Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
0answers
54 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=explode("!",$w);@$e[0](/* */ @...
2
votes
1answer
76 views

Is this schema between a Desktop App and an API secure?

From my previous question: How secure is this schema between a Desktop App (c++) and an API (php). Introduction I made a paid Desktop-app that required constant internet connection (because of its ...
1
vote
1answer
84 views

How secure is this schema between a Desktop App (c++) and an API (php)

as title says I'm writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. ...
0
votes
2answers
93 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
0
votes
0answers
35 views

user_roles getting deleted from wp_options table in wordpress

I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by ...
3
votes
2answers
76 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
1
vote
1answer
70 views

Is it possible to gain RCE from Arbitrary file write by an unprivileged user?

I am pentesting a PHP website running on Apache in a Ubuntu server. I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP ...
0
votes
1answer
112 views

I saw a weird url in my logs, dunno how to proceed [duplicate]

I'm by no means a security expert. I own a very small personal site which I wrote in php mostly for practice and all that. I noticed a weird url call in my logs process.php?d=MV0f+F6R+6Nn/...
0
votes
1answer
77 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
0answers
50 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
0
votes
2answers
128 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
0
votes
2answers
107 views

Unable to execute PHP, throws 500 error. Able to upload and execute all others

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I ...
4
votes
2answers
182 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
1
vote
1answer
82 views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
7
votes
5answers
3k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
0
votes
0answers
57 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
5
votes
2answers
938 views

Is directly echoing the user agent in PHP a security hole?

Is this script vulnerable to PHP or JS code injection? In my quick test I changed the useragent to a PHP script but it will not be executed just printed. If change the user agent to a javascript code ...
-4
votes
1answer
127 views

How to prevent other users from accessing PHP source code?

The source code of my website is on a server multiple people can access via FTP. How can I prevent them from accessing the source code? Edit: Ok, so I can't do nothing about that. But, how about if ...
3
votes
3answers
160 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
1answer
100 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
2
votes
1answer
142 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
35 views

PHP stuff requests on Node.js based web app? [duplicate]

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...
0
votes
0answers
91 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
0
votes
1answer
232 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...
-1
votes
1answer
70 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
60 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
3
votes
2answers
162 views

What does The input is reflected inside a tag parameter between double quotes mean?

A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside ...
0
votes
2answers
240 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
2
votes
1answer
176 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...
0
votes
1answer
102 views

Bluehost Wordpress Site hacked multiple times FTP MMprobe php file [duplicate]

Anyone have experience and advice to locate the source and stop an ftp hack on my client's Wordpress site hosted on BlueHost? The hackers were able to do the following: Create multiple ftp accounts ...
1
vote
2answers
93 views

I want know if a file with php code but without extension name could be exploted?

I'm testing a site and I found a file with critical php code but this does not have extension name, my question is it could be exploited for a shell attack or something like? I don't found nothing ...
1
vote
1answer
146 views

When signing up a new user, is there a way to secure the password using jQuery/PHP?

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...
1
vote
1answer
67 views

Is emulated SQL query preparation less secure?

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
2
votes
1answer
266 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
-1
votes
1answer
70 views

In my webserver I found may PHP with random strings [duplicate]

In one of my webserver, I found some new folders got created and many files are there, In access log I found many files access from that folder. Sample file: After this strings: But it I copy ...
0
votes
0answers
46 views

How do i ensure that links are from OneDrive / Google Drive?

I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are ...
0
votes
0answers
42 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
4
votes
1answer
260 views

Timing attack - Is safe to check if strings have the same length?

In Node, you can use crypto.timingSafeEqual() to check if two strings are equal in a timing-attack safe way. But, they must have the same length, so you have to do something like that: return ...
0
votes
1answer
127 views

Securing a website for my school project [closed]

I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
1
vote
1answer
74 views

What should I use to encrypt data between a centralized server and multiple devices running NodeJS?

I have a centralized server and DB that each of my devices polls every ten seconds. The centralized server may respond with a list of "active jobs", which the devices will then run. I need to ensure ...
3
votes
1answer
164 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
2
votes
1answer
95 views

File upload security with PHP - Header to text/plain

I am using PHP to create a small script that uploads images to a server. While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
0
votes
1answer
51 views

Does PHP unserialize work with an object inside a string

serialize($_POST); where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure? I coulnd't get ...
1
vote
1answer
73 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...
0
votes
2answers
86 views

Confidentiality and Authenticity of the Key in a Key-Value Store

What, if anything, can be used to provide confidentiality and authenticity guarantees for the storage keys used to store data in a key-value store? To be clear what I mean by the storage keys - I ...
-1
votes
1answer
364 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
96 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
114 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
50 views

Are public paths/folder structures mean security risks for a website? [duplicate]

I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. ...
0
votes
1answer
89 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...