Tag Info

New answers tagged

0

Yes but don't forget to use a fallback function like that: <?php /** * Generate a random key using openssl * fallback to mcrypt_create_iv. * * @access private * @param int * @return string */ private static function _get_random_key($_length = 32) { if ...


1

I read Insufficient Entropy For Random Values and now I think non of the given examples provide enough entropy. gethostname() is not secret and uniqid() and even mt_rand() is a Pseudo-Random Number Generator. I will use $nonce = base64_encode(bin2hex(openssl_random_pseudo_bytes(16)));


0

The third line could be a good choice but you must add a substr() to the hash_hmac() return value considering that the nonce value is 16 byte long. php -r "echo base64_encode(substr(hash_hmac('sha512', uniqid(null, true), uniqid(), true), 0, 16));"


4

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all? Ajax is not a special thing regarding the transport of the login data, because it is a HTTP request done in the background instead of the foreground. Thus if done ...


1

The traditional way to avoid the user having to type in a user name is to include "remember me" functionality where the user name is persisted in a manner that is associated with the browser, e.g. an encrypted cookie or a cookie containing a durable token (say, 30 days) that the server can use to infer the user name. Some of the replies here are going to ...


1

Generally if you find an SQLi you don't need to map the whole database to prove the vulnerability, actually very little information is needed as proof. SQLmap is a great tool for what it's meant for, mapping databases, but it does have some limitations in usability. Generally I'd advice to use a web application scanner to look for SQLi vectors, for example ...


0

In what scenarios would bin2hex be vulnerable to a timing attack? The timing attack discussed in the mailing list and blog post is a cache-timing attack, which was famously demonstrated by Daniel J. Bernstein against OpenSSL's implementation of AES here (PDF). In order for bin2hex() to be vulnerable to a timing attack, the following conditions must be met: ...


1

The payload is encrypted using a simple autokey cipher, using md5($_f__f).substr(md5(strrev($_f__f)),0,strlen($_f__f)) as the password. You could try the usual techniques for attacking autokey ciphers, but the length of the password (at least 32 characters) and the fact that the plaintext is gzip-compressed make it impractical.


0

This function calculates the MD5 hash from the POST value "_f__f". It is impossible to get the original value from a MD5 hash because it's a hash and not an encryption.


1

This behavior is not directly linked to this exploit, but by a weak web server configuration. For instance: Apache offers through mod_mime the possibility to serve files with multiple extension. This extension is designed to serve the same way files such as welcome.html.fr or welcome.fr.html (ie. french version of the welcome.html file). However it can be ...


1

ECB doesn't even make sense in the context of RSA. It's a mode of operation for symmetric ciphers like AES. More info: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#ECB PKCS1Padding, however, does apply to RSA. And you're right - that likely means RSAES-PKCS1-V1_5. For the PHP side you can use phpseclib. eg. <?php ...


1

If you encounter a local file inclusion (LFI) vulnerability there is a special technique that enables you to read files from the target system by making use of a PHP wrapper. This will not work in every case but you might want to give it a try. You can read more about the PHP wrapper on the official php.net site: http://php.net/manual/en/wrappers.php.php ...


0

I am not an expert but I do use "The Whitelist Approach", I learned the process is called so afterwards. The simple function which I do use heavily is preg_replace() Example for numerics: $_filtered = preg_replace('/[^0-9]/', '', $_foo) and then $dbh->prepare($_query) PDO Prepared Statements For Later SQL Part.



Top 50 recent answers are included