Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

1
vote
0answers
28 views

Name of this cipher/encoding method?

I see a common method of encoding in PHP malware where there's some bytes of key, which gets used to decode that many bytes of encoded text. Decoded bytes get appended to the key on the fly. The ...
0
votes
1answer
25 views

Security for FTP connection within a server

In PHP, I am accessing another user's files using FTP on the same server. In this case, do I need to use secure FTP or is it ok to have normal FTP as both source and destination are on the same server?...
-1
votes
1answer
37 views

how to exploit file upload functionality [on hold]

I'm pentesting a website, where i'm testing an upload functionality and it only accepts pdf files and when we visit the url where the file gets uploaded it shows download prompt instead of any content....
0
votes
0answers
24 views

How to decrypt an openssl_encrypt() encrypted value using MySQL query? [closed]

If I am using the following php script to encrypt a field in my database: <?php require_once('../api.php'); $newApi = new api(); $conn = $newApi->connection(); //$key previously generated ...
-5
votes
0answers
33 views

Is there vulnerability in the next piece of code?

in my application I have the following part of code and I would like to know if it is vulnerable. In case something can be done, I would like to know how the vulnerability could be valid. $params = ...
0
votes
0answers
20 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
0
votes
1answer
30 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
0
votes
0answers
58 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...
1
vote
1answer
115 views

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies ...
-1
votes
0answers
32 views

php://filter or php://file Can we write a file with these filters?

I know how to use a filter to read a file on my system like file:///var/www/readme.txt But I am unaware if I can change the parameter to write to a file?
0
votes
2answers
57 views

PHP Code Injection vulnerability exists even after recommended hardening

Using Burp to intercept traffic and inject code we have identified remote code execution vulnerability in a website. After entering data in input fields on the form and clicking submit the traffic ...
0
votes
1answer
100 views

How to bypass the following PHP function [closed]

I need to write PHP code in an application in which I have access to the code, because it is a white box. However, I noticed that they use the following function: function stripbadchars($str_chain){ ...
0
votes
2answers
309 views

Strange GET request to my web application

I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment. During inspection of the logs, I found the following GET request, "GET /...
2
votes
2answers
126 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
82 views

We saw URL-decoded PHP code. What does the code mean?

We saw URL-decoded PHP code that will probably try to take down our web servers via overflow attack, but we do not know exactly what it does. The decoded URL string is: /<?php echo chr(78).chr(69)...
3
votes
2answers
108 views

Possible SQLi with self-made prepared statements and real_escape_string?

My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird. $query = db::...
0
votes
1answer
43 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
1
vote
2answers
51 views

Sending order details in hidden input fields?

I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a ...
3
votes
2answers
85 views

Store database access password in PHP class const?

I have PHP project and I need to store MySQL access information. I have a config.php file outside public directory and in the file I have: class Config { const host = "dbserver"; const name =...
2
votes
1answer
121 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
1answer
51 views

Security implication of disclosing composer.lock?

What are the security implications in disclosing the composer.lock file for a remote, public known, web application?
1
vote
1answer
113 views

Reverse PHP shell disconnecting when netcat listener

Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565 Rather than rely on Metasploit or Meterpreter to ...
0
votes
1answer
60 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
3answers
177 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
-1
votes
0answers
33 views

Vulnerabilities associated with admin-ajax.php

I company I am working for has created a form that relies upon admin-ajax.php. This form is currently hidden with the wp-admin directory (is is blocked for external users). In order for the form to ...
1
vote
2answers
184 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
-1
votes
0answers
110 views

XSS : How to bypass htmlentities when < > " & is escaped and no input is inside a tag attribute with single quote? (the page is UTF8)

So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a ...
0
votes
1answer
35 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
2
votes
0answers
116 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
6
votes
3answers
409 views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...
0
votes
1answer
79 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...
1
vote
0answers
37 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
-1
votes
1answer
54 views

How To Patch LFI Vulnerabilities [closed]

I wonder how to patch the LFI problem in this code? Please suggest a good way to patch this vulnerability.
0
votes
2answers
84 views

Locale detection & huge Accept-Language header, can this be considered an atack vulnerability?

I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app. Most of the answers I found were similar, only differing in the parsing methods. An example '...
0
votes
1answer
60 views

Any threats/SQL injections possible, when single-quote is being escaped?

Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url: example.com/?id=a'b the app ...
2
votes
1answer
37 views

php-fpm.log shows a mass of unusual attempts to open primary script with random filenames [duplicate]

I recently happened to inspect my php-fpm.log and found a lot of suspicious activity that looks like malicious attempts to get access to my host. Here're some of the logs: [07-Oct-2018 22:01:31] ...
-1
votes
1answer
135 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
2
votes
1answer
35 views

Limit rights for user applications

I have a website, where users are available to upload small applications which runs 24/7 on my server. So if the user upload an application, some folders will be created: /{USER_ID}/{APP_ID}/ (if ...
0
votes
1answer
33 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
1
vote
1answer
93 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
0
votes
1answer
40 views

Remotely included script cannot set session variables

I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging ...
0
votes
1answer
101 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
2
votes
0answers
29 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
0
votes
0answers
17 views

Malicious php files and strange directories appear in an HTML only directory [duplicate]

I host a website at a hosting company. I believe it is the "shared" kind of hosting. I was hacked somehow and sudden php files and directories pop up with certain frequency. Also, on my error logs I ...
0
votes
1answer
49 views

What is a secure way to use PHP tokens in a C# application

I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if ...
0
votes
1answer
28 views

What characters that are converted when running PHP on IIS?

I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload I saw this statement: Finding characters that are converted to other useful ...
3
votes
4answers
183 views

Can valid PHP be written and executed in non-ascii character encodings?

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii. ...
-4
votes
1answer
86 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
0
votes
0answers
133 views

DVWA file upload High without other vulnerabilities

I am busy with making a comprehensive writeup of DVWA for our junior employees. The high level of the file upload I do not seem to get to work except if I use the file include vulnerability and upload ...
-1
votes
1answer
77 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...