Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
84
questions with no upvoted or accepted answers
4
votes
0answers
275 views
Obtaining large data sets for research: MySQL, PHP, Apache, etc
I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
1answer
76 views
Sql map Manual Vulnerability Assessment
I am trying to do penetration testing for one of my client.
The platform is Code ignitor.
There is an endpoint /find/1
The function queries the vehicle table where vehicle ID is 1 with no sanity check....
3
votes
0answers
350 views
Disable php://filter globally or per php file
Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini:
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html
Clearly, ...
3
votes
0answers
375 views
Is setting the Apache's TimeOut directive to 3 hours risky?
In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
2
votes
0answers
63 views
If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?
I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.
Everything ...
2
votes
0answers
108 views
How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?
From PHP Session Management basics:
Proper use of session.use_only_cookies and session_regenerate_id() can
cause personal DoS with undeletable cookies set by attackers. In this
case, developers may ...
2
votes
0answers
59 views
Using a fix $key and variable $data vs partially variable $key with fixed $data in PHP's hash_hmac()
This question was originally asked in stack overflow, but it was suggested to ask it here as well..
not looking to improve on hash_hmac functionality. I'm rather interested in the $uri in the ...
2
votes
0answers
67 views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
2
votes
0answers
242 views
Does CVE-2019-0211 affect Apache w/ php-fpm?
Intro
From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019),
Apache HTTP suffers from a local root privilege escalation
vulnerability due to an out-of-bounds array access leading ...
2
votes
0answers
94 views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
2
votes
0answers
40 views
PHP static code analysis tool that follows includes (framework compatible)
I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis.
For example:
include "asdf.php"
//this is a function defined in asdf.php
echo test($...
2
votes
0answers
411 views
Random Alphabetical String Added to URL
I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue:
Users have ...
2
votes
0answers
97 views
How to securely manage generating files on the client-side to download
While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript:
using data URLs
by generating the file on ...
2
votes
0answers
668 views
Why does the order of arguments to hash_equals() matter?
The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather ...
1
vote
1answer
71 views
How to protect client server app if both: client and server - located on client side?
Frontend communicates to backend.
I am a developer of frontend and backend.
I want to protect my app (prohibit end user from using my app without paying).
The only thing I have in mind is to have some ...
1
vote
1answer
103 views
PHP execution with special characters in the end
I was trying to reproduce this vulnerability:
https://www.exploit-db.com/exploits/49294
According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
1
vote
0answers
325 views
Identifying Source of Malware Attack on Laravel App
We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin
Recently that server issued a maldet warning (our ...
1
vote
0answers
30 views
Is there such a thing as “parameterized terminal commands”?
Long ago, I used to do SQL queries like:
SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1;
This was horribly scary and I probably messed it up by ...
1
vote
0answers
211 views
What is the approach to working on this?
I have a question I am working on with regards to PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php.
My train of thoughts is that the following ...
1
vote
0answers
298 views
Exploiting LFI with prefix in PHP?
I have a scenario as the following:
<?php include("resource/" + $_GET['vuln']); ?>
And I'm trying to get RCE from this, or atleast acquire some interesting information.
I already looked at /...
1
vote
1answer
89 views
What is the recommended way to generate API tokens using Laravel framework?
I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
1
vote
0answers
343 views
SQLMAP with single URL application
I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
0answers
471 views
How to abuse eval() in PHP
I'm trying to bypass a page that has an eval() and it works like this:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
...
1
vote
0answers
99 views
How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?
I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
1
vote
0answers
140 views
Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?
Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
0answers
623 views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
1
vote
0answers
502 views
CSRF protection and Single Page Apps on hosted on S3 (with no backend.)
I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
1
vote
0answers
206 views
Problem in Cracking PHP rand() seed on windows
I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
1
vote
0answers
161 views
Conditions under which PHP path-traversal with %2e works
While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file:
<?php var_dump(file_exists(...
1
vote
0answers
1k views
php-reverse-shell in Wordpress can't connect to netcat
I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
1
vote
0answers
151 views
Choosing a more or less secure signature algorithm with very short signature length
For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app.
I would imagine to use RSA or something but the signature ...
1
vote
0answers
209 views
security breach: php file edited on codeigniter site, ubuntu server
I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
1
vote
0answers
357 views
Countermeasure for privilege escalation for TeamPass
I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
1
vote
0answers
331 views
What is the difference in implementation between HybridAuth and OpenID Connect?
I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
0answers
140 views
Decryption with two-way authentication
We have a Customer who wants his sensitive user-data stored with an encryption.
These are the basic requirements:
Sensitive user-data is stored in a database using encryption
A remote-attacker who ...
1
vote
0answers
475 views
IIS | Block execution of files in directory
I am dealing with user uploads via a PHP application.
I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it.
I have set it so all ...
1
vote
0answers
3k views
Codeigniter RESTful web api creation for mobile and web applications general guidelines
I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
303 views
Secure Requests Between iOS App and PHP Server
I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
131 views
Where to save digital content and prevent sharing?
I've been inspired by the answer to the question here: Location to store an encryption key
It gave me a lot to think about.
My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
115 views
trackback spotted in multple http errors
[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php
Does ...
1
vote
0answers
3k views
Do I keep my PHP simple auth session secure enough?
I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
349 views
Implementation of different BCrypt versions
I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
1
vote
0answers
100 views
Is what flexi_auth does with its use of its $this->auth object good practice?
I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used
Like this:
`$this->auth =...
1
vote
1answer
152 views
How to deny execution of any file on a specific directory?
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
1
vote
1answer
193 views
Is XSS possible when using htmlspecialchars and https prefix check in href?
There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example:
<a href="javascript:alert(42);">please clickme</...
0
votes
0answers
16 views
Multi stage/request SQLmap with challenge
I have a scenario where I'm testing for injection points but the authentication form has a challenge token that refreshes with each GET. The credentials are sent in a POST accompanied by that ...
0
votes
0answers
44 views
Uploading php webshell using Burp Intruder
I am using Burp Intruder to upload a webshell to different directories.
These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
0
votes
1answer
36 views
CSRF tokens in file that we can upload a file
I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code
if (isset($file_submit)) {
//submit_file()
}
else {
show_submission_form()
}
...
0
votes
1answer
42 views
Bypass Local File Inclusion(LFI) prevention filters
I have these two LFI filters and i want to bypass them
$bad = str_replace('../','',$_GET['bad']);
while( substr_count($bad, '../', 0)) {
$bad = str_replace('../', '', $bad);...
0
votes
0answers
43 views
XSS with Java to get User Cookies
I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information.
I am following the instructions in this Lab for the XSS Attack.
We are ...
