Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

0
votes
0answers
36 views

How Worpdress files can be modified by hack script? [duplicate]

I have 3 wordpress sites hosted on shared hosting. And I was hacked a few weeks ago. All files "index.php", "functions.php" have been corrupted. And the following script is added to the first line of ...
0
votes
0answers
52 views

Where should I look for 'Location' header malicious redirect? Linux, php

My site was hacked and now it responses with 'Location' header redirecting to the malicious site, but does this only for mobile clients. I wasn't able to find the malicious code yet and I'd like you ...
2
votes
1answer
92 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
-2
votes
0answers
76 views

What does this PHP malware do? [duplicate]

Somebody hacked my site and uploaded this script (rootfunctions.php) to my webroot and its content is: PHP Code: https://pastebin.com/raw/a889iG0V Hopefully, I have removed this malware from my ...
0
votes
0answers
24 views

Security implication of disclosing composer.lock?

What are the security implications in disclosing the composer.lock file for a remote, public known, web application?
-2
votes
0answers
14 views

Is it possible to bypass or exploit with truncate, local file inclusion, path traversal attack or with any other possible attacks?

Is this code safe to execute, or how intruder can truncate the .php extension or make any other attacks? <?php $var = (string)@$_GET['var']; $var .= '.php'; if (file_exists($var)) { echo ...
0
votes
0answers
23 views

Best Practice: User config, folder and file rights for *nix web servers

What file and folder rights do you suggest for a maximum secure *nix web server. Posts like this and this are not really answering this. Long story This may sound trivial, but it isn't, when I ...
1
vote
1answer
47 views

Reverse PHP shell disconnecting when netcat listener

Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565 Rather than rely on Metasploit or Meterpreter to ...
0
votes
1answer
38 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
3answers
167 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
0
votes
0answers
51 views

When a web interface requires username/password authentication, is ability to execute commands as root via www-data a big security risk?

I want to create a web interface to run some software on a small Raspberry Pi computer. This will be similar to logging in to your router from your browser. The web interface will be have a dashboard ...
0
votes
0answers
28 views

Vulnerabilities associated with admin-ajax.php

I company I am working for has created a form that relies upon admin-ajax.php. This form is currently hidden with the wp-admin directory (is is blocked for external users). In order for the form to ...
1
vote
2answers
74 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
0
votes
0answers
19 views

Multibyte addcslashes/addslashes/str_replace not working as expected

I would like to convince another programmer, that using addslashes/addcslashes for escaping SQL query values is not secure. I found that answer regarding this topic: https://security.stackexchange.com/...
0
votes
0answers
57 views

XSS : How to bypass htmlentities when < > " & is escaped and no input is inside a tag attribute with single quote? (the page is UTF8)

So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a ...
0
votes
0answers
13 views

Paypal api saving client id and secret

I am developing a web application (It is a point system, users do certain things and they receive points for it and I am using Wordpress for it) in php and I wanted to ask what is the best way to ...
0
votes
1answer
34 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
2
votes
0answers
113 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
6
votes
3answers
352 views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...
0
votes
0answers
24 views

WordPress javascript code injection [duplicate]

Google notified me that there are malicious links on my website: https://cobalten.com/apu.php?zoneid=2025634 https://go.oclasrv.com/apu.php?zoneid=2025634 https://wowreality.info/page.js?wm=gr It's ...
0
votes
1answer
78 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...
1
vote
0answers
36 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
-1
votes
1answer
51 views

How To Patch LFI Vulnerabilities [closed]

I wonder how to patch the LFI problem in this code? Please suggest a good way to patch this vulnerability.
0
votes
2answers
66 views

Locale detection & huge Accept-Language header, can this be considered an atack vulnerability?

I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app. Most of the answers I found were similar, only differing in the parsing methods. An example '...
0
votes
1answer
46 views

Any threats/SQL injections possible, when single-quote is being escaped?

Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url: example.com/?id=a'b the app ...
2
votes
1answer
32 views

php-fpm.log shows a mass of unusual attempts to open primary script with random filenames [duplicate]

I recently happened to inspect my php-fpm.log and found a lot of suspicious activity that looks like malicious attempts to get access to my host. Here're some of the logs: [07-Oct-2018 22:01:31] ...
-1
votes
1answer
104 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
2
votes
1answer
34 views

Limit rights for user applications

I have a website, where users are available to upload small applications which runs 24/7 on my server. So if the user upload an application, some folders will be created: /{USER_ID}/{APP_ID}/ (if ...
0
votes
1answer
31 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
1
vote
1answer
76 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
0
votes
1answer
35 views

Remotely included script cannot set session variables

I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging ...
0
votes
1answer
98 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
2
votes
0answers
26 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
0
votes
0answers
17 views

Malicious php files and strange directories appear in an HTML only directory [duplicate]

I host a website at a hosting company. I believe it is the "shared" kind of hosting. I was hacked somehow and sudden php files and directories pop up with certain frequency. Also, on my error logs I ...
0
votes
1answer
49 views

What is a secure way to use PHP tokens in a C# application

I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if ...
0
votes
1answer
28 views

What characters that are converted when running PHP on IIS?

I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload I saw this statement: Finding characters that are converted to other useful ...
3
votes
4answers
166 views

Can valid PHP be written and executed in non-ascii character encodings?

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii. ...
-4
votes
1answer
82 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
0
votes
0answers
82 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
-1
votes
1answer
66 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...
2
votes
3answers
205 views

PHP - Needing help to encrypt/hash a password for small application

I have created a small script for work. It's an internal web script but has to be hosted on our public domain so I have created a very small PHP based login system using a login form and a session ...
1
vote
0answers
24 views

Disable php://filter globally or per php file

Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini: allow_url_fopen = Off allow_url_include = Off open_basedir = /var/www/html Clearly, ...
0
votes
0answers
50 views

preg_replace() bypassing [duplicate]

so i was googling some web CTF's to play, and i've found a one with preg_replace() filtering in the login page. $name = preg_replace('/\'/', '', $name); $pass = preg_replace('/\'/', '', $pass); $...
0
votes
2answers
105 views

Php parameters (username, password) in link

Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time. I was examining a web site on a remote server and i saw something like; www.myurl.com/login....
3
votes
3answers
926 views

How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login. ...
2
votes
1answer
503 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
0answers
38 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
-1
votes
1answer
276 views

Using SQL to compare hashed passwords

Setup A LAMP system (Linux, Apache, MySQL, PHP). Access to db is over the loopback interface (maybe not in the future - dependent on hosting solution). The db contains a table with the username, ...
-3
votes
1answer
397 views

How To detect Fake mobile number for SMS verification [closed]

I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info How to detect the number is ...
0
votes
1answer
129 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...