Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

2
votes
1answer
332 views

How much of a security problem is PHP's proc_open() on a shared host

My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
0
votes
1answer
47 views

Safest way to access data from an SQL server

I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
3
votes
3answers
292 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
-4
votes
0answers
45 views

What is most secure web framework for a secure website? [closed]

What is most secure web framework for a secure website? Give me the best tips for a server and framework configuration: OS name-version, webserver, database, php. And tips for securing it. Thank you ...
0
votes
1answer
31 views

Any vulnerabilities in user input to web Server running Apache and PHP?

There is understandably a lot of emphasis on sanitizing user input handed off to PHP on a web server and numerous opinions on doing it. Can someone please confirm there is no security problems with ...
10
votes
3answers
10k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
5
votes
2answers
156 views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
8
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
3
votes
2answers
61 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
3
votes
1answer
42 views

Restrict user from executing shell commands using PHP

Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in ...
0
votes
1answer
59 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
5
votes
1answer
70 views

How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

PHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new ...
1
vote
1answer
52 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
0
votes
2answers
299 views

Possible hack on site?

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd. I have done lots of changes on this site ...
-5
votes
2answers
107 views

Is this something exploitable in this code?

Is there any possibility to pass this weak comparison? Can user input a file with an extension not contained in $allowed and get past the security check? $allowed = array('txt','docx'); if ...
1
vote
1answer
63 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
5
votes
1answer
80 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
1
vote
1answer
45 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
8
votes
2answers
2k views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
1
vote
4answers
179 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
1
vote
1answer
32 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
1
vote
2answers
83 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
0
votes
1answer
49 views

Wordpress - 3.9 - uploading a php file through media gallery

I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware. There is an app called: iCon2PHP that can merge php ...
-1
votes
0answers
17 views

How to extract the filename extension and check it against an array of allowed extensions? [migrated]

How to prepare subject string to fake preg_match checking extension from $allowed array? The goal is use filename with extension which is not in allowed array. I tried some trick like UTF8 coding and ...
4
votes
1answer
89 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
1
vote
3answers
97 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
6
votes
1answer
58 views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
8
votes
1answer
59 views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilites with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
-1
votes
1answer
49 views

Using and creating a custom 2 way encryption function [closed]

I am trying to create a 2 way encryption function using PHP. As yet I do not have a very good system at all, it is severely flawed and highly insecure, it is using a substitute cipher running from ...
2
votes
1answer
38 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
3
votes
1answer
104 views

Offering a privacy scenario with PHP mcrypt library

first of all, sorry if my question is not clear, because English is not my first language. Anyway, let-me explain the concept I'm struggling to solve as the best solution. I have some guys, and they ...
28
votes
4answers
2k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
4
votes
2answers
333 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... ...
44
votes
6answers
9k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
9
votes
4answers
9k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
3
votes
1answer
270 views

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
-1
votes
1answer
37 views

Token in URL changes on click [closed]

Logging into OpenCart admin, I find a token in its URL: http://localhost/opencart/admin/index.php?route=common/dashboard&token=xOHq2UzQ0YwKTubXgxNpGFySmAA9W90z The synchronizer token pattern is ...
20
votes
4answers
21k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
1
vote
1answer
31 views

Logout CSRF Protection [duplicate]

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
0
votes
1answer
42 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do ...
2
votes
2answers
160 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
0answers
90 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
26
votes
7answers
4k views

How to replace SSL/TLS?

I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS) The data that ...
-4
votes
2answers
51 views

php malware file-names [closed]

The following is a list malware php file-names that I found on my server some time ago, looking at the source these were clearly to allow a hacker to take full control of my server. I'm posting these ...
1
vote
1answer
69 views

WordPress site is infected with malware, cannot find dropper [duplicate]

I am in a bit of an annoying situation. I inherited responsibilities of a WordPress multisite once managed from from other contractors and that site has been infected with virus dropping malware. I ...
1
vote
2answers
62 views

Application that uses USB token to assign user on a server

I have the following situation: One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password; When the user is logged he ...
4
votes
2answers
92 views

Saving Personal Information (Name, Address, Phone, Email) in MySQL Database

I'm going to build a web app for people to sign up and pay for a membership. The transaction information will all be processed through Authorize.NET but we save the rest of the information (Name, ...
1
vote
1answer
1k views

Is it safe to store the reset password token in PHP session

I have a login system created in PHP. It currently doesn't have the "forgot password" feature and I would like to implement the feature. For this I'm planning to do the following: When user submits ...
1
vote
1answer
41 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...