Tag Info

New answers tagged

3

When talking about SQL injection, regardless of language, you should use parametrized queries. These construct a query plan ahead of time, rather than when the user provides input, so an attacker cannot easily modify how the query works. PHP supports this, but you need to use the PDO library rather than the mysqli functions. http://php.net/pdo for more ...


0

I think the most important of this question is breaking the paradigm: "Images are innocents". Image are not innocents, and are very dangerous, take a look on this article: "Stegosploit hides malicious code in images, this is the future of online attacks". The short answer is: Create a new image file and storing it in a static environment, without execution ...


1

You're generating 16 bytes which is 128 bits. Modern block and stream ciphers (i.e. AES) have a security margin of 128 bits, so it's reasonable to say that 16 bytes is sufficient. What I can't say for certain is whether or not openssl_random_pseudo_bytes() is sane enough to rely on.


0

Cron daemon only sends email, if executed process outputs something on console - and only after the job finish. So basically you can't get such information, when nmap is still running, unless you implement it yourself, eg. by generating log file from nmap and analyzing it from another cron job each minute. I've seen some cron web wrappers, and at least one ...


1

I'm not sure if there is an easy way to do that, but if you output the nmap results to a text file, and you use the nmap -v parameter for more verbose output, you could search the output text file for the information you need. Fore example, the first time the phrase "Scanning x hosts" appears, refers to the total number of hosts you are trying to scan. The ...


0

Use type casting to sanitize numeric parameters and whitelisting to sanitize identifiers in addition to mysql_real_escape_string(). In the referenced PHP page, there is an example of a sql injection in a login form. A better solution would be to use prepared statements, you can do this by using PDO or mysqli. A code example is given here. Note that ...


2

There are several improvements that can be made to the functions you've given, based on my knowledge. Obvious threats First, and most important, keep your private key secure, and make it external to the function definition (e.g., a second argument). I would recommend spending significant effort solving this problem. Is this per-user encryption, or ...


1

If security updates are being applied, it's perfectly fine, even normal, to run an older version of PHP. On a desktop computer, people often approach updates with the mindset of always wanting to get the latest and greatest versions, which is fine (and good) for end-user machines. But for servers, the focus is on stability - people usually don't want to ...


0

Is running those old versions pure madness or is it just a minor risk for our customers? No, not at all: it is neither a pure madness nor a minor risk. You must absolutely find a way to convince (in the case you can not do it by yourself) your clients to upgrade their PHP versions to the newest one IF it is possible OTHERWISE update the security ...


2

Most new versions come with security improvements, so the older a version is the more time an attacker has to take advantage of it. You can browse through a vulnerabilities library, for example here is one for php 5.4. You can check yourself how many vulnerabilities have been disclosed and how severe they are. For the most part I think its a matter of which ...


0

It's correct that proc_open can be dangerous, if and only if there is user input going through it. For affecting other users/websites on the server, it's a low risk nowadays since cagefs is being used, and the kernel's security is updated on the servers. So don't worry about other users: it's the hosting company's job.


1

If you are restricted to the current statement, the exploitation is also limited to the capabilities of the current statement type. In general, a SELECT statement allows: reading data from accessible tables and databases reading files using the LOAD_FILE function writing files using the INTO … syntax executing stored procedures Of course, the way the ...


4

Let's remove PHP entirely from the equation for a moment. SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution. The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, ...


0

Sort of. You can create a landing page that lists all client IP addresses using WebRTC and load another address. You can use gethostbyaddr() on every IP returned, and you will get some user198.domain-a.company.xxx. Just set a session variable, and you are set.


0

Not really. You can directly retrieve some agent information and the local IP/hostname but not their workgroup/domain status. That being said - you could get the hostname and query Active Directory via WMI to see if it is a domain computer, but you can never prove the validity of the hostname. Another option is that you can authenticate a user against ...


-1

It's possible to get corresponding to a given IP address using gethostbyaddr function http://php.net/manual/en/function.gethostbyaddr.php: $proxy = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : false; if(!!$proxy){ $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR']; echo "Warning: Your cliend is using proxy, may could ...


0

There are already a number of standard solutions for this type of problem, such as Javascript Web Tokens. The architecture for most of these solutions is fairly straight forward - you have an authentication service which authenticates the user and returns a unique token which is encrypted and contains information your service requires. The server owns the ...


2

It is clearly a spamming component. There's lots of mail sending functions around the code: private function mailPassthru($to, $subject, $body, $header, $params) { public function isSMTP() public function isMail() public function isSendmail() public function isQmail() This generally occurs when you have an outdated Wordpress installation laying ...


0

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013, remove and install a fresh version of OpenX.


0

There are several businesses that provide SMS as a service, and they (usually) have pretty decent API documentation and libraries for all popular programming languages (which PHP is). These sites are not free, and they charge a small amount for each text sent. They do have the ability to turn on "test-mode", so that you can develop your site without fearing ...


1

At the very least you can generate a random 4 digit code (1000-9999) and store it in a database, then use SMS-to-email gateways to send sms to mobile phone for free. Most carriers support this, however you will have to ask your end user what carrier they have, and you will need to maintain a database of all carriers gateway domains. For example, you can ...


4

You have at least 3 ways to achieve that: In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime: ini_set("session.cookie_httponly", 1); If it doesn't work, you have to manually overwrite that cookie: ...


0

Given that the page is before login and is low risk I have taken the advice of @sliverlighFox and removed the CSRF from the form which resolves the issue.


1

Yes but don't forget to use a fallback function like that: <?php /** * Generate a random key using openssl * fallback to mcrypt_create_iv. * * @access private * @param int * @return string */ private static function _get_random_key($_length = 32) { if ...


1

I read Insufficient Entropy For Random Values and now I think non of the given examples provide enough entropy. gethostname() is not secret and uniqid() and even mt_rand() is a Pseudo-Random Number Generator. I will use $nonce = base64_encode(bin2hex(openssl_random_pseudo_bytes(16)));


0

The third line could be a good choice but you must add a substr() to the hash_hmac() return value considering that the nonce value is 16 byte long. php -r "echo base64_encode(substr(hash_hmac('sha512', uniqid(null, true), uniqid(), true), 0, 16));"


4

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all? Ajax is not a special thing regarding the transport of the login data, because it is a HTTP request done in the background instead of the foreground. Thus if done ...



Top 50 recent answers are included