Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

118
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
20
votes
3answers
3k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
27
votes
2answers
17k views

Risks of a php image upload form

So I have a client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated ...
36
votes
6answers
7k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
9
votes
4answers
10k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
70
votes
5answers
15k views

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]

I just noticed that the top line of my index.php file got changed to what's below. <?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
44
votes
6answers
10k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
22
votes
2answers
8k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
16
votes
2answers
11k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
7
votes
7answers
4k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
19
votes
4answers
9k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
29
votes
4answers
2k views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
15
votes
4answers
691 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
8
votes
2answers
2k views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
36
votes
5answers
7k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
33
votes
4answers
32k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
21
votes
1answer
14k views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($...
14
votes
3answers
23k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
38
votes
6answers
5k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole? ...
6
votes
6answers
2k views

What are some good, free tools to run automated security audits for PHP code?

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, ...
13
votes
3answers
8k views

SQL injection can bypass login but not drop table

I've setup a test environment for running some SQL Injection against my code and learning how to defend against it. I can bypass the login form using the following in the password field: ' OR ...
7
votes
4answers
960 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
7
votes
3answers
16k views

Generating an unguessable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation e-...
15
votes
3answers
2k views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
5
votes
3answers
7k views

PHP crypt() or phpass for storing passwords?

When storing passwords, should I use PHP's built in crypt or phpass? If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?
9
votes
4answers
2k views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
6
votes
6answers
2k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
5
votes
4answers
7k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', '4'=>'...
10
votes
6answers
4k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
5
votes
3answers
980 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
41
votes
3answers
4k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
13
votes
2answers
6k views

How to do Ajax securely?

This question is inspired by this security question http://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
15
votes
8answers
4k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?
47
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
13
votes
3answers
798 views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
9
votes
2answers
7k views

when to use nonce?

I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
2
votes
6answers
13k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
7
votes
3answers
5k views

How insecure are PHP's rand functions?

There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here. I understand those functions are insecure, but how insecure are they? ...
21
votes
5answers
1k views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
8
votes
3answers
2k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
12
votes
2answers
6k views

Is strip_tags() horribly unsafe?

I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML! Is it true? What can I do to ...
8
votes
3answers
823 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
7
votes
1answer
1k views

Does Heartbleed affect servers if OpenSSL was only used to generate the certificate?

I built an application that generates certificate signing requests (CSRs) using the PHP OpenSSL module. Is there a way that the HeartBleed bug can affect these (in use) private keys and CSRs that ...
5
votes
3answers
3k views

optimal way to salt password?

A good way to salt password? I have read a few answers related to salting password. But I started to get confused. I came across few functions people used to generate salt like: mcrypt_create_iv() ...
4
votes
2answers
2k views

Is PHP unserialize() exploitable without any 'interesting' methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
4
votes
2answers
2k views

How to find and protect against the exploited vulnerability in a PHP application based on the logged URL?

I have been attacked on a shared host server and they said I should configure my own php.ini file properly. I have a little PHP/MySQL program with a registering function, a little admin site. ...
1
vote
1answer
492 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
1
vote
1answer
1k views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
0
votes
2answers
949 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
5
votes
1answer
436 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...