New answers tagged

2

Being able to use arrays in $_GET in this way is in itself not a security vulnerability. The DoS vector seems negligible to me, although this may indeed be amplified by the code using it. However, the examples you provided missed the most important part of this feature (from an attackers point of view): it is not only possible to pass regular arrays in GET ...


0

The same "vulnerability" is in C, Java, Perl, Ruby, Lisp, Fortran, BASIC, PASCAL, ALGOL....programming languages almost universally provide a construct for reading files. Some files on a Unix system are world readable. I do not have control on developers about what code they are uploading... Then by all means try to mitigate silly mistakes, but don't ...


0

You can restrict which directories PHP scripts may access using the open_basedir configuration. e.g. putting open_basedir = /var/www/ in your php.ini file should restrict PHP to /var/www/


0

One way to stop Apache from reading system files (and, in general, any file outside the web root directory) is with SELinux. Its whole purpose is to prevent inappropriate access to system resources (not restricted to constraining Apache, but that sort of protection is one of its great benefits). You would need to use an operating system that supported it, ...


1

If you use 4 or 8 bytes of integers to store your passwords, you are making the brute-forcers' jobs a lot easier. Because, if i understand your situation correctly, an attacker would just need to come up with an string so that its converted value(converted to check with the values in DB) matchs the stored password value. Considering the computing power in ...


3

This is security through obscurity, and in violation of kerchoffs's principle. if they don't know the algorithm they wouldn't be able to crack it? Maybe. And maybe analyzing the entries leads to the revelation of the algorithm. And once an attacker does get the algorithm - via analysis, by getting access to your server, because you posted it here - ...


3

This is not a vulnerability in Apache. It is a vulnerability in your PHP code. The function include(x) includes the file x. If you let the user pick any x, they will be able to include any file. If you don't want them to be able to do that, then don't write PHP code that lets them. I suggest you only pass constants or values from a whitelist as parameters ...


6

No, injection with just hexadecimal characters is not possible. Another (better?) way to prevent SQL injection is to use prepared statements: $stmt = $mysqli->prepare("SELECT * FROM User WHERE Password=?"); $stmt->bind_param("s", $password); $stmt->execute(); Because you leave it to the database engine to correctly put your data in the SQL query,...


1

Firstly, I would recommend to use below function, that would be more efficient and stricter in my opinion. <?php function IsHexadecimal($pass) { return preg_match('/^[0-9a-f]{64}$/i', $pass); } // or as @martinstoeckli suggested function IsHexadecimal($pass) { return (ctype_xdigit($pass) && strlen($pass) ==...


1

This doesn't sound like a natural influx of customer. Something fishy is probably going on. I would guess that this is a bot. So why would a bot sign up for your newsletter? It is probably looking for bulletin boards or comment fields or anything where it can post spam. Since bots can be quite dumb, it doesn't understand that it is just a newsletter it is ...


4

I think the term HTTP parameter pollution would be the best fit. This type of pollution usually submits the same parameter multiple times with different values in the same request. This results in the parameter being treated as an array of values with the parameter name as the array name as described in this article. The way the web server and programming ...


3

In fact I'm trying to understand what's the standard way for doing that. On a properly configured web server, the web server will log all received requests in a log file (the exact content of this log file is usually more or less configurable, depending on the server software used). There are also standard means to centralize the logs if you want to like ...


0

I managed to trace the files without rebuilding the whole server which are sending spam emails. This is probably happening because of any PHP script that is running on your server. Usually hackers are deploying these scripts that are using eval() methods to execute the php mail code randomly. I found Files with name such as db.php functions90.php ...


12

Strictly speaking? No, by itself it isn't a vulnerability. But it does suggest there's potentially a problem that needs further investigation. This is one of the inherent problems with pen testing. You find something ambiguous like this, and don't know if it's exploitable. To even start to find out if this is a vulnerability, you need to understand what ...


24

Why does this happen? It's because PHP has loose typing. Take a look at this example: $x = "1e6"; echo strlen($x); // 3 echo $x * 1; // 1 000 000 On the second line, $x is assumed to be a string, and as such is obviously three characters long. On the third line, $x is interpreted as an integer, or 1 000 000 in this case. Is it a problem? This can ...


3

This sounds very much like your server was compromised, and someone is using it to spread malware with the help of drive by downloads. Consider taking your site offline, as it might be infecting your visitors with malware. To make sure that this is actually the case, I would recommend the following: Ask the person responsible for the site if she knows ...


4

Parsing BBCode in a safe way that does not open the doors to XSS hell is a tricky task, and there have been many failed attempts. As you yourself note, the way you currently do it is vulnerable to XSS - all you need to do is post [script src="evil.js"]. Just using htmlentities() will not solve this for you, it is much more complex. This blog illustrates the ...


1

I think that you should do two kind of security measures to prevent injection. 1.Firstly, validate the input data, you should use a white list or black list, think in what is the best way to control your input data, the white list is usually used to validate input data, because it's easier to determine what is the correct format for input data. I recommend ...


1

Assuming you can modify the ./ascii.txt, I would put this text inside: <?php override_function('md5', '$a', 'return "castle";'); And that should work.


1

Php has some escape functions for using user supplied data in commands, escapeshellcmd1 and escapeshellarg2. There are however some limitations when using these functions. If used with a command that has unsafe command line switches. I wrote a detailed blog post about it 3. You should also ensure your imagemagick installation is up to date and configured ...


4

I see that you accepted gabedwrds solution (which is excellent, by the way), but I wanted to post one potential solution that I have used in the past when doing some interesting pentesting practice. (I am by no means an expert in that field, but I am sometimes a hobbiest.) If you will notice, the script never sets any policy for handling a user abort. By ...


