Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
1answer
400 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
0
votes
0answers
18 views

Hack Laravel based website using sqlmap [on hold]

I am currently building a website using Laravel Framework (PHP). Using sqlmap to test the safety, however it seems that that Laravel has already covered this. Has anyone tried methods/parameters to ...
0
votes
2answers
93 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
-5
votes
0answers
33 views

Is someone using my PHP script? [on hold]

Well I've made a forum in PHP from scratch and I'd like to share it online. I'd like to know if there's any way to figure out if someone's using my script.. Basically I'd like to know how many people ...
0
votes
2answers
314 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
1
vote
2answers
163 views

session security in php

This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security. Are there any other cases I should consider? Below is just an ...
2
votes
2answers
425 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
-2
votes
1answer
221 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
1
vote
0answers
44 views

I want to figure out how cookies/ session variables interact to validate a user session [migrated]

---I have been experimenting on cookies/ session ids and have a little trouble digesting in the concepts. I'm working on a Debian distro. Using Burp to capture/alter requests/ responses. What I know ...
42
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
2
votes
2answers
82 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
21
votes
5answers
3k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
0
votes
1answer
114 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
4
votes
2answers
3k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
1
vote
2answers
70 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
-4
votes
0answers
30 views

injection of a malicious php file to the webroot folder [closed]

an attacker has inject an php file to the webroot folder where all the files and folders relating to many websites are reside. the php file can upload any file to current working directory of web ...
0
votes
1answer
62 views

Directory names using extensions a security risk?

In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name). Someone suggested to use standard file name sanitization ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
-2
votes
0answers
17 views

How to concatenate 2 function in php [migrated]

I have an application with the following code: <?php if(isset($_GET['function'])){ $_GET['function'](); } ?> So if i entered this url: http://localhost/?function=phpinfo I ...
1
vote
2answers
49 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
2
votes
2answers
140 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
2
votes
2answers
172 views

What is a current best practice example of basic encryption and decryption in PHP?

I have a good working knowledge of basic security best practices (password hashing, preventing sql injection, CSRF, etc.) but am completely at a loss for finding a solution to common-case encryption ...
17
votes
1answer
452 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
1
vote
1answer
56 views

Security issue with form action $_SERVER['PHP_SELF']

I read that there is a potential securty issue with forms like this (action $_SERVER['PHP_SELF']) <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> <input ...
0
votes
1answer
656 views

How can I detect whether a webshell exploit has been run?

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files ...
1
vote
1answer
90 views

How to prevent adding malicious code, found in hacked Wordpress website?

I have a website created using Wordpress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an ajax request with a HTML code, which should receive a JSON object as ...
0
votes
0answers
13 views

TYPO3 installation and apache's DocumentRoot permissions [migrated]

I just installed TYPO3 7.1.0 and managed to resolve all the issues (e.g. missing system libraries, php-open_basedir-issue and so on) during and after the installation. But there is one issue that ...
-3
votes
0answers
14 views

Php's password_hash encoding for HTTP basic authentication [migrated]

My problem: I need, basic authentication over HTTP (client can't afford HTTPS). So I don't worry if communication is not encrypted. I just want to prevent some user from sniffing and using the ...
4
votes
3answers
167 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
0
votes
1answer
59 views

Is enough to remove “..” from strings to avoid directory traversal attack?

Lets say I want to build a simple PHP script that let me access files inside a folder: $path = $_GET['path']; $path = str_replace('..', '', $path); $path = "./static/" . $path; readfile($path); Is ...
-2
votes
1answer
86 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
-3
votes
1answer
43 views

Creating blacklist on login page [closed]

I am working on how to secure login page from tautology attack. Can anybody help me on how to create blackist of SQL keywords in php ?
1
vote
1answer
326 views

What does this PHP injected-code do?

I've just found out that all of my websites on one of my server has been hacked. Some seemingly malicous code was injected into all index.php files: /*EngineWork*/ if(!defined("FDSJERIUI234FSDF")){ ...
1
vote
0answers
37 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
0
votes
1answer
34 views

PHP and other files on the server, their visibility and access [closed]

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-2
votes
0answers
33 views

are there commonly known risks of PHP generated email? [migrated]

In the following code, an email is sent via PHP, Apache, and Linux. A comment from a website user, $comment, and her $emailFrom address, are obviously potentially of an unknown nature. Do these fields ...
10
votes
4answers
1k views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
0
votes
1answer
55 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
7
votes
3answers
647 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
1
vote
1answer
316 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
2
votes
0answers
19 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
-2
votes
2answers
86 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
3
votes
3answers
130 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
1
vote
1answer
59 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
1
vote
2answers
89 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
1
vote
0answers
39 views

Unidentified contents injected in include file [closed]

This code was injected into a "include" file on my server. http://pastebin.com/Eueu8unY Any file that included this gave a 301 Moved Permanently error. I wish to know: Is this due to an insecure ...
2
votes
1answer
59 views

Using INTO OUTFILE with INSERT

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and ...
2
votes
1answer
101 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
2
votes
2answers
171 views

Why does this CSRF vulnerability work?

Recently Laravel 4 was updated to address a security concern: there was a CSRF vulnerability in their code. Here's the old code: if (Session::token() != Input::get('_token')) { throw new ...
3
votes
1answer
117 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...