Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
89
questions with no upvoted or accepted answers
4
votes
0
answers
310
views
Obtaining large data sets for research: MySQL, PHP, Apache, etc
I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
- 141
3
votes
1
answer
193
views
Sql map Manual Vulnerability Assessment
I am trying to do penetration testing for one of my client.
The platform is Code ignitor.
There is an endpoint /find/1
The function queries the vehicle table where vehicle ID is 1 with no sanity check....
- 43
3
votes
0
answers
558
views
Disable php://filter globally or per php file
Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini:
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html
Clearly, ...
- 611
3
votes
0
answers
508
views
Is setting the Apache's TimeOut directive to 3 hours risky?
In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
- 296
2
votes
0
answers
187
views
How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?
From PHP Session Management basics:
Proper use of session.use_only_cookies and session_regenerate_id() can
cause personal DoS with undeletable cookies set by attackers. In this
case, developers may ...
- 121
2
votes
0
answers
100
views
Using a fix $key and variable $data vs partially variable $key with fixed $data in PHP's hash_hmac()
This question was originally asked in stack overflow, but it was suggested to ask it here as well..
not looking to improve on hash_hmac functionality. I'm rather interested in the $uri in the ...
2
votes
0
answers
476
views
Exploiting LFI with prefix in PHP?
I have a scenario as the following:
<?php include("resource/" + $_GET['vuln']); ?>
And I'm trying to get RCE from this, or atleast acquire some interesting information.
I already looked at /...
- 133
2
votes
0
answers
106
views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
- 141
2
votes
0
answers
318
views
Does CVE-2019-0211 affect Apache w/ php-fpm?
Intro
From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019),
Apache HTTP suffers from a local root privilege escalation
vulnerability due to an out-of-bounds array access leading ...
- 3,116
2
votes
0
answers
140
views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
- 64.2k
2
votes
0
answers
82
views
PHP static code analysis tool that follows includes (framework compatible)
I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis.
For example:
include "asdf.php"
//this is a function defined in asdf.php
echo test($...
2
votes
0
answers
633
views
Random Alphabetical String Added to URL
I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue:
Users have ...
- 63
2
votes
0
answers
146
views
How to securely manage generating files on the client-side to download
While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript:
using data URLs
by generating the file on ...
- 296
2
votes
0
answers
769
views
Why does the order of arguments to hash_equals() matter?
The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather ...
- 609
1
vote
0
answers
25
views
Is PHP json_encode sufficient for HTML data blocks?
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" ...
- 136
1
vote
0
answers
101
views
How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"
The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive:
<FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)">
SetHandler ...
- 570
1
vote
0
answers
130
views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
- 11
1
vote
0
answers
524
views
Identifying Source of Malware Attack on Laravel App
We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin
Recently that server issued a maldet warning (our ...
- 11
1
vote
0
answers
335
views
Is XSS possible when using htmlspecialchars and https prefix check in href?
There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example:
<a href="javascript:alert(42);">please clickme</...
- 558
1
vote
0
answers
64
views
Is there such a thing as "parameterized terminal commands"?
Long ago, I used to do SQL queries like:
SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1;
This was horribly scary and I probably messed it up by ...
1
vote
0
answers
368
views
Print contents of PHP file in CTF
I am working with a PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php.
My train of thought is that the following could be the vulnerabilities in the ...
- 19
1
vote
1
answer
165
views
What is the recommended way to generate API tokens using Laravel framework?
I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
- 11
1
vote
0
answers
521
views
SQLMAP with single URL application
I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
- 111
1
vote
0
answers
649
views
How to abuse eval() in PHP
I'm trying to bypass a page that has an eval() and it works like this:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
...
- 11
1
vote
0
answers
162
views
How to implement a "Forgot password?" functionality using php-encryption's KeyProtectedByPassword and 2FA?
I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
- 111
1
vote
0
answers
226
views
Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?
Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
- 54
1
vote
0
answers
984
views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
- 13
1
vote
0
answers
732
views
CSRF protection and Single Page Apps on hosted on S3 (with no backend.)
I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
- 111
1
vote
0
answers
257
views
Problem in Cracking PHP rand() seed on windows
I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
- 159
1
vote
0
answers
288
views
Conditions under which PHP path-traversal with %2e works
While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file:
<?php var_dump(file_exists(...
- 11
1
vote
0
answers
1k
views
php-reverse-shell in Wordpress can't connect to netcat
I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
- 21
1
vote
0
answers
200
views
Choosing a more or less secure signature algorithm with very short signature length
For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app.
I would imagine to use RSA or something but the signature ...
- 1,147
1
vote
0
answers
247
views
security breach: php file edited on codeigniter site, ubuntu server
I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
- 11
1
vote
0
answers
418
views
Countermeasure for privilege escalation for TeamPass
I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
- 111
1
vote
0
answers
380
views
What is the difference in implementation between HybridAuth and OpenID Connect?
I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
- 111
1
vote
0
answers
183
views
Decryption with two-way authentication
We have a Customer who wants his sensitive user-data stored with an encryption.
These are the basic requirements:
Sensitive user-data is stored in a database using encryption
A remote-attacker who ...
- 11
1
vote
0
answers
516
views
IIS | Block execution of files in directory
I am dealing with user uploads via a PHP application.
I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it.
I have set it so all ...
- 99
1
vote
0
answers
3k
views
Codeigniter RESTful web api creation for mobile and web applications general guidelines
I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
- 111
1
vote
0
answers
342
views
Secure Requests Between iOS App and PHP Server
I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
- 11
1
vote
0
answers
161
views
Where to save digital content and prevent sharing?
I've been inspired by the answer to the question here: Location to store an encryption key
It gave me a lot to think about.
My friend and I are building a website and we've encountered a problem in ...
- 11
1
vote
0
answers
149
views
trackback spotted in multple http errors
[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php
Does ...
- 111
1
vote
0
answers
3k
views
Do I keep my PHP simple auth session secure enough?
I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
- 111
1
vote
0
answers
420
views
Implementation of different BCrypt versions
I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
1
vote
0
answers
134
views
Is what flexi_auth does with its use of its $this->auth object good practice?
I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used
Like this:
`$this->auth =...
- 173
1
vote
1
answer
194
views
How to deny execution of any file on a specific directory?
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
- 111
0
votes
0
answers
39
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
0
votes
0
answers
55
views
How to perform php post request attack with javascript sanitization?
The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
- 9
0
votes
0
answers
53
views
What's the best way to handle authentication across multiple different domains under the same service?
For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains?
For the main site, example.com, I am currently using:
&...
- 1
0
votes
0
answers
34
views
How does "./" affects signature generation for files, in a PHP based web application?
I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
0
votes
0
answers
101
views
How to prevent a timing attack when I do/don't perform password_verify (depending if the user exists)?
Here is the code which potentially can allow a timing attack
$user = getUserFromDatabase($input_username);
if ($user === false) { // potential timing attack
// user not exist
...
- 11