Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
1answer
14 views

PHP and other files on the server, their visibility and access [on hold]

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-1
votes
0answers
77 views

PHP strpos and strlen Bypass

This is from a CTF event that has ended, but a writeup has not been done for it yet, and I'm quite curious as to how it would be done. With this code: $a = $_GET["pl"]; if(isset($a)) { ...
1
vote
1answer
335 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
2answers
77 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
-2
votes
0answers
33 views

are there commonly known risks of PHP generated email? [migrated]

In the following code, an email is sent via PHP, Apache, and Linux. A comment from a website user, $comment, and her $emailFrom address, are obviously potentially of an unknown nature. Do these fields ...
0
votes
2answers
224 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
0
votes
2answers
141 views

session security in php

This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security. Are there any other cases I should consider? Below is just an ...
-2
votes
0answers
19 views

How i can secure authentication with php? [on hold]

I have an identification with id and password , after the user enters the ID and password, then script php search in the database ( mysql) if the id and password exists in the table. Can you tell me ...
2
votes
2answers
337 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
2
votes
2answers
76 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
10
votes
4answers
975 views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
0
votes
0answers
27 views

What highest security brake with php-site where you can't modify php files? [on hold]

I want that Wordpress site: files are unmodified and dirs are unchangeble (can't add/delete/update files). this site will be inside container (Docker, LXC or OpenVZ). static content dir ...
15
votes
1answer
347 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
-3
votes
0answers
28 views

How can I chain web pages in PHP? [on hold]

Can someone help me to chain web pages, to avoid someone accessing the second page without identification in the first page?
0
votes
1answer
42 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
7
votes
3answers
636 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
1
vote
1answer
285 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
0
votes
1answer
97 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
2
votes
0answers
14 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
-2
votes
2answers
69 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
3
votes
3answers
80 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
1
vote
1answer
55 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
1
vote
2answers
63 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
0
votes
1answer
50 views

Directory names using extensions a security risk?

In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name). Someone suggested to use standard file name sanitization ...
1
vote
0answers
37 views

Unidentified contents injected in include file [closed]

This code was injected into a "include" file on my server. http://pastebin.com/Eueu8unY Any file that included this gave a 301 Moved Permanently error. I wish to know: Is this due to an insecure ...
2
votes
1answer
41 views

Using INTO OUTFILE with INSERT

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and ...
2
votes
1answer
99 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
2
votes
2answers
150 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
2
votes
1answer
82 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
1
vote
2answers
45 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
0
votes
2answers
58 views

PHP Plugin Security

I've been working on a Home Automation system now for a little more than a year and I've added a plugin system to it. I've also added so others can submit their plugins and if I accept them then ...
0
votes
0answers
71 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
6
votes
1answer
137 views

What is the name for this type of URL attack?

Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs ...
2
votes
2answers
528 views

Preventing SQL Injections

So I'm pretty new to SQL so I'm not too familiar with how to prevent any SQL injections. I have 1 main form that's being used as a poll and it currently only has 1 text field. At the moment I think ...
0
votes
3answers
82 views

htaccess - protect php file execution in specific directory

How can I protect php execution in specific upload directory? Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers. So how can I ...
1
vote
2answers
65 views

SQL Injection Issue Multi-line query

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as ...
0
votes
3answers
696 views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
-1
votes
1answer
41 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
1
vote
1answer
55 views

How to prevent adding malicious code, found in hacked Wordpress website?

I have a website created using Wordpress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an ajax request with a HTML code, which should receive a JSON object as ...
0
votes
0answers
27 views

Improve the security of a website implementing the least privilege principle [duplicate]

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
19
votes
8answers
2k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
0
votes
0answers
84 views

Improve the security of a website implementing the least privilege principle

I am a beginner and I am trying to program a secure website to improve my skills and knowledge. I am under Linux and I am using LAMP with php. My website is similar to a social network so people will ...
0
votes
0answers
34 views

Is Apache enough to prevent unauthorized access? [migrated]

I've just been assigned to finish the development of an application which has user restricted access. The original developer was a co-op student, as am I. After looking over his code it seems that ...
2
votes
0answers
31 views

Offering a privacy scenario with PHP mcrypt library

first of all, sorry if my question is not clear, because English is not my first language. Anyway, let-me explain the concept I'm struggling to solve as the best solution. I have some guys, and they ...
1
vote
2answers
175 views

How To Patch LFI Vulnerability

I'm pretty sure that you all are aware of this vulnerability, but i wonder how to patch this? I have seen this code in a tutorial that it is the way to patch this but still user can access all the ...
1
vote
1answer
56 views

How to use mySQL UNION operator in sql injection, with injectable password paramiter?

Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass ...
0
votes
2answers
86 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
2
votes
1answer
128 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
1
vote
2answers
54 views

Does using a MAC for encryption remove the need for PKCS7 padding with this class?

I am working with this PHP encryption class using MCRYPT_RIJNDAEL_256 and MCRYPT_MODE_CBC with a fixed 32-byte (64 character) HMAC key, as my basis. The class is a result of previous discussions and ...
0
votes
0answers
73 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...