Tag Info

Hot answers tagged

5

You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it. Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...


4

At the top level, it's doing something relatively new, using assert() to get PHP to dynamically evaluate some PHP source code, because using eval() or preg_replace() with a 'e' flag is out of fashion. Under about 10 layers of ROT13 and base54 and gzip obfuscation, it runs Web Shell by oRb ("WSO" or "FilesMan"), version 2.5. WSO is one of the more ...


3

If the web server you are using is correctly configured, you don't have to worry about the actual uninterpreted ASP / PHP files themselves being served out (unless of course the attacker is exploiting a vulnerability somewhere, as you pointed out). If you're especially concerned about code theft it's probably more useful to think about other, more likely ...


2

Going from the above code, you need to be more concerned with directory traversal than you do with LFI. Although similar, an LFI allows code execution of the traversed file while directory traversal allows file access. To make safe, sanitize "/var/www/logs/" . $name . ".log" with the realpath function then check that the returned path begins with ...


2

As of 2015 this is how you prevent your website from sending the Referer header: Just add this to the head section of the web page: <meta name="referrer" content="no-referrer" /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name="referrer" content="unsafe-url" ...


2

This is not possible. It is not possible to manipulate an HTML form using JavaScript as far as file upload fields go. As noted the form must be submitted as multipart/form-data and the filename needs to be submitted as part of that: Content-Disposition: form-data; name="file"; filename="foo.exe" The value of an input with type file is readonly in ...


2

I'm positive there are quite advanced tools available for this. Form fuzzers come immediately to mind. If you're just trying to check for what happens with 10,000x form posts come in, you might be able to script something fairly trivially. I haven't tested this, but you might have luck with something similar to: for ((i=1; i<= 100; i++)); do curl ...


2

I think you're the proud owner of a "libworker.so" backdoor! Malware Must Die has a good analysis of it, read that before running it yourself. The Malware Must Die author isn't a native english speaker, but does disclose a ton of detail. Malware Must Die has the PHP "dropper" code getting downloaded via a copy of "Web Shell by oRb", so you're going to need ...


2

Where to place PHP files for security? Put in mind that there is no best place to store your files safely. The safety of your sensible files is only a result of a combination of good measures -such as preventing URL injections that may disclose your sensitive files- you may take and discussed below briefly. My thought is it should follow the ...


2

Basically you are right: on a server you own there is no actual need to place the PHP files in the document root directory. Only is needed some entry point like an index.php file or any other file targeted by your rewrite rules. Once the web-server hand-hovers the request processing to the PHP interpreter, you are not bound anymore by the web-server's ...


1

Also Burp https://portswigger.net/burp/ While you're at it - although ZAP (Zed Attack Proxy) is not a tool specifically designed for dictionary attacks - it is a swiss army knife for scanning for Web site vulnerabilities. Quite easy to get up and running and it can proxy through SSL pages. Recently moved from Google Code to GitHub ...


1

You need to send an X-Frame-Options header, usually with the value "sameorigin". You can do this in Apache using mod_headers, something like: Header set X-Frame-Options sameorigin


1

A lot depends on what it is your trying to do and what the risks are associated with session hijacking. Generally, if you have a real need to ensure the session is actually owned by the right user, you would add additional checks, such as username and password etc. The EFF has been doing a bit of work on how you can do browser fingerprinting to track ...



Only top voted, non community-wiki answers of a minimum length are eligible