reason to turn off phpinfo()?

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
29
votes
3answers
9k views

How does “check.torproject.org.” know if you're using TOR?

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not. ...