Tag Info

New answers tagged

1

The echo output with the \0 included is supposed to happen, nothing to worry. In order to understand the attack, you have to know how C and PHP store strings. C In C, a string is simply a a pointer to a memory address where the pointer points to the start of the string, and the \0 character indicates the end. No length is stored, all code that reads ...


1

SQL Injection does not require the use of union or select . SQL injection means that the query structure itself has been altered by user input. How about where $id is ' OR '1'='1? This will make your query become SELECT username,password FROM admin WHERE username='' OR '1'='1' ORDER BY 1 which means all records will be returned. The solution is to use ...


2

Theoretically,i think this can be bypassed using HPP (HTTP Parameter pollution) , for example ?id=union select&id=union select ... counter==2 will be bypassed this way. One other way i think could be using comments like un//ion+se//lect. One other thing to note that to bypass this, we can proof the counter false using legitimate union select like in ...


1

I think there are bigger issues at play, for one your logs seems to suggest there is an issue with your application caused by a file which can't be opened. The fact that there were dozens of logs all within the same second implies that this error is also occurring multiple times in the same request. This may or may not be contributing to your site being ...


4

You should ensure that your session token is random and at least 128 bits. Aside from that you just basically send a session token and a user id. To be fair, only your session token should be needed to identify a user since it is unique. Ensure also that you destroy the session token after the user logs out. Aside from that it seems similar to any other ...


9

It is a very obfuscated way of doing this: eval(getenv(HTTP_X_UP_DEVCAP_IMMED_ALERT)); This alone won't do anything until someone views the page with the HTTP_X_UP_DEVCAP_IMMED_ALERT header set, then the content of this header will be executed on your webpage. It looks like someone wants to execude code, perhaps for a botnet. If you are interested in ...


4

Malware analysis is fun! I have not done this with PHP before, but lets see what we can do. First, I want to format it correctly. I found an online tool called phpbeautifier.com which does this nicely. Output is now: <?php $nkIL3_ = 'Hn' & ~hTzup; $TTCpX = 'HEr@D@(DEi&' | 'HD"AN`(eT$I.'; $fGZGQD2 = l5fg . '{3Ht&d~' & '|,' . /*'. 'gri*/ ...


1

Quite simple :-) First of all I got some weird errors when I run your script: PHP Notice: Use of undefined constant curlopt_cainfo - assumed 'curlopt_cainfo' in ... PHP Warning: curl_setopt() expects parameter 2 to be long, string given in ... So I replaced with curlopt_cainfo with CURLOPT_CAINFO - that seems to get rid of them. I added the following ...


0

Sorry for posting this as an answer - I can't comment with my rep yet - just joined this part of stack exchange. Run the SQLMap with higher verbose level, like -v3 or -v6. -v3 will show the requests SQLMap makes and you should be able to determine (or update your question) with more specific info on what generates the HTTP 404 response. -v6 will ...


1

Please take below-mentioned as my personal opinion. I think is is less secure. But it depends on what you consider a security problem and what not. real life example my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x .. I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't ...


2

Please do NOT consider disable_functions a security feature. See my previous answer to a different question on stackoverflow - even PHP does not consider disable_functions and similar as a real security feature(s).


0

If you have all of the PHP code for the application you can set up a LAMP/WAMP VM and load it up on an IDE. You can run it and set your breakpoints as needed. Turn off the network card and install and run wireshark in the background. If you need to you can look into some DNS spoofing applications. If you're very concerned do all of this on dedicated ...


0

Are input fields that don’t have name="" sent via the browser Not by the standard HTML form submission process. However JavaScript on the client side can read the contents of the fields and send that data themselves. Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? Yes. All content on a ...


2

Yes. Any HTTP request that isn't protected by SSL/TLS/HTTPS is vulnerable to MitM attacks. Without the integrity that is provided by HTTPS, any component of the HTML served over HTTP is vulnerable to attack or modification by a man-in-the-middle. For instance, the form's action could be changed, so instead of the form being POSTed to your intended page, ...


2

There have been issues with filter_var when used with FILTER_VALIDATE_EMAIL in the past, however I cannot find any vulnerabilities with FILTER_VALIDATE_IP. Even though an IP address does not contain characters that have special meaning within HTML (e.g. <) or have characters that can break out of a database query (e.g. '), I would treat the value like ...


1

This sort of question has likely never been asked here before because it is more suitable for StackOverflow. There are easier and better ways to protect against SQL injection in Codeigniter - I strongly suggest you look at Query Binding (at the bottom of the linked page) or Active Records. Both of these will escape queries for you in a way that is much ...


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


1

The main concern I would have with your proposed method of generating card grid data is whether the resulting grid numbers are sufficiently random. Since you are running randomly generated data through a HMAC (which should be fine) but then also a "mathematical formula" it is possible that could bias the resulting numbers. If an attacker knows that certain ...


1

You seem to be engineering a lot of unnecessary complexity in...unless I've missed something. If you have 64 cells generate a 64 character sequence of crypto random digits and store it. Print your card from this. And check responses to challenges against it. It's really very similar to having a 64 character password and asking for a few characters from ...


0

You can do a self pen-testing by: Executing that php file in your case the arbitrary jpeg file in your browser and see if it displays or execute a simple Linux command say ls. Example: say the jpeg file is in your <path>/uploads/ you shoulbe be able to get a shell from your browser if you enter http://yourSite.com/uploads/shell.jpeg You can also ...


1

uniqid() does not create a cryptographically secure hash, and sending sensitive data over plaintext channels such as email or http means that anyone in between can read them. Is this a problem? No, not really (with the exception stated in the last paragraph). The information you send out consists of the user's email address and a confirmation key. This is ...


1

I hate those kind of problems. There are so many places something could have happened. I think I would just double check my config files - always a good idea to have a copy of valid config files. I use a GIT based tool to version all of mine. Then you can easily spot any unknown changes and back them out. Then I would add the domain to IPTABLES and block ...


2

While it may deter very amateur hackers, the concept of security by obscurity is very seldom effective at providing actual security. A far better approach would be to restrict the admin page to an IP (yours). Also, I assume you are using wordpress or some other content management system. My two best recommendations for improved security would be to keep ...


7

uniqid() should not be used for anything security related: This function does not create random nor unpredictable strings. This function must not be used for security purposes. Use a cryptographically secure random function/generator and cryptographically secure hash functions to create unpredictable secure IDs. Also, you should make your link a HTTPS ...


10

The only issue is that you're leaking information, in this case, the user's email address. Since it's plaintext in the querystring, it's going to be stored by any logging that's occurring anywhere between the client and your server, potentially in bookmarks if the user bookmarks that page, if the URL is copied and stored or sent to anyone, etc. I'll ...


1

The best solution would be to use a local PHP server on a computer without Internet if you want to be safe. Download PHP, put this text in a .php file, COMMENT OUT ALL THE PARTS YOU DON'T UNDERSTAND YET, and run 'php -S localhost:80' (or even better, take this version I cleaned a little) Then just add 'echo $variable' to see what's going on, and uncomment ...


0

There's two aspects to the question here: Is using the ID from the URL (GET) safe? Short answer, no. Like any other data it needs to be validated and filtered before use. This prevents issues like SQL injection from coming up and leaving the application vulnerable. Validate that it's an ID, validate that it's a valid ID and use prepared statements to ...



Top 50 recent answers are included