Security aspects concerning code written in the programming language PHP which is often used for web applications.
37
votes
5answers
2k views
Password security in databases - today still best practice? [duplicate]
Possible Duplicate:
Which password hashing method should I use?
There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am ...
32
votes
1answer
2k views
default.php file found on the server, is this a security threat?
I found a file named "default.php" on the server with following code
eval(gzinflate(base64_decode(
...
29
votes
3answers
1k views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
24
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
21
votes
5answers
2k views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
20
votes
5answers
733 views
Should passwords be revealed in error message?
I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
18
votes
4answers
3k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
18
votes
3answers
3k views
How does “check.torproject.org.” know if you're using TOR?
I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not.
...
17
votes
3answers
3k views
What are the best practices for hardening a php.ini file?
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
16
votes
4answers
737 views
How to convince coworkers to not store credit card numbers ourselves
The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
16
votes
5answers
400 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
16
votes
5answers
1k views
Should I use Suhosin for PHP?
Suhosin can be used to increase the security of your php application.
I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
14
votes
4answers
443 views
What are the security threats of zip file uploads and what preventive actions should be taken?
We have a Drupal application developed for sharing files.
We are allowing zip files to be uploaded by logged in departmental user.
We are using Drupal private file system (outside webroot).
We are ...
14
votes
4answers
4k views
How did anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, anonymous took down a child pornography site using SQL-injection. I read in this article that anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
13
votes
6answers
885 views
Is it possible for a hacker to download a php file without executing it first?
I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
12
votes
3answers
451 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
12
votes
1answer
373 views
Risks of a php image upload form
So I have a client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated ...
12
votes
2answers
487 views
PHP attack string in access logs
So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I ...
12
votes
2answers
1k views
How to do Ajax securely?
This question is inspired by this security question http://security.stackexchange.com/questions/1707
What are the threats in using Ajax? (Please note I am talking about security threats, not ...
12
votes
5answers
3k views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
11
votes
4answers
447 views
what to do after suspected intrusion on hobby webserver
I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
11
votes
3answers
494 views
Getting a manual security code review done - What to watch out for?
We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process.
We did specify what kind of tests he should be ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
10
votes
4answers
460 views
Why do browsers warn about mixed content for images?
I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website.
However, they want to preserve the traditional forum ...
10
votes
2answers
1k views
Is strip_tags() horribly unsafe?
I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML!
Is it true?
What can I do to ...
10
votes
1answer
602 views
How to properly secure a $_GET in PHP?
I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
10
votes
1answer
330 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
10
votes
4answers
583 views
Encrypting IP addresses in a MySQL database
I'd like to encrypt IP addresses in my MySQL database, with the following constraints:
Does not need to be resistant to attackers that can execute queries.
Must be resistant to attackers that have ...
9
votes
2answers
2k views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
...
9
votes
3answers
540 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
8
votes
1answer
411 views
Why do attackers bother (trivially) obfuscating their source code?
A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:
...
8
votes
2answers
276 views
Key management scheme in PHP that is compliant with NIST SP 800-57
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management
I wonder if there're any open-source or commercial PHP solutions ...
8
votes
1answer
369 views
PHP 5.3.9 Vulnerability Help
This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits.
This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
7
votes
4answers
668 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
7
votes
2answers
998 views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
7
votes
5answers
587 views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
7
votes
3answers
550 views
Should IP addresses be validated to prevent SQL Injection?
In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses.
Should I validate user IP addresses before using ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
7
votes
3answers
382 views
Finding security consultant for doing in-depth code review?
We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
7
votes
3answers
2k views
Creating Secure PHP Sessions
I have already created and refined both registration and login systems, However I am lead to believe the tricky part comes when you are creating a session. As far as I know this is due to both ...
7
votes
2answers
741 views
PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?
For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
7
votes
3answers
313 views
What security features should be present in every web-based CMS?
What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?
Please note: I'm looking ...
7
votes
2answers
159 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
6
votes
5answers
1k views
Why do people say that PHP is inherently insecure?
I've heard it said that PHP is inherently insecure. Is this true? Why?
6
votes
8answers
590 views
What is the vulnerability in my PHP code?
A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam.
I've taken ...
6
votes
3answers
471 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
6
votes
4answers
480 views
Is there any chance PHP developers themselves implement backdoors in PHP core?
This is not a concern that I personally have,no! In my job environment I've heard from programmers and non programmers that PHP developers always put secret backdoors in PHP that no one has access to ...
