Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

0
votes
1answer
24 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
0
votes
0answers
26 views

Advanced SQL Injection Test [on hold]

As an assignment for my cybersecurity course, I've been tasked to execute a penetration test on a login form which is bound to be vulnerable to SQL Injection and if we can't penetrate it like that we ...
0
votes
1answer
29 views

Local File Inclusion [ Post-Exploitation ] Question

Hello I am just curious what kind sensitive files I can read on a windows server which is vulnerable to LFI compared to Linux? I mean the first file or common files which a pentester or a ...
0
votes
1answer
36 views

Does PHP unserialize work with an object inside a string

serialize($_POST); where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure? I coulnd't get ...
-1
votes
0answers
51 views

How to reverse this VB code [closed]

I have a vb or a c# file am confused what language
1
vote
0answers
31 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...
0
votes
2answers
69 views

Confidentiality and Authenticity of the Key in a Key-Value Store

What, if anything, can be used to provide confidentiality and authenticity guarantees for the storage keys used to store data in a key-value store? To be clear what I mean by the storage keys - I ...
-1
votes
1answer
82 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
71 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
80 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
48 views

Are public paths/folder structures mean security risks for a website?

I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. ...
0
votes
1answer
54 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...
0
votes
0answers
126 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
0
votes
0answers
41 views

How to ignore htmlentities() to steal cookies in php page

I have a messageboard running at http://10.8.0.240/a9q2/messageboard.php. I can use my 'student' login to login the messageboard and post messages which can be seen by the admin and other students. ...
1
vote
1answer
99 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
0
votes
1answer
50 views

Storing server-side secret key in environment variable - is a concern?

Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
0
votes
1answer
105 views

How do I escape webapp root directory in a php website?

This is part of a old CTF question which I've had trouble solving. I'm not sure what approach to take. I'm given a single site: http://user:token@host:port/public/index.php the flag is in /tmp/flag....
0
votes
0answers
9 views

How are the laws considering storing country details of visitors of my website? (calculated of their ip adresses) [migrated]

I wanted to add the country of the people who left a review on a website but I was wondering how this regards towards the laws about privacy. I have been doing quite some research into this topic but ...
2
votes
0answers
58 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
0
votes
1answer
53 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
0
votes
1answer
97 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
2
votes
1answer
281 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
81 views

Is my session schema vulnerable to session fixation?

I have a PHP application, where two session IDs are being used. I will use foo and bar as example for those session IDs. The foo session ID is being generated at the login page. The bar session ID ...
0
votes
0answers
52 views

Is php code with such features vulnerable to RCE?

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library. Here are the things I found I can make this library do for me: Include (include_once call) any ...
0
votes
1answer
175 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
2answers
67 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
0
votes
1answer
70 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
0
votes
1answer
49 views

PHP code execution attempts on an ASP website

I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
-4
votes
1answer
60 views

encrypting file and user have public key to decrypt in barcode [closed]

I want code very secure system and I need some answers and help. Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it. I've thinking of ...
-1
votes
1answer
126 views

Unknown code on my website comments [closed]

During the last few weeks, I often find on my website these "Comment": {"name":"BryantFlogy","email":"cgorillamail@gmail.com","message":"Hi, htmlkurss.xyz \r\n \r\nI&#39;ve been visiting your ...
0
votes
1answer
67 views

Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)

I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...
4
votes
1answer
57 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
0
votes
1answer
91 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
0
votes
1answer
76 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
0
votes
1answer
320 views

Bypassing password authentication in example PHP

I have pseudocode of the following script: $pass = '...'; $answer = '....' extract($_GET); if (($inp)) { if ($inp === get_contents($pass)) { return $answer } else { echo ...
1
vote
2answers
213 views

PHP password_hash (bcrypt) vs sha-3 [duplicate]

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The ...
3
votes
1answer
142 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
2
votes
0answers
157 views

Does CVE-2019-0211 affect Apache w/ php-fpm?

Intro From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading ...
2
votes
1answer
134 views

Found malware in my Wordpress, what is it and what it does? [closed]

Recently I found strange file inside Wordpress sources directory of a page I have written and I am maintaining. It was a luck case. I deploy my sources from git so when I typed git status on a server ...
1
vote
0answers
116 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
3answers
102 views

After running a string through mysqli_real_escape_string, is it safe to remove the backslash before echoing it into a page?

I'm using a rich text editor (Nicedit) with a cms project I'm making. In order to reduce the likelihood of SQL injections, I'm using the mysqli_real_escape_string function to escape the user input ...
0
votes
1answer
99 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
-1
votes
1answer
46 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
29 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
1answer
81 views

Is a “logged_in” session flag secure enough?

Is the code below enough to secure a login area? <?php if ($_SESSION['logged_in']) { // show content for logged-in users } Note: $_SESSION['logged_in'] is just a boolean value true after ...
0
votes
0answers
24 views

Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini

I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/ But I cannot use wp-cli if I do that. Any solution please?
0
votes
0answers
19 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
0
votes
1answer
32 views

`$_GET[1]`; payload why work in php short tag only? [closed]

when I try to use this payload: <?= `$_GET['1']`; ?> it works in php-short-tag but when I do this: <?php `$_GET['1']`; ?> it's not working, and give me blank page. Can anyone explain ...
7
votes
1answer
193 views

Can I inject a shell command here in PHP?

During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec() $arg = $_GET['arg']; // sanitization, I suppose... if(...
0
votes
1answer
51 views

Securimage php library for Captcha Code showing security issues in Arachni Scanner

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...