Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

13
votes
3answers
991 views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
7
votes
2answers
883 views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
8
votes
2answers
469 views

Key management scheme in PHP that is compliant with NIST SP 800-57

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
5
votes
1answer
376 views

Using sudo to secure git deployment via web script

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility. Briefly, how it works it: I commit to Bitbucket Bitbucket POSTs to a ...
2
votes
1answer
202 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
3
votes
4answers
411 views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...
31
votes
5answers
4k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
6
votes
2answers
3k views

php.ini security setting after attack

My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options. here is my settings: file_uploads = Off ...
2
votes
5answers
480 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
21
votes
5answers
941 views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
5
votes
4answers
540 views

Is not checking the src url a vulnerability?

By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
1
vote
1answer
304 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
5
votes
3answers
3k views

Starting a secure php session

I have been looking into creating secure php sessions for use in a login script for a week or so now. So far I have not found a concrete resource to base my work off, reading StackOverflow all I have ...
0
votes
1answer
164 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
2
votes
1answer
3k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
20
votes
5answers
2k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
0
votes
1answer
210 views

Malicious PHP code can run in cache. Solution?

I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database The way how I cache is by creating html page with the details of the user using ...
1
vote
1answer
89 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
6
votes
2answers
128 views

Security concerns with pre-pay system

I am looking at setting up a pre-pay system for the food retail industry. Retailers will be able to generate random 10 digit codes and supply these to customers to enter into an app to gain the value ...
4
votes
1answer
837 views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
23
votes
5answers
2k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
0
votes
2answers
944 views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
2
votes
3answers
1k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
0
votes
3answers
834 views

Viewing the configuration.php

My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario). ...
3
votes
3answers
2k views

User data encryption/decryption in a database (PHP)

I was wondering which is the best way to encrypt and decrypt user data in a database, to make it much more secure as it is possible? I was reading about AES but I would like to know if is really the ...
7
votes
1answer
2k views

PHP crypt() trims the salt as it would be too long

I am using Blowfish with PHP crypt() for password hashing but I noticed something weird. Quoting PHP documentation: CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$", "$2x$" or ...
2
votes
1answer
302 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
1
vote
2answers
353 views

Strange Pharma Spam Site resulting from DAT file created by SQL Injection?

Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
10
votes
1answer
2k views

How to properly secure a $_GET in PHP?

I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
1
vote
1answer
221 views

Is it possibel to inject php code to roundcube errors log file via LFI vulnerability? [closed]

i tried to inject php code to roundcube errors log file, with no success. i think there is something filtering injected php code.
35
votes
3answers
3k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
5
votes
4answers
1k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
8
votes
2answers
3k views

when to use nonce?

I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
4
votes
3answers
2k views

optimal way to salt password?

A good way to salt password? I have read a few answers related to salting password. But I started to get confused. I came across few functions people used to generate salt like: mcrypt_create_iv() ...
2
votes
1answer
190 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
12
votes
4answers
1k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
2
votes
2answers
795 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
3
votes
1answer
174 views

Malicious php scripts in word press theme folder?

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
2
votes
2answers
357 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
4
votes
2answers
2k views

How to find and protect against the exploited vulnerability in a PHP application based on the logged URL?

I have been attacked on a shared host server and they said I should configure my own php.ini file properly. I have a little PHP/MySQL program with a registering function, a little admin site. ...
2
votes
2answers
326 views

Can the `system` function pose severe security threats on a shared hosting server?

I recently bought an account from a shared hosting company and I needed the php system function to be enabled for one of my projects. So I created a ticket and asked them to enable it. This is what ...
3
votes
1answer
5k views

Where and How is data stored in a session?

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored? If I store an object of a class, in ...
4
votes
3answers
5k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
5
votes
3answers
361 views

Security risks using tmpfile() for sensitive data in PHP

What are the primary concerns when storing sensitive data in PHP's temporary directory via tmpfile()? For instance: Could this data be recovered from HDD by a malicious admin? Could the admin easily ...
-1
votes
1answer
2k views

How to hack linux from phpMyAdmin? [closed]

I got the username and the password for phpMyAdmin, and i am trying to hack the operating system "linux". i tried to create an payload.php file which is a pyaload taken form metasploit. i encoded the ...
20
votes
3answers
6k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
2
votes
2answers
621 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
3
votes
3answers
329 views

PRNG: Does combining insecure algos help?

Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...
4
votes
1answer
484 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...