Tag Info

Hot answers tagged

4

Let's remove PHP entirely from the equation for a moment. SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution. The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, ...


4

You have at least 3 ways to achieve that: In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime: ini_set("session.cookie_httponly", 1); If it doesn't work, you have to manually overwrite that cookie: ...


4

From the top of my head : the API server's security, which means you may need to hire a competent sysadmin to take care of it if you aren't experienced with system administration. Whatever security you implement on top of that (API authentication, etc) becomes moot if your server itself is compromised. Keep in mind that every software installed on it is a ...


3

First, you have no way to avoid people using curl to access the API. On the server perspective, your application and someone using curl or telnetting in is exactly the same. You must employ some controls and protections on the API that will make harder to people just fire up curl and mess with you database. As you are learning, I will not give you links, ...


3

When talking about SQL injection, regardless of language, you should use parametrized queries. These construct a query plan ahead of time, rather than when the user provides input, so an attacker cannot easily modify how the query works. PHP supports this, but you need to use the PDO library rather than the mysqli functions. http://php.net/pdo for more ...


2

It is clearly a spamming component. There's lots of mail sending functions around the code: private function mailPassthru($to, $subject, $body, $header, $params) { public function isSMTP() public function isMail() public function isSendmail() public function isQmail() This generally occurs when you have an outdated Wordpress installation laying ...


2

Most new versions come with security improvements, so the older a version is the more time an attacker has to take advantage of it. You can browse through a vulnerabilities library, for example here is one for php 5.4. You can check yourself how many vulnerabilities have been disclosed and how severe they are. For the most part I think its a matter of which ...


2

There are several improvements that can be made to the functions you've given, based on my knowledge. Obvious threats First, and most important, keep your private key secure, and make it external to the function definition (e.g., a second argument). I would recommend spending significant effort solving this problem. Is this per-user encryption, or ...


2

The WebSocket TLS (WSS) connection is a different connection from the HTTP TLS connection. A WebSocket connection is created sending a HTTP request containing the wish to upgrade the connection to WebSocket and by receiving a HTTP response granting this wish. From then on the WebSocket protocol is spoken inside the upgraded HTTP connection. This means ...


1

I believe your premise is flawed. Alice doesn't log on to bob.com via normal HTTPS means, because Alice sees the invalid certificate error and smartly decides not to enter in her credentials. If Alice chooses to ignore the warning and proceed anyway, then now she has the same problem that she would have on any financial or high security site too. Her ...


1

See this for an introduction on password hashing. That your method ("sha1(password + md5(login))") may be guessed by the attacker is not a problem. Well, it is an indirect problem. Ideally, a "secret algorithm" would protect you even if the said secret algorithm was abysmally weak, because the attacker would still do not know the ends or tails of what you ...


1

You're generating 16 bytes which is 128 bits. Modern block and stream ciphers (i.e. AES) have a security margin of 128 bits, so it's reasonable to say that 16 bytes is sufficient. What I can't say for certain is whether or not openssl_random_pseudo_bytes() is sane enough to rely on.


1

I'm not sure if there is an easy way to do that, but if you output the nmap results to a text file, and you use the nmap -v parameter for more verbose output, you could search the output text file for the information you need. Fore example, the first time the phrase "Scanning x hosts" appears, refers to the total number of hosts you are trying to scan. The ...


1

If security updates are being applied, it's perfectly fine, even normal, to run an older version of PHP. On a desktop computer, people often approach updates with the mindset of always wanting to get the latest and greatest versions, which is fine (and good) for end-user machines. But for servers, the focus is on stability - people usually don't want to ...


1

If you are restricted to the current statement, the exploitation is also limited to the capabilities of the current statement type. In general, a SELECT statement allows: reading data from accessible tables and databases reading files using the LOAD_FILE function writing files using the INTO … syntax executing stored procedures Of course, the way the ...


1

At the very least you can generate a random 4 digit code (1000-9999) and store it in a database, then use SMS-to-email gateways to send sms to mobile phone for free. Most carriers support this, however you will have to ask your end user what carrier they have, and you will need to maintain a database of all carriers gateway domains. For example, you can ...



Only top voted, non community-wiki answers of a minimum length are eligible