Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
1,609
questions
0
votes
1
answer
35
views
PHP code review: is it open to object code injection through unserialize [closed]
I'm trying to figure out if the code below is open to object injection:
<?php
// loggin level
define('CRIT', 5);
define('ERROR', 4);
// secret is defined somewhere in the script ...
- 1
0
votes
1
answer
83
views
This is supposed to be vulnerable to SQL injection but I can't really see how. Is it really that bad?
See bellow php code that takes a url param, queries a db and then returns a string:
$inpt = ereg_replace("[^A-Za-z0-9" . '' . "]", "", $_GET['param']);
$rtrn = $...
- 529
-1
votes
0
answers
13
views
pick a value from array [migrated]
i have a curl request which fetches response, response comes as plain text, i need to read a value from response.
i have used below method it works using ID, i want to use name of field rather than ID ...
4
votes
1
answer
185
views
User isolation in LAMP
As I understand, in a typical LAMP (or be it LEPP) setup, all PHP code is executed using the same user and group ("www" or similar). In a multi-user scenario (e.g. some variant of allowing ...
- 143
-2
votes
2
answers
49
views
PHP 7+ custom salt hashing algorithm [closed]
I'd like to hash email addresses with the same salt to make the hash searchable\indexable and make it hard to figure out the actual data. I wanted to use bcrypt, but I found that from PHP 7 custom ...
- 479
0
votes
1
answer
101
views
Implementing secure two factor authentication with Google Authenticator?
I would like to add two factor authentication to a login screen. My understanding of the process is the following:
Generate a QR Code
Scan this Code with Google Authenticator app
Use a library to ...
- 121
0
votes
1
answer
114
views
Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]
I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
- 9
32
votes
1
answer
4k
views
Crashing the sha1() function in PHP?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Here is my methodology:
Reset the ...
- 705
0
votes
1
answer
35
views
Post-EOL security patches for PHP7
Imagine the following situation: you have a third party software which still uses PHP7 despite of the EOL.
The risk there will be further post-EOL vulnerabilities is as I estimated considerably higher ...
- 127
0
votes
1
answer
63
views
JWT secret part from php password_hash() (128bit random salt and password hashed together)?
We are using JWT (Json Web Token), with HS256 algorithm.
Is it ok to use PHP's password_hash() functions output for the secret part?
It's output is a 128 bit random salt with the user's password ...
1
vote
1
answer
123
views
Is running PHP file_get_contents on random user-generated links safe?
In one of my PHP apps, I have a part where it scrapes the content of random links on the internet using file_get_contents, and then it runs a regex on this content to find all the email addresses in ...
- 297
0
votes
0
answers
22
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 101
0
votes
0
answers
45
views
Are these cPanel processes malicious? [duplicate]
I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.
After investigating ...
- 297
18
votes
2
answers
3k
views
Is this expect.php file (in all the git repositories of my web server) malicious? [closed]
Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it:
<?php
function visit_cookie() {
$h = $_COOKIE;
...
- 297
0
votes
1
answer
74
views
Why can I not sql inject this piece of code? [duplicate]
This is the code:
$stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?");
$stmt->bind_param("is", $kurssi, $avain);
// prepare and bind
$...
1
vote
1
answer
145
views
Should I keep hash a secret?
I am using a service called "Lootably", and in order to verify postback requests, they require you to verify using a SHA256 hash, like this:
hash("sha256", userID . ip . revenue . ...
- 11
1
vote
2
answers
50
views
Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?
This is actually a general question about template engines.
If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
- 125
1
vote
1
answer
61
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
0
votes
1
answer
51
views
How exactly do security fixes get to the users in PHP?
I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the ...
- 133
0
votes
0
answers
58
views
Path Traversal with rawurldecode and dots validation
I'm trying to check if it's possible to bypass a two dots verification to perform a Path Traversal, downloading files out of the allowed folder. The problem is that it uses rawurldecode when ...
- 121
0
votes
1
answer
265
views
PHP - How to block files access in specific directory from the external
I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
- 1
0
votes
2
answers
208
views
What's so bad about including "backdoors" to a Website?
I have a fundamental question about the harm of leaving a backdoor in one of my public websites / plattforms. I do not want to discuss the details why I wanted to do that, I just want to understand ...
- 851
0
votes
2
answers
155
views
Running PHP commands on my website from a form input
I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like :
mkdir('Folder'); file_put_contents();scandir()...