2

Similar to what others have said, PHP has a max memory size. If you put in POST data that was JUST big enough to use ALMOST all of PHP's memory up, then it could conceivably crash when it gets exactly to this line if it ran out of memory: echo 'Wrong or empty password.' This is built on three principles: 1) When sessions are enabled, PHP doesn't flush ...


2

From source code we can see that sqlinjection1 has four known columns username,password,welcomemessage,id. As people pointed in commnets,We can use error based Sql injection to get the usernames,passwords,welcomemessage,id etc. Post below parameters in sqli $user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from ...


0

Yes you can nullify the vote. The solution is as follows. The Mysql Database table for voting is instantiated as below. mysql> use test; Database changed mysql> create table sqlinjection2 (ALICE int,BOB int); Query OK, 0 rows affected (0.03 sec) mysql> INSERT INTO sqlinjection2 values (0,0); Query OK, 1 row affected (0.01 sec) mysql> select * ...


4

Removing comments helps against some injections, but by all means not all. In this case you can still zero any field by setting $vote to construct a logical sequence out of what was an assignment: variable : vote`=1 + `vote query : ... SET `vote`=1 + `vote`=`vote`=1 + `vote`+1; This will alternate vote between 0, if it is nonzero, and 1,...


3

Since the script does not check that the user exists using some non-existing username with an empty password succeeds in my test: echo challenge('Foobar','') ? "MATCH\n":"nomatch\n"; PHP Notice: Undefined index: Foobar in ... MATCH


56

Try sending a HEAD request. I'm assuming that with ascii.txt included, the output of the script is just over a nice number like 4096 bytes, a common output_buffering value. Once the script has written output_buffering bytes, it needs to flush the output buffer before continuing. Normally this works fine and the script continues, but if the request type is ...


0

For default/base installs of Wordpress (with the exception of third party plugins) attacking through this vector will be a wasted effort. The image manager is locked down pretty good at this point from non-authorized users. If the account is comprised or the upload manager is exposed publically it will still be hard to exploit it. As you can see from the ...


26

The security flaw isn't in MD5 in this case. And the idea isn't to get if (!isset($_POST['pass']) || md5($_POST['pass'])!='castle') to evaluate in favor of the hacker. The vulnerability appears when you crash the script. The admin privileges are not conditional. No matter what the user gets their permission elevated by setting 1 to $_SESSION['admin_level']. ...


17

I've seen a similar challenge somewhere. Try to send something like 'QNKCDZO' as input. md5('QNKCDZO') is '0e830400451993494058024219903391' (note the 0e prefix in the hash indicating scientific notation of a number) and since the code uses the != operator (instead of the type sensitive !==) PHP (older versions only?) will actually cast it to a number before ...


9

I haven't been able to test in PHP 5.5.9, and what I'm going to propose doesn't work on my PHP 5.6.22 (but I might have made some silly mistake). The only workaround I can fathom is if MD5 returns something that is treated as a number. I've Googled and found something which seems germane.


0

Although Fluffy and Matthew both suggest that the reason for the policy is to prevent abuse of SourceForge's services, implying that someone with legitimate access to the content would abuse that privilege, it's also worth noting that it also provides protection for your content / site. If your site has an file injection/inclusion vulnerability, such as... ...


1

Why SourceForge's administrators block my web by a firewall? The answer on StackOverflow explains it all really. Previously, SourceForge allowed outgoing requests and this was abused, so they no longer allow it. Why Google can get some data from my website, as HTML page, easily? Because Google is not behind SourceForge's firewall (obviously) and ...


4

Google is an external service, connecting into your server. A web server's firewall will normally be configured to allow this. You are trying to connect out from your server, which may well be blocked, since most web servers don't need that ability. You don't need it, for example, to include a Twitter feed (that's client side loaded), to upload files to your ...


4

You are making the assumption that an attacker would only break the protection methods in an application for financial reasons. This isn't accurate - for a very long time, software cracking of this kind has been done for kudos, to show skills, or just for fun. Adding more layers of protection can even entice more people to try, since there is additional ...


2

In response to your second question is there any chance to build it to be so hard to null that the job for the attacker doesn't payoff? I assume by "getting nulled" you mean cracked or altered in some way that lets them use it freely. The only really effective way is to not give all of the code/binaries. Rework your application to be client-server ...


5

Upgrading to the latest supported stable PHP branch is the recommended route plain and simple. That being said, you've noted that you're with GoDaddy. Which of their services are you using for the project? If it's their shared hosting line, or any line that offers cPanel, upgrading PHP versions shouldn't add anything to current costs. Any web hosting ...


2

Search for uploadify on https://www.exploit-db.com and you will notice that the JS-Script is part of your theme and vulnerable to Arbitrary File Upload Vulnerability. You could delete that Script and your theme might still work or better yet use another more secure theme.


5

There are a lot of ways. Judging by the main features of your website, an attacker could have used: SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection; credential theft: the attacker could have stolen or ...


1

Is it still possible ,with some trick perhaps to ignore docs, to perform a path traversal attack ? Yes, it's pretty simple, just use ../ and it will be normalized before the file is opened (on *nix systems anyway, I don't know for sure on Windows). Something like this would work. $path = '../test.txt'; $full_path = "./valid_dir/docs/" . trim($path); ...


0

The correct answer is; it really depends on your codebase. This would enable all manner of logic flaws. While I hope you're not writing banking applications in php imagine if you did and an attacker could repeatedly call approveLoan() or a similar function. What would happen if the attacker could call validateAdmin() to set an admin flag in the session. ...



Top 50 recent answers are included