Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
1answer
103 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
-2
votes
0answers
46 views

what can be done by php method able to do 1+1 [on hold]

I just analyzed an app. found a php method on app used to bring profile credentials: POST service/bring_profile.php HTTP/1.1 Host: xxx.com Content-Type: text/plain Origin: file:// Connection: close ...
0
votes
1answer
32 views

PHP stuff requests on Node.js based web app? [duplicate]

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...
0
votes
0answers
66 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
0
votes
1answer
218 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...
-1
votes
1answer
65 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
53 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
3
votes
2answers
105 views

What does The input is reflected inside a tag parameter between double quotes mean?

A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside ...
0
votes
2answers
216 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
2
votes
1answer
98 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...
0
votes
1answer
58 views

Bluehost Wordpress Site hacked multiple times FTP MMprobe php file [duplicate]

Anyone have experience and advice to locate the source and stop an ftp hack on my client's Wordpress site hosted on BlueHost? The hackers were able to do the following: Create multiple ftp accounts ...
1
vote
2answers
88 views

I want know if a file with php code but without extension name could be exploted?

I'm testing a site and I found a file with critical php code but this does not have extension name, my question is it could be exploited for a shell attack or something like? I don't found nothing ...
1
vote
1answer
144 views

When signing up a new user, is there a way to secure the password using jQuery/PHP?

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...
1
vote
1answer
59 views

Is emulated SQL query preparation less secure?

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
2
votes
1answer
263 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
-1
votes
1answer
68 views

In my webserver I found may PHP with random strings [duplicate]

In one of my webserver, I found some new folders got created and many files are there, In access log I found many files access from that folder. Sample file: After this strings: But it I copy ...
0
votes
0answers
45 views

How do i ensure that links are from OneDrive / Google Drive?

I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are ...
0
votes
0answers
39 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
4
votes
1answer
245 views

Timing attack - Is safe to check if strings have the same length?

In Node, you can use crypto.timingSafeEqual() to check if two strings are equal in a timing-attack safe way. But, they must have the same length, so you have to do something like that: return ...
0
votes
1answer
101 views

Cybersecurity role for my website project. Need help and Advice [closed]

I been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login page?
1
vote
1answer
69 views

What should I use to encrypt data between a centralized server and multiple devices running NodeJS?

I have a centralized server and DB that each of my devices polls every ten seconds. The centralized server may respond with a list of "active jobs", which the devices will then run. I need to ensure ...
3
votes
1answer
161 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
2
votes
1answer
92 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
0
votes
1answer
49 views

Does PHP unserialize work with an object inside a string

serialize($_POST); where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure? I coulnd't get ...
1
vote
1answer
72 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...
0
votes
2answers
79 views

Confidentiality and Authenticity of the Key in a Key-Value Store

What, if anything, can be used to provide confidentiality and authenticity guarantees for the storage keys used to store data in a key-value store? To be clear what I mean by the storage keys - I ...
-1
votes
1answer
196 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
89 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
100 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
50 views

Are public paths/folder structures mean security risks for a website? [duplicate]

I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. ...
0
votes
1answer
73 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...
0
votes
0answers
133 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
1answer
117 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
0
votes
1answer
63 views

Storing server-side secret key in environment variable - is a concern?

Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
0
votes
1answer
110 views

How do I escape webapp root directory in a php website?

This is part of a old CTF question which I've had trouble solving. I'm not sure what approach to take. I'm given a single site: http://user:token@host:port/public/index.php the flag is in /tmp/flag....
2
votes
0answers
60 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
0
votes
1answer
53 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
0
votes
1answer
106 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
2
votes
1answer
545 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
86 views

Is my session schema vulnerable to session fixation?

I have a PHP application, where two session IDs are being used. I will use foo and bar as example for those session IDs. The foo session ID is being generated at the login page. The bar session ID ...
0
votes
0answers
57 views

Is php code with such features vulnerable to RCE?

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library. Here are the things I found I can make this library do for me: Include (include_once call) any ...
0
votes
1answer
188 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
2answers
134 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
0
votes
1answer
92 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
0
votes
1answer
58 views

PHP code execution attempts on an ASP website

I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
-4
votes
1answer
66 views

encrypting file and user have public key to decrypt in barcode [closed]

I want code very secure system and I need some answers and help. Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it. I've thinking of ...
-1
votes
1answer
129 views

Unknown code on my website comments [closed]

During the last few weeks, I often find on my website these "Comment": {"name":"BryantFlogy","email":"cgorillamail@gmail.com","message":"Hi, htmlkurss.xyz \r\n \r\nI&#39;ve been visiting your ...
0
votes
1answer
125 views

Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)

I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...
4
votes
1answer
67 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
0
votes
1answer
171 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...