0
votes
0
answers
27
views
SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?
I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
- 101
1
vote
1
answer
478
views
PHP, is addslashes() in eval() really that unsafe?
A friend challenged me in a programming question: You have a list of paths, make the paths a multidimensional associative array of paths.
Sample input:
$paths = [
"a/a/a",
"a/a/...
- 13
0
votes
0
answers
666
views
Best practices for storing passwords for PHP and MySQL applications [duplicate]
I am creating a simplified lead and call management system for a friend's small business.
I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
0
votes
1
answer
292
views
How do I prevent this PHP/Apache exploit?
I'm running:
Ubuntu 20.02
Apache/2.4.41
PHP 7.4.3
I am running a simple web server that will accept file uploads, store them and catalog them in a database.
When I check /var/log/apache2/error.log, ...
0
votes
2
answers
342
views
nonce generation based on php session id
On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to 'self' would ...
- 147
0
votes
1
answer
676
views
What can I do with a Pdf upload vulnerability on a CTF server?
A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
- 1
0
votes
1
answer
164
views
Is this really a way to filter LFI?
I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd.
Is it possible to bypass in_array function?
<?php
$...
- 13
4
votes
0
answers
54
views
Best practice for storing security tokens in source code [duplicate]
I have a PHP system and I need to store some tokens for operations like:
Database username and password
API token
Keys for encryption
It turns out that for a long time only I manage the source code, ...
- 163
0
votes
1
answer
1k
views
PHP 7.4.3 preg_match bypass
I want to filter user input like this:
$data = file_get_contents('php://input');
if ($data != null && $data !=='') {
$parsedData = json_decode($data, true);
}
// find quickmodule name
$...
1
vote
1
answer
491
views
Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?
Since PHP has loose type comparison, we have:
php -r 'var_dump("1234e03"=="1234000");'
bool(true)
And since MD5 hashs are often reprensented as hexa string like ...
- 1,341
0
votes
0
answers
115
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
0
votes
1
answer
336
views
unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]
I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
2
votes
1
answer
475
views
Is PHP json_encode sufficient for HTML data blocks?
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" ...
- 146
2
votes
1
answer
122
views
use md5 hashed guid as app login and REST interface
We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
- 147
-1
votes
1
answer
114
views
2 Way SSL for Magento API
Checked many blogs for 2 way ssl(Mutual Authentication) for magento api's or PHP but did not get end to end implementation details.
Below is my understanding.
Lets consider client (sslclient.com) and ...
0
votes
1
answer
120
views
Ruby on Rails: Request to http://\localhost/admin/config.php
I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php
This is the notification:
-------------------------------
Request:
------------------------...
- 103
0
votes
1
answer
58
views
Prevent reading PHP files
For better security(or for better hacker-life-difficulty) i do not trust even on my php files and my question is :
<?php
//how to deny any reading of .PHP files from standard PHP functions like ...
0
votes
0
answers
116
views
How to perform php post request attack with javascript sanitization?
The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
- 9
1
vote
1
answer
382
views
How to track which php file executed a malware binary
I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
- 111
2
votes
0
answers
659
views
What's the best way to handle authentication across multiple different domains under the same service?
For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains?
For the main site, example.com, I am currently using:
&...
- 21
0
votes
0
answers
37
views
How does "./" affects signature generation for files, in a PHP based web application?
I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
0
votes
1
answer
239
views
Can POST request be changed in a HTTPS website?
I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
0
votes
0
answers
271
views
How to prevent a timing attack when I do/don't perform password_verify (depending if the user exists)?
Here is the code which potentially can allow a timing attack
$user = getUserFromDatabase($input_username);
if ($user === false) { // potential timing attack
// user not exist
...
- 11
0
votes
1
answer
113
views
Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?
Usually once you register in a website you need to visit a url like:
https://example.com/user_activate/^random_string^
Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
0
votes
1
answer
359
views
Why not use a long life session ID for auto-login instead of a persistent cookie with a token?
On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
- 1
0
votes
1
answer
446
views
Securely transfer a file to a server via PHP
I'm trying to extract a specific dataset via a daily cronjob written in PHP (by extracting the data from a MariaDB DB), and transfer it onto another server D which is externally available to a client. ...
- 115
0
votes
1
answer
112
views
Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?
When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
- 3