Skip to main content

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
2 votes
1 answer
111 views

Is it secure to save a salt in session variables

I know a salt isn't secure data that needs to be encrypted in the dB, but as its access should be controlled, is it considered safe to save it as a session variable at login for use later on different ...
Èl Sea's user avatar
  • 57
2 votes
2 answers
139 views

Securely store password for API sessions

Scenario: I have a PHP web application that needs to make an API call using a password provided by the user. I want to temporarily store this password so I can use it across multiple requests without ...
Techlands's user avatar
1 vote
2 answers
96 views

Backdoor:PHP/Webshell.O virus detected in an uploaded image file. Should I be worried? How can I prevent it?

I have a site which allows users to upload images. One uploaded file was recently detected by antivirus software (uploads aren't scanned, this was a system wide scan after) Upon upload, I check the ...
cantsay's user avatar
  • 111
0 votes
0 answers
81 views

Problem bypassing a PHP WAF for SQLi

I am working to bypass this WAF, but I have some problems. $args_arr=array( 'sql'=>"[^\\{\\s]{1}(\\s|\\b)+(?:select\\b|update\\b|insert(?:(\\/\\*.*?\\*\\/)|(\\s)|(\\+))+into\\b).+?...
Dinnerboard's user avatar
-1 votes
1 answer
142 views

How to sanitize $_SERVER url variables?

An attacker used the HTTP_REFERER variable to inject Javascript by sending the following in the Header: Referer: javascri&#...
rami300's user avatar
  • 160
0 votes
1 answer
81 views

Phar file deserialization in PHP < 8.0

TLDR: I want to reproduce the RCE from phar file deserialization described in GitHub/advisory/97m3. I fabricate an html file that includes a malicious svg file in its <img> tag. Adding debug ...
OrenIshShalom's user avatar
0 votes
1 answer
86 views

How dangerous is this suspicious PHP code? [closed]

I found this code on my web server in /wp-content/uploads/2023/index.php: $hello_dolly[]='b8f878fc41d0fd3c'; $hello_dolly[]=$_POST; $hello_dolly[]='color'; if (isset($hello_dolly[1][$hello_dolly[0]])) ...
mwfearnley's user avatar
0 votes
1 answer
79 views

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover. Thus I can increase the impact and get more bounty then what they ...
oo7hacker's user avatar
0 votes
0 answers
23 views

Where does elp.php come from? [duplicate]

From yesterday on, all my sites (one and same hosting) has an elp.php-file in the root-folder of every domain. This file is publicly open and does show a list of all files, with possibility to edit ...
Eddy Erkelens's user avatar
1 vote
2 answers
116 views

Can I set session time to 10 days without risking security issues?

We have a WordPress form that collects data on what marketing source (UTM) the user came from and upon submission, sends that UTM data to a 3rd party. Recently, a client asked me to have a web session ...
hyemark's user avatar
  • 11
0 votes
0 answers
273 views

Lax SameSite and POST (2 minute)

I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
Johnny's user avatar
  • 183
3 votes
1 answer
408 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
James Nugent's user avatar
1 vote
1 answer
74 views

How to encapsulate PHP subdirectories in Apache?

We have separate WordPress installation directories in one webspace on the same User. (Wordpress_01, Wordpress_02...) It is possible to block PHP script Actions between the directories? (is the best ...
user2534903's user avatar
0 votes
1 answer
183 views

Server Side Request Forgery Vulnerability Question

I am working on a CTF called Internal. I know there are walkthroughs available but I am trying not to look at them for the time being and try and work through things myself. The admin page that is the ...
user2334659's user avatar
1 vote
1 answer
443 views

SQL Lite Injection via CSS URL

We had a "pentest" done on our website - and received the following alert (xyz.com is a placeholder for the real name. I queried this with the testers, and they say their automated tools ...
Stephen Knott's user avatar
0 votes
0 answers
180 views

How to tunnel intranet web site with php file?

I have this configuration: ________ | | Internet -----> | Server | ----> All intranet server port(443) | | port(80) ------...
psico_disk's user avatar
0 votes
1 answer
243 views

Secure Serving of File Uploads on PHP Server without Root Config Possibilities? (Apache)

To secure the file uploads to a PHP/Apache server, I have already implemented the following steps: Solid upload validation from PHP Framework Used own names for uploaded files Place uploaded files in ...
DevelJoe's user avatar
  • 141
0 votes
0 answers
89 views

What are password encryption schemes that result in variable length common in MySQL and PHP?

I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples. 753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 ...
knods's user avatar
  • 1
3 votes
0 answers
291 views

PHP CTF: Vulnerabilities in PHP before 2007?

I came across a CTF that i'm trying to solve, the goal is fairly simple: Bypass the authentication form and access the admin-restricted area. You can find the code snippet below. Things to consider: ...
user avatar
0 votes
1 answer
230 views

This is supposed to be vulnerable to SQL injection but I can't really see how. Is it really that bad?

See bellow php code that takes a url param, queries a db and then returns a string: $inpt = ereg_replace("[^A-Za-z0-9" . '' . "]", "", $_GET['param']); $rtrn = $...
None's user avatar
  • 539
4 votes
1 answer
279 views

User isolation in LAMP

As I understand, in a typical LAMP (or be it LEPP) setup, all PHP code is executed using the same user and group ("www" or similar). In a multi-user scenario (e.g. some variant of allowing ...
Gamification's user avatar
-2 votes
2 answers
176 views

PHP 7+ custom salt hashing algorithm [closed]

I'd like to hash email addresses with the same salt to make the hash searchable\indexable and make it hard to figure out the actual data. I wanted to use bcrypt, but I found that from PHP 7 custom ...
inf3rno's user avatar
  • 489
0 votes
1 answer
783 views

Implementing secure two factor authentication with Google Authenticator?

