Tag Info

Hot answers tagged

14

No. SQL Injection should be prevented by parameterizing your queries. OWASP has some great resources to help you with this. Here is one such sheet to show this in several languages. The PHP cheat sheet also has some more information regarding sql injection. To directly address your hard coded filter function check out this source demonstrating the ...


7

No, it doesn't, use prepared statements as is plus single query functions and proper input validation. The latter one is the default for most functions in PHP (e.g. mysqli::query Vs. mysqli::multi_query). Prepared Statements Prepared statements will forward the data of a variable and its type separately to your DBMS which in turn will either escape all ...


6

FastCGI communicates between the webserver and the CGI host using IPC rather than environment variables, so the main attack vector (the webserver setting environment variables for CGI) is gone. However, it is still possible for you to be attacked if your PHP script itself sets environment variables based on user input before executing bash.


7

No. The backdoor is not on this script. This piece of highly obfuscated code contains a program to allow the hacker to dynamically append any HTML or javascript by randomly calling a server located at 31.184.192.250 with one of the four hostnames "33db9538.com", "9507c4e8.com", "e5b57288.com", "54dfa1cb.com". The deobfuscated code looks something like this: ...


5

There are a few things you can do to mitigate the risk: Try to upload the files to a path outside your webroot For example, if you host your site on /var/www/myserver/html, make your PHP upload script write files on /var/www/myserver/data. This way, a Local File Include will not work, as the sent files are outside the server root. Don't use Mime Type or ...


4

It could be due to a (previous) bad code or to avoid warnings/errors in responses. stripos returns the possition of second parameter in first one, starting indexes at 0, so in a bad code if (stripos($ua,'android')) the condition would be skipped as false in the case the string started with android. Correct solution would be using === and !==, but ...


3

One relatively easy approach to this would be to create a persistent cookie on the client's side after the first log in. The cookie should hold only the user's username and a generated key. During the next log in the server would verify the key against the same key stored in the database and if it doesn't match or the user doesn't have the cookie at all you ...


3

your best bet for this would be probably to look at the other OWASP ESAPI implementations to see how they've handled it, which should at least give you the approaches to look at, even if you then need to translate that over to PHP. In terms of information you could look at this post about the Java ESAPI implementation which is, AFAIK, the most mature one ...


3

If someone manages to catch a request like this it may be possible to resend the request numerous times in your five second frame. Now the question is how to prevent this. There are more options, the most simple one seems to be, that you add a unique ID to each command, and the recieving server stores them in a way (like a table) and executes your ...


3

Because the index.php file is already being processed. When you attempt to inject a ?> tag into the file, you're actually injecting it into the page that will eventually be sent to the client.


3

I recognize this webshell, as I've dealt with it many times over my years in the shared hosting world. This is known as a webshell. This particular one, Filesman, has a slew of dangerous features one can execute. To name a few, they can view and download any file or directory in your webroot, change permissions (CHMOD) of files and directories, and open ...


2

The session is just a random generated token which is impractical to guess. There are many scenarios in which stealing sessions are possible such as Cross Site Scripting (XSS) or by sniffing the traffic if the attacker has access to a networkin node between client and server. To solve the XSS issue you need to not have validation issues. This means proper ...


2

Yes, it's not C/C++ language; however, perl, PHP, ruby and java are descendents that carry on various C language conventions. By not having %n, php gets rid of part of the problem, but it still has %x which can be exploitable under certain circumstances. Basically, printf() and its variants can allow control of the format string if you don't specify it. ...


2

Why not just use an existing token-based authentication method like Kerberos and build off of it? So the user authenticates normally and receives a kerberos token. Then, you go to the API server, say "Hey I got this token!" The API server verifies it, and sends a copy of the encrypted data to the user, who can decrypt the keys on their machine? Seems ...


2

The two main risks of a system such as this are: SQL Injection XSS The risk of SQL Injection is mitigated by the use of parameterised queries. This ensures that data values inserted into the database can only be interpreted as data and not by part of the query by an attacker escaping out of the context. XSS is prevented by correct output escaping. This ...


1

As @Douglas and @fleshgrinder said before, no. Consider the following request: SELECT title, news FROM news_table WHERE id = $id Applied for $id = 5 is fine, now if $id = 5 OR 1=1 will display all the news... Not a big deal? Now if $id = 5 UNION SELECT login as title, password as news from secret_credentials_table where is_admin = 1 should also be a ...


1

Very risky. The first could be used to perform operations on the wrong database, possibly bypassing access restrictions (I don't think it could access the MySQL internal database because of the underscore, but I could be wrong). The second could be manipulated to access any "functions.php" file in the filesystem, and if you also permit file uploads, this ...


1

You can't read PHP code with an include() or require() because these functions evaluate the PHP code within a file. If you can control the beginning part of the string passed to include() or require() then you can use a php://filter to read php files, but this attack pattern does not apply for this bug. In order to get a shell with this LFI vulnerability, ...


1

It works perfectly fine for me with eng.php/../../../anotherfile (I'm using PHP 5.5.6-1). Are you sure that anotherfile.php is in the correct directory? Try placing it in the same directory as the lang php files and include it there (just for testing). is it readable by the web server? (for testing, you can just chmod 777 file.php). Also note that while ...


1

Sigh. Here is the reasoning for me posting a link in lieu of a long answer. Original post wants to inject/disaffect/exploit through the lang variable in cookie: GET /en-us HTTP/1.1 Cookie: xxx=eng.php/../../../anotherfile He then states he tried and failed: ErrorException: ...


1

Your code looks good and there doesn't appear to be anything you need to be worried about. A side note or two: I would consider adding trim() to your variable to clean any white space. I am a little curious why you use if(!empty){}if(empty){} instead of an if(!empty){}else{}


1

Set <form> accept-charset Attribute using UTF-8 Sanitize all the html / xml special characters and replace them with their escaped version. Display the code within the <pre> tags


1

You escape the output by replacing "special" characters with their HTML character entities. In PHP, you can do this using htmlspecialchars(), for example. I suggest using the ENT_QUOTES flag to ensure all types of quotes get encoded.


1

You seem to talk about two different things: retrieving mail and encrypting mail. From reading the question I think encryption is not what this is about. So for now I forget about it. When you login to Hotmail or Gmail via your browser, you use your login. It looks like you have more email addresses and possibly popboxes. Now it depends on how you setup ...


1

The two encryptions are equivalent. You can add a wrapper to use one approach as a drop-in replacement of the other: /** * Uses the one-parameter method as if it was the 2-parameter one. */ function buhlencrypt($keya, $data) { global $key; $key = $keya; return encrypt($data); } /** * Uses the two-parameter method as if it was the one-parameter. */ ...


1

The IP addresses seem to belong to a plethora pf european ISPs/data centers: inetnum: 83.31.0.0 - 83.31.255.255 netname: NEOSTRADA-ADSL descr: Neostrada Plus descr: Warszawa country: PL inetnum: 178.217.184.0 - 178.217.191.255 netname: HOSTEAM-1 descr: HOSTEAM S.C. country: PL ...



Only top voted, non community-wiki answers of a minimum length are eligible