Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

1
vote
1answer
95 views

What security practices should I keep in mind during development? [on hold]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
-4
votes
1answer
21 views

Exploit php array and string using url variable [on hold]

I get this php error after requesting /main/located?location=usa&time=' on my site. array(0) { } string(8) "||| LOCATION I tried several methods to inject something, but all failed.. What do ...
0
votes
2answers
137 views

Getting the uploaded file path without knowing the uploading destination

Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
2
votes
3answers
95 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
0
votes
0answers
18 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
20
votes
1answer
622 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
1
vote
2answers
101 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
0
votes
1answer
63 views

Securing SQL injection for my PHP files [closed]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...
1
vote
2answers
77 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...
1
vote
0answers
43 views

Is there anything to worry about — worth putting security on a simple test site?

So I want to make a site, this site won't have users (so no one but me will be able to post to the site) or anything it will just echo out items from Mysql like title and text-body I was wondering if ...
4
votes
2answers
231 views

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image. What I'm currently doing is file_get_contents('pic') ...
0
votes
0answers
22 views

Can PHP sockets and HTTP requests be logged? [migrated]

I would like to be able to log outgoing HTTP requests from PHP scripts with the time and PHP script location and line. It occurs to me that since you apparently can open sockets in PHP, you would also ...
2
votes
0answers
30 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I hope this is the right place to post this! I have been looking around the web for large data sets (specifically web related log files - mysql, php, apache, and so on) that contains data of ...
-4
votes
2answers
74 views

How do i make a phone number authetication system for my website? [closed]

I really need to prevent users from create multiple accounts. So I was thinking about making a phone number authentication system. Where when a user signs up, a 4 digit code is sent to their phone, ...
1
vote
2answers
37 views

If I write an nmap job into crontab from PHP code to run background, how can I get the status of the nmap cronjob?

I am trying to write a php code test to write an nmap scan (with parameters) scheduled into crontab file. While the nmap is running I would like to get the status of that specific nmap scan. For ...
0
votes
1answer
79 views

Is this data encryption process secure?

I have created the following encryption process which I will be using to store CD keys inside my database. Before I use it, however, I need to make sure that this is as secure as possible. From what ...
2
votes
2answers
3k views

Proxy / VPN Quality Check / Detection

Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software? I have already tried to use this code, but it doesn't detect all proxies, in fact it detect ...
1
vote
1answer
69 views

PHP code in user session LFI filtered out

Firstly, I make the obligatory disclaimer that everything I am doing here is legitimate and pre-authorized, etc., etc. For those unfamiliar with user session local file inclusion in PHP, there's a ...
3
votes
3answers
99 views

How dangerous are outdated PHP versions for my clients?

In the company where I work (webhosting) our custoumers can choose the PHP version they want to use for their website. However, I have just realized that all of the offered PHP versions are outdated ...
3
votes
0answers
54 views

Concepts of a secure note sharing system

I am trying to design a system that will allow for staff members in our small company to securely share sensitive customer information (text) and see them on a web page alongside less sensitive ...
1
vote
0answers
23 views

Folder Access restriction in Shared Hosting

In shared hosting (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories. It needs some configuration like ...
1
vote
2answers
67 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
1
vote
0answers
25 views

Is it possible to pass both a message and a public key from stdin to gpg/gpg2? [migrated]

If I have both a message (M) and a public key (P) in a process memory, what would be the way to encrypt M using P without writing either to a temporary intermediate file? Any chance I can pass both ...
1
vote
1answer
58 views

How much of a security problem is PHP's proc_open() on a shared host

My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. ...
1
vote
2answers
75 views

What are the dangers of sql injection with php?

I made an SQL-injectable web-app build to with PHP to get a better understanding of what is going on and automated it all with sqlmap. The relevant code is the following: mysqli_query($conn, SELECT ...
0
votes
3answers
71 views

Is it possible to get Network Domain from Client with PHP or Apache? [closed]

I'm working on a solution to identify client Network Domain or Workgroup in a private network. Based on it, I must change some access permissions. I can't do that through IP address because it isn't ...
1
vote
1answer
55 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
3
votes
3answers
289 views

How to prevent adding malicious code, found in hacked Wordpress website?

I have a website created using Wordpress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an ajax request with a HTML code, which should receive a JSON object as ...
1
vote
1answer
51 views

There was a potential harmful file on my server, What damage has it done? [closed]

I received an abuse complaint for my server from hosting provider. After a thorough search I found file with name "title.php" in a WordPress installation's upload directory. I am curious to know what ...
2
votes
1answer
41 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
1
vote
0answers
36 views

Webserver | IIS | Configuring to not run certain files [closed]

I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP. Lets assume the a user is able to upload a trojan onto my server, either through a ...
0
votes
1answer
66 views

Setting the HTTPOnly flag for PHPSESSID cookie [closed]

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
1
vote
1answer
37 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
7
votes
3answers
6k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
2
votes
3answers
46 views

How to create a secure nonce for WSSE

I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important. I found very different implementations: * ...
1
vote
1answer
178 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
2
votes
2answers
146 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
-1
votes
3answers
130 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
3
votes
1answer
48 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
0
votes
1answer
163 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
5
votes
1answer
166 views

PHP bin2hex vulnerable to timing attack?

I've read in a few places[1][2][3] of the desire to make PHP's bin2hex constant time. In what scenarios would bin2hex be vulnerable to a timing attack? Is this below code for handling a CSRF token ...
-1
votes
2answers
57 views

webshell on webserver, but what does it contain/do? [closed]

Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely. This is the part where I am missing some information: md5($_POST['_f__f']) Does ...
2
votes
1answer
83 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any ...
0
votes
1answer
106 views

RSA/ECB/PKCS1Padding: Encypting a Session Key Javascript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
0
votes
1answer
114 views

Reading php comments using php page that open text files, CTF [closed]

There is a CTF Problem that it needs to see comments of a PHP file using some vulnerabilities of PHP; The Question is: In the link bellow You must change lorem.php to read exact php comments of ...
0
votes
2answers
78 views

Is this sufficient text cleaning in a PHP Form?

Wondering if the following is sufficient for sanitizing input in a simple contact form that contains inputs for $name, $email, $phone, and $text. There is no SQL. I am simply wondering if I am doing ...
0
votes
1answer
57 views

Is SESSION is safe for transferring encrypted email and password in PHP

I am working on a project where I am using PHP_SESSION, Somewhere I heard that PHP_SESSION are quite unsafe for passing valuable data so I have to know what are the security flaws, how it can be ...
0
votes
0answers
57 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
-1
votes
4answers
81 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
3
votes
2answers
83 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...