Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
4
votes
1answer
153 views

Vulnerability in restricted eval

Is it possible to exploit this code? eval ("\$RequestVariables = \$_REQUEST;"); or eval ("\$ServerVariables = \$_SERVER;"); I know if $_REQUEST or $_SERVER wasn't an array and if it was a string ...
11
votes
1answer
619 views

PHP eval code sandbox break

I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php function eval_syntax($code) { $braces = 0; $inString = 0; // We need to know if ...
2
votes
1answer
864 views

PHP File Upload Vulnerability

I'm assessing the security of a webportal for a client and I found a vulnerability. I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function ...
2
votes
1answer
74 views

Any security vulnerability in PHP fsocketopen

I'm assessing security of a webportal for a client and I found a vulnerability. In the PHP, the code parses a user supplied URL, finds hostname, then does this: fsocketopen("http://"$URL_HOST", 80); ...
7
votes
3answers
4k views

PHP file_get_contents vulnerability

I'm assessing security of a webportal for a client and I found a vulnerability. This is the PHP code: echo(file_get_contents("template/data/" $_GET['id'])); I was able to successfully read ../../../...
0
votes
2answers
3k views

Remote code execution vulnerability in PHP's base64_decode?

I'm trying to pentest a PHP script. This is the last line of the script that I want to exploit: Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']); Is it ...
-1
votes
1answer
995 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing Cross-...
2
votes
2answers
856 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
-1
votes
2answers
91 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
1
vote
1answer
581 views

PHP gethostbyname security implications

I'm working on a PHP application. There is a requirement to find IP's by hostname and i have to resort to gethostbynamel for that. Looks like there is no other way. I was wondering if there are any ...
1
vote
2answers
404 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
3
votes
2answers
160 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
29
votes
4answers
13k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
2
votes
4answers
1k views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
4
votes
1answer
236 views

What are possible consequences for applications that depends on Safe Mode for security?

PHP finally removed safe_mode feature: Safe Mode Warning This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. The PHP safe mode is an attempt to solve the ...
-1
votes
1answer
2k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
1
vote
1answer
106 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check how/...
6
votes
4answers
3k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
11
votes
2answers
1k views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
2
votes
4answers
3k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
3answers
2k views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
7
votes
2answers
369 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
5
votes
1answer
958 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
4
votes
1answer
1k views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I couldn't get ...
5
votes
3answers
767 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain directories),...
11
votes
1answer
706 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
4
votes
2answers
899 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as intended)...
7
votes
6answers
2k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
16
votes
4answers
830 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
6
votes
6answers
3k views

What are some good, free tools to run automated security audits for PHP code?

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, ...
11
votes
3answers
1k views

How to demonstrate SQL injection?

I've got lines in my PHP/MySQL code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a test/...
7
votes
3answers
27k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print "...
15
votes
2answers
8k views

How to do Ajax securely?

This question is inspired by this security question https://security.stackexchange.com/questions/1707 What are the threats in using Ajax? (Please note I am talking about security threats, not ...
24
votes
4answers
34k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
4
votes
3answers
4k views

Altering a $_SESSION variable in PHP via XSS?

Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script? One of our scripts uses a $_SESSION variable and I'm not sure if ...
8
votes
4answers
1k views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
6
votes
1answer
1k views

Good Security tool for PHP- Suhosin vs Spike vs PHPIDS

Do I have to check/test my code beforehand, or do these tools inform me when an attempt is being made in real time? Secondly, which one should I go for -- Suhosin or Spike or PHPIDS or a combo? What ...
7
votes
8answers
893 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
5
votes
1answer
2k views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
7
votes
1answer
468 views

how to configure edit-restricted mediawiki

I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user. I am planning to create a very restricted ...
11
votes
2answers
6k views

How to address XSS security issues in FCKeditor / CKeditor?

A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application. They pointed out that accessing URLs such as: http://www....
16
votes
7answers
14k views

Disable insecure/dangerous PHP functions

Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
6
votes
2answers
1k views

GET with additional parameters leads to “code injection” in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%...
11
votes
6answers
8k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET /...
22
votes
7answers
2k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
9
votes
3answers
3k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
8
votes
4answers
1k views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
9
votes
3answers
1k views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
16
votes
3answers
950 views

Getting a manual security code review done - What to watch out for?

We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
17
votes
9answers
8k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?