I would like to add two factor authentication to a login screen. My understanding of the process is the following: Generate a QR Code Scan this Code with Google Authenticator app Use a library to ...
JavaForAndroid's user avatar
0 votes
1 answer
309 views

Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]

I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
Manuel's user avatar
  • 9
33 votes
1 answer
5k views

Crashing the sha1() function in PHP?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Here is my methodology: Reset the ...
user5623335's user avatar
0 votes
1 answer
97 views

Post-EOL security patches for PHP7

Imagine the following situation: you have a third party software which still uses PHP7 despite of the EOL. The risk there will be further post-EOL vulnerabilities is as I estimated considerably higher ...
J. Doe's user avatar
  • 137
0 votes
1 answer
414 views

JWT secret part from php password_hash() (128bit random salt and password hashed together)?

We are using JWT (Json Web Token), with HS256 algorithm. Is it ok to use PHP's password_hash() functions output for the secret part? It's output is a 128 bit random salt with the user's password ...
user288117's user avatar
1 vote
1 answer
402 views

Is running PHP file_get_contents on random user-generated links safe?

In one of my PHP apps, I have a part where it scrapes the content of random links on the internet using file_get_contents, and then it runs a regex on this content to find all the email addresses in ...
Syed M. Sannan's user avatar
0 votes
0 answers
24 views

Found several potentially malicious PHP files but not sure what they are doing? [duplicate]

A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
John T's user avatar
  • 101
0 votes
0 answers
49 views

Are these cPanel processes malicious? [duplicate]

I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it. After investigating ...
Syed M. Sannan's user avatar
18 votes
2 answers
3k views

Is this expect.php file (in all the git repositories of my web server) malicious? [closed]

Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it: <?php function visit_cookie() { $h = $_COOKIE; ...
Syed M. Sannan's user avatar
0 votes
1 answer
137 views

Why can I not sql inject this piece of code? [duplicate]

This is the code: $stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?"); $stmt->bind_param("is", $kurssi, $avain); // prepare and bind $...
user285206's user avatar
1 vote
2 answers
127 views

Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?

This is actually a general question about template engines. If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
Drew's user avatar
  • 135
1 vote
1 answer
166 views

Why would you use the command `test` in a php shell injection?

I saw someone doing this in a php shell injection: test | cat /var/backup/secret.txt Why are they using test |? How is that not useless here?
idontknowwhatgg's user avatar
0 votes
1 answer
102 views

How exactly do security fixes get to the users in PHP?

I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the ...
zomega's user avatar
  • 145
0 votes
0 answers
276 views

Path Traversal with rawurldecode and dots validation

I'm trying to check if it's possible to bypass a two dots verification to perform a Path Traversal, downloading files out of the allowed folder. The problem is that it uses rawurldecode when ...
Lucius's user avatar
  • 121
0 votes
1 answer
792 views

PHP - How to block files access in specific directory from the external

I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
ducarpit's user avatar
0 votes
2 answers
290 views

What's so bad about including "backdoors" to a Website?

I have a fundamental question about the harm of leaving a backdoor in one of my public websites / plattforms. I do not want to discuss the details why I wanted to do that, I just want to understand ...
tim's user avatar
  • 851
0 votes
2 answers
499 views

Running PHP commands on my website from a form input

I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like : mkdir('Folder'); file_put_contents();scandir()...
Kashyap Sharma's user avatar
0 votes
0 answers
71 views

SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?

I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
Ben Holness's user avatar
1 vote
1 answer
2k views

PHP, is addslashes() in eval() really that unsafe?

A friend challenged me in a programming question: You have a list of paths, make the paths a multidimensional associative array of paths. Sample input: $paths = [ "a/a/a", "a/a/...
ShiSHcat's user avatar
0 votes
0 answers
2k views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
huyang888's user avatar
0 votes
1 answer
626 views

How do I prevent this PHP/Apache exploit?

I'm running: Ubuntu 20.02 Apache/2.4.41 PHP 7.4.3 I am running a simple web server that will accept file uploads, store them and catalog them in a database. When I check /var/log/apache2/error.log, ...
Frank Zyna's user avatar
0 votes
2 answers
996 views

nonce generation based on php session id

On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to 'self' would ...
theking2's user avatar
  • 146
0 votes
1 answer
2k views

What can I do with a Pdf upload vulnerability on a CTF server?

A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
Nnnnn's user avatar
  • 1
0 votes
1 answer
325 views

Is this really a way to filter LFI?

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd. Is it possible to bypass in_array function? <?php $...
Kiwi501987's user avatar
4 votes
0 answers
85 views

Best practice for storing security tokens in source code [duplicate]

I have a PHP system and I need to store some tokens for operations like: Database username and password API token Keys for encryption It turns out that for a long time only I manage the source code, ...
Tom's user avatar
  • 174
0 votes
1 answer
3k views

PHP 7.4.3 preg_match bypass

I want to filter user input like this: $data = file_get_contents('php://input'); if ($data != null && $data !=='') { $parsedData = json_decode($data, true); } // find quickmodule name $...
The Modern Gamer's user avatar
1 vote
1 answer
2k views

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Since PHP has loose type comparison, we have: php -r 'var_dump("1234e03"=="1234000");' bool(true) And since MD5 hashs are often reprensented as hexa string like ...
Xenos's user avatar
  • 1,371
1 vote
0 answers
314 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
santosh baruah's user avatar

1
2 3 4 5
33