All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
2answers
268 views

How to open a shell using LFI or RFI exploits?

I am completing some online labs to do with cybersecurity and I have been given the task of dealing with a virtual machine of kali linux, to access a basic ip for a website called "yellow". we access ...
1
vote
1answer
169 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
1answer
131 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
1answer
277 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
0
votes
1answer
60 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
0
votes
1answer
163 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
-1
votes
1answer
369 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
-4
votes
1answer
98 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
0
votes
2answers
404 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
1answer
902 views

What web servers are affected by this user agent exploit?

I found this user agent logged in one of my websites: Array ( [IPaddress] => 115.89.123.121 [userAgent] => }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}...
6
votes
2answers
4k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
1
vote
2answers
128 views

Is it secure to execute MySQL queries on a client device?

I am building a project that requires users to be authenticated to access it. I was planning on using MySQL as a database and running PHP scripts on the client to fetch user data. E.g. SELECT * from ...
0
votes
1answer
135 views

How exactly can a public server be compromised? [closed]

I'm in the process of setting up a network and it needs a site for users to be accessible on the internet. I keep reading about not having a public server on a local network, domain etc etc. And that ...
2
votes
3answers
1k views

Huge amount of hidden porn backlinks from legit WordPress sites, why they did it?

I was doing some backlink research and found a huge amount of legit websites linking to the site I was researching. The problem was that the anchor text of all the links where porn related terms.... ...
1
vote
1answer
198 views

Does using PHP headers during login make the form vulnerable to attacks?

I didn't think so, but upon reading online it seems this type of code is vulnerable as I'm not ending with exit(); and could therefore be exploited by redirecting or changing the contents of the ...
2
votes
2answers
1k views

Understanding preg_replace Filtering & Exploitation

Here is the proof of concept of the code: <?php $input=$_GET['input']; print preg_replace('/[A-DH-M0-9._%+-]+@(.+)\.[A-Z]{2,4}/mADsex', 'strtoupper("\\1")', $input); ?> I don't quite ...
1
vote
0answers
154 views

How did hackers compromise my WHMCS? [closed]

Today I tried to access my WHMCS admin but I couldn't. Someone had entered my system, removed my admin and added his own. I figured out how to protect my admin panel through .htaccess allowing only ...
0
votes
1answer
2k views

Exploiting printed _GET parameters in PHP

I am trying to learn how to exploit poorly secured $_GET parameters on my own website for research purpose. I just want to execute basic stuff like phpinfo(). The vulnerable code is like so : if(...
0
votes
1answer
1k views

File inclusion on a website always appending .php

I'm looking at a website that uses a URL parameter to include the current page, like http://host.tld/index.php?page=about. If I add anything other than the current page (e.g. http://host.tld/index....
1
vote
0answers
261 views

Countermeasure for privilege escalation for TeamPass

I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
3
votes
1answer
3k views

Exploiting the PHP readfile function when a filename is appended to the path

I would like to ask a question about exploiting the PHP function readfile. So I'm geting payed for hacking a site, and I need to read a PHO file named readme.php through a PHP file named read.php, ...
0
votes
1answer
1k views

LFI - Bypass Preg_Replace

I have a script that have this code: $name = preg_replace('/[^a-z0-9_.]/', '', $_GET['name']); $_GET['name'] = ../../conf.php but preg_replace filtered my slash (/) and $name will be ....conf.php ...
1
vote
3answers
10k views

Local File Inclusion to RCE using PHP File Wrappers

Suppose we have code that looks something like this: <?php include("includes/".$_GET['param1'].".php");?> Now the above code is vulnerable to LFI. If I pass payload ../../../../etc/passwd%00it ...
5
votes
1answer
3k views

How to bypass mysql_real_escape_string to exploit a SQLi vulnerability?

I tried to find some SQL injection exploits that could bypass functions that should prevent sql injection vulnerabilities, for example mysql_real_escape_string. I found an exploit and the author ...
0
votes
1answer
452 views

Does having /sbin/nologin mean I cannot start the /bin/sh executable?

While practicing exploitation on a lab, I managed to get the ability to execute php code which allowed me to execute system commands through shell_exec on a web server. The apache user has /sbin/...
-1
votes
2answers
413 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
-1
votes
2answers
830 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
42
votes
7answers
10k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
5
votes
2answers
2k views

How can someone upload a PHP file to a server without an upload form?

I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the ...
0
votes
2answers
249 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
5
votes
2answers
4k views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
3
votes
2answers
883 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
4answers
351 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
14
votes
3answers
60k views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
1
vote
1answer
1k views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
3
votes
2answers
664 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo $_POST['message']...
4
votes
2answers
3k views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
-1
votes
1answer
2k views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: <?...
2
votes
2answers
5k views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
-3
votes
1answer
126 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
3
votes
1answer
306 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
4
votes
2answers
4k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
1
vote
1answer
296 views

WordPress private exploit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
9
votes
2answers
22k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a PHP ...
4
votes
1answer
513 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
2
votes
2answers
3k views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which is ...
1
vote
5answers
2k views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. eval((base64_decode("...
2
votes
6answers
21k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
5
votes
2answers
2k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
1
vote
1answer
106 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check how/...