Reputation
4,859
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
16 39
Newest
 Nice Answer
Impact
~75k people reached

Feb
3
answered How can using multiple laptops improve security?
Feb
3
answered Any vulnerabilities in user input to web Server running Apache and PHP?
Feb
1
comment Making a Blacklist of filetypes to protect PHP application
@aroth well, like I showed, a PHP mimetype check can be bypassed, but executing PHP files with an image extension is quite difficult and requires unsecure code. So if you have a PHP application like the OP, and want to protect the server from code execution, a file extension check would be more reliable (given no other security issues), while a mimetype check would be easily bypassed. Of course, additionally, you should secure the location of the upload (eg no execute right, outside webroot, etc), like I mentioned.
Jan
31
comment Making a Blacklist of filetypes to protect PHP application
@NeilSmithline sure, and I did mention that a whitelist should be used (although without special configuration, an attacker should not be able to gain anything by uploading asp or cgi files in the OPs case). I don't think it really matters though, as PHP files can easily bypass a mimetype check, so it's not the correct approach anyways, and should only be done in addition to an extension check (and then a whitelist should be used).
Jan
31
answered Making a Blacklist of filetypes to protect PHP application
Jan
29
reviewed Leave Open Spear Phishing attempt, how to respond?
Jan
29
reviewed Leave Open Securing online SQL database and server
Jan
28
awarded  Nice Answer
Jan
27
comment Is it a security issue to allow nearly identical email addresses when registering?
You can't really reject all invalid email addresses upon registration, as email validation is quite complex, making perfect validation impractical. And instead of rejecting valid addresses, it is better to let through invalid ones. At most, you could send out confirmation codes to check if the address actually exists. But at that point, the user is already registered and their data stored in the db.
Jan
27
revised Is it a security issue to allow nearly identical email addresses when registering?
added 252 characters in body
Jan
27
comment Is it a security issue to allow nearly identical email addresses when registering?
@ParthianShot but that's not really a problem with nearly identical email addresses. Ideally, something like that should be caught when registering, but it's more of a vulnerability of the used mail function/library, which should make it explicit in its interface if there is one recipient, or if there are multiple recipients, and deny invalid input.
Jan
27
answered Is it a security issue to allow nearly identical email addresses when registering?
Jan
27
revised Exploiting a PHP server with a .jpg file upload
added 933 characters in body
Jan
27
answered Exploiting a PHP server with a .jpg file upload
Jan
26
reviewed Leave Open How to brute force HTTP Basic Authentication requested with XHR?
Jan
26
comment How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?
not a direct duplicate, but answers will be pretty much the same as here: Is PHP unserialize() exploitable without any 'interesting' methods? (the big difference to this question is __construct vs __wakeup, but both are about exploiting user-based class creation without considering custom classes)
Jan
26
answered How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?
Jan
25
awarded  Enlightened
Jan
24
comment How can I prevent data scraping on my website?
@MarkBuffalo well, like I said, scraping can't be prevented. But the cost can be increased for a scraper, and if the cost is increased enough, it may not be worth it anymore (this obviously doesn't work for people who write scrapers for fun, as it just makes it more interesting :) ). Some of the ideas (such as the first one) are very easily implemented, so I would say they are worth it. Others may not be, depending on the concrete situation.
Jan
24
reviewed Approve How can I prevent data scraping on my website?