Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

89 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
310 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
user avatar
3 votes
1 answer
193 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
user avatar
  • 43
3 votes
0 answers
558 views

Disable php://filter globally or per php file

Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini: allow_url_fopen = Off allow_url_include = Off open_basedir = /var/www/html Clearly, ...
user avatar
3 votes
0 answers
508 views

Is setting the Apache's TimeOut directive to 3 hours risky?

In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
user avatar
2 votes
0 answers
187 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
user avatar
  • 121
2 votes
0 answers
100 views

Using a fix $key and variable $data vs partially variable $key with fixed $data in PHP's hash_hmac()

This question was originally asked in stack overflow, but it was suggested to ask it here as well.. not looking to improve on hash_hmac functionality. I'm rather interested in the $uri in the ...
user avatar
2 votes
0 answers
476 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
user avatar
  • 133
2 votes
0 answers
106 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
user avatar
2 votes
0 answers
318 views

Does CVE-2019-0211 affect Apache w/ php-fpm?

Intro From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading ...
user avatar
  • 3,116
2 votes
0 answers
140 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
user avatar
  • 64.2k
2 votes
0 answers
82 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
user avatar
2 votes
0 answers
633 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
user avatar
2 votes
0 answers
146 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
user avatar
2 votes
0 answers
769 views

Why does the order of arguments to hash_equals() matter?

The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says, It is important to provide the user-supplied string as the second parameter, rather ...
user avatar
  • 609
1 vote
0 answers
25 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
1 vote
0 answers
101 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler ...
user avatar
  • 570
1 vote
0 answers
130 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
user avatar
  • 11
1 vote
0 answers
524 views

Identifying Source of Malware Attack on Laravel App

We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin Recently that server issued a maldet warning (our ...
user avatar
1 vote
0 answers
335 views

Is XSS possible when using htmlspecialchars and https prefix check in href?

There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example: <a href="javascript:alert(42);">please clickme</...
user avatar
1 vote
0 answers
64 views

Is there such a thing as "parameterized terminal commands"?

Long ago, I used to do SQL queries like: SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1; This was horribly scary and I probably messed it up by ...
user avatar
1 vote
0 answers
368 views

Print contents of PHP file in CTF

I am working with a PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php. My train of thought is that the following could be the vulnerabilities in the ...
user avatar
1 vote
1 answer
165 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
user avatar
1 vote
0 answers
521 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
user avatar
1 vote
0 answers
649 views

How to abuse eval() in PHP

I'm trying to bypass a page that has an eval() and it works like this: POST /anything.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 ...
user avatar
1 vote
0 answers
162 views

How to implement a "Forgot password?" functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
user avatar
1 vote
0 answers
226 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
user avatar
  • 54
1 vote
0 answers
984 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
user avatar
1 vote
0 answers
732 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
user avatar
1 vote
0 answers
257 views

Problem in Cracking PHP rand() seed on windows

I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
user avatar
  • 159
1 vote
0 answers
288 views

Conditions under which PHP path-traversal with %2e works

While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file: <?php var_dump(file_exists(...
user avatar
  • 11
1 vote
0 answers
1k views

php-reverse-shell in Wordpress can't connect to netcat

I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
user avatar
1 vote
0 answers
200 views

Choosing a more or less secure signature algorithm with very short signature length

For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app. I would imagine to use RSA or something but the signature ...
user avatar
  • 1,147
1 vote
0 answers
247 views

security breach: php file edited on codeigniter site, ubuntu server

I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
user avatar
  • 11
1 vote
0 answers
418 views

Countermeasure for privilege escalation for TeamPass

I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
user avatar
  • 111
1 vote
0 answers
380 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
user avatar
  • 111
1 vote
0 answers
183 views

Decryption with two-way authentication

We have a Customer who wants his sensitive user-data stored with an encryption. These are the basic requirements: Sensitive user-data is stored in a database using encryption A remote-attacker who ...
user avatar
  • 11
1 vote
0 answers
516 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
user avatar
  • 99
1 vote
0 answers
3k views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
user avatar
1 vote
0 answers
342 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
user avatar
  • 11
1 vote
0 answers
161 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
user avatar
  • 11
1 vote
0 answers
149 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
user avatar
  • 111
1 vote
0 answers
3k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
user avatar
  • 111
1 vote
0 answers
420 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
user avatar
1 vote
0 answers
134 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth =...
user avatar
  • 173
1 vote
1 answer
194 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
user avatar
0 votes
0 answers
39 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
user avatar
0 votes
0 answers
55 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
0 votes
0 answers
53 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
user avatar
  • 1
0 votes
0 answers
34 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
user avatar
0 votes
0 answers
101 views

How to prevent a timing attack when I do/don't perform password_verify (depending if the user exists)?

Here is the code which potentially can allow a timing attack $user = getUserFromDatabase($input_username); if ($user === false) { // potential timing attack // user not exist ...
user avatar
  • 11