Tag Info

Hot answers tagged

4

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all? Ajax is not a special thing regarding the transport of the login data, because it is a HTTP request done in the background instead of the foreground. Thus if done ...


1

I read Insufficient Entropy For Random Values and now I think non of the given examples provide enough entropy. gethostname() is not secret and uniqid() and even mt_rand() is a Pseudo-Random Number Generator. I will use $nonce = base64_encode(bin2hex(openssl_random_pseudo_bytes(16)));


1

The traditional way to avoid the user having to type in a user name is to include "remember me" functionality where the user name is persisted in a manner that is associated with the browser, e.g. an encrypted cookie or a cookie containing a durable token (say, 30 days) that the server can use to infer the user name. Some of the replies here are going to ...


1

Generally if you find an SQLi you don't need to map the whole database to prove the vulnerability, actually very little information is needed as proof. SQLmap is a great tool for what it's meant for, mapping databases, but it does have some limitations in usability. Generally I'd advice to use a web application scanner to look for SQLi vectors, for example ...


1

The payload is encrypted using a simple autokey cipher, using md5($_f__f).substr(md5(strrev($_f__f)),0,strlen($_f__f)) as the password. You could try the usual techniques for attacking autokey ciphers, but the length of the password (at least 32 characters) and the fact that the plaintext is gzip-compressed make it impractical.


1

This behavior is not directly linked to this exploit, but by a weak web server configuration. For instance: Apache offers through mod_mime the possibility to serve files with multiple extension. This extension is designed to serve the same way files such as welcome.html.fr or welcome.fr.html (ie. french version of the welcome.html file). However it can be ...


1

ECB doesn't even make sense in the context of RSA. It's a mode of operation for symmetric ciphers like AES. More info: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#ECB PKCS1Padding, however, does apply to RSA. And you're right - that likely means RSAES-PKCS1-V1_5. For the PHP side you can use phpseclib. eg. <?php ...


1

If you encounter a local file inclusion (LFI) vulnerability there is a special technique that enables you to read files from the target system by making use of a PHP wrapper. This will not work in every case but you might want to give it a try. You can read more about the PHP wrapper on the official php.net site: http://php.net/manual/en/wrappers.php.php ...



Only top voted, non community-wiki answers of a minimum length are eligible