Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
0answers
14 views

PHP: decrypting a file directly to a stream using the defuse/PHP_encryption library

I have for a while been using the excellent Defuse PHP Encryption library for storing encrypted data strings in a database. I have an extension of this need where I now have files that need to be ...
2
votes
2answers
109 views

What is the meaning of this possible malware?

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am ...
0
votes
1answer
38 views

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible?

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible? Let's say we have the following URL https://example.com/product.php?id=1&action=show Now example....
0
votes
0answers
19 views

sql - Select boolean strictly true [on hold]

I want to select a row Ad as boolean which is strictly true. I am using the following SQL statement. SELECT 'user' AS username, 'pass' AS password, true AS Ad FROM users LIMIT 1; However the above ...
6
votes
1answer
219 views

SQL Injection through addslashes

I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose. After reading this topic and this topic, I try to understand how it can bypass ...
1
vote
1answer
2k views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how is this really exploitable? ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
-1
votes
2answers
88 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
4
votes
3answers
167 views

Is this PHP code vulnerable SQL injection?

Im given control over the $vote variable (in the "challenge" function) Is there any way to sql inject the query? (BTW I can see/read whatever the challenge function returns e.g. the sql errors. I ...
1
vote
1answer
146 views

Is simple authentication safe if over HTTPS?

Background For my app I need to know if users have entered the correct email password combo. Pretty common stuff. I'm using HTTPS, and salting and hashing the passwords. Question Now, what I am ...
1
vote
4answers
79 views

How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.
2
votes
0answers
52 views

How can I protect my PHP app against XSS?

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones ...
3
votes
1answer
90 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
0
votes
2answers
101 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
0
votes
2answers
112 views

Wordpress - 3.9 - uploading a php file through media gallery

I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware. There is an app called: iCon2PHP that can merge php ...
8
votes
1answer
134 views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilities with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
0
votes
2answers
121 views

Remote code execution vulnerability in PHP's base64_decode?

I'm trying to pentest a PHP script. This is the last line of the script that I want to exploit: Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']); Is it ...
1
vote
1answer
53 views

How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...
0
votes
1answer
67 views

Best approach to get user's IP

There is two approaches: First approach: if (isset($_SERVER['HTTP_CLIENT_IP'])) $user_ip = $_SERVER['HTTP_CLIENT_IP']; else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) $user_ip = $_SERVER['...
1
vote
3answers
131 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
1
vote
1answer
42 views

RCE in a PHP script that doesn't have write permissions

So i've found a RCE vulnerability in a PHP script (it's in a file called viewfile.php). Basically, from this file I can execute whatever PHP code I want, for example, <?php echo phpinfo(); ?> ...
0
votes
1answer
82 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
1
vote
2answers
116 views

SQL Injection not working when I think it should

I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed ...
29
votes
4answers
2k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
4
votes
1answer
146 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
0
votes
2answers
148 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
-1
votes
0answers
23 views

Is this PHP code vulnerable to some attack? [migrated]

So I've made a PHP code for a login form. But i am not sure if this code was that safe, because i am not a security expert. I am using PDO statements in my code, here's my code : <?php class ...
1
vote
2answers
56 views

What cookie request is a suspect request?

I have this table which is containing all users' cookies: (about being login. that's actually "remember me checked") // cookies +----+---------+-------------------+------------+ | id | user_id | ...
28
votes
2answers
18k views

Risks of a PHP image upload form

My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with ...
0
votes
0answers
21 views

Restrict Excecution Access [migrated]

Lets say we have multiple domains in the same hosting account. The tree is like: home->website1 home->website2 home->website3 The problem is that website3 or website2 can contain a php or js file ...
124
votes
8answers
22k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
4
votes
4answers
185 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
1
vote
3answers
1k views

How to exploit this include_once vulnerability in PHP?

I'm performing a static analysis on a PHP code and came across this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP request: ...
1
vote
1answer
632 views

Security issue with form action $_SERVER['PHP_SELF']

I read that there is a potential security issue with forms like this (action $_SERVER['PHP_SELF']) <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post"> <input type="...
3
votes
3answers
413 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
-1
votes
1answer
67 views

Do I need to detect user's device for “remember me” system? [closed]

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
1
vote
0answers
92 views

Obfuscated PHP code found in WordPress core files and plugins

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
3
votes
3answers
672 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering if there was any necessity to do that if we've already cast it? $num = (int) $num; Can we use real_escape() ...
5
votes
1answer
88 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
-6
votes
2answers
54 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
7
votes
2answers
991 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
0
votes
2answers
451 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
0
votes
1answer
2k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
1
vote
4answers
49 views

Remove possibility to read system files with PHP from Apache

When I upload a php file (file.php) with following content on Apache server <?php $file = $_GET['file']; include ( $file); ?> I am able to read any file of Apache using the below URLs http://...
0
votes
2answers
121 views

Can an SQL injection attack happen if the input is only allowed to be hexadecimal characters?

I've set up a login system that works more or less like this: 1) The user enters the data 2) The data is hashed locally using SHA256 (To reduce the risk of someone stealing the password through a ...
0
votes
2answers
96 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
7
votes
1answer
333 views

What is the name for this type of URL attack?

Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs ...
4
votes
1answer
75 views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...