Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
1,607
questions
1
vote
1
answer
1k
views
Session management and login PHP scripts
I want to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, but ...
CommunityBot
- 1
2
votes
1
answer
1k
views
Bypass PHP strtoupper() to perform SQL-injection on MySQL database?
I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case ...
CommunityBot
- 1
3
votes
0
answers
109
views
PHP CTF: Vulnerabilities in PHP before 2007?
I came across a CTF that i'm trying to solve, the goal is fairly simple: Bypass the authentication form and access the admin-restricted area. You can find the code snippet below.
Things to consider:
...
- 127k
0
votes
1
answer
405
views
Why not use a long life session ID for auto-login instead of a persistent cookie with a token?
On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
CommunityBot
- 1
1
vote
1
answer
167
views
Should I keep hash a secret?
I am using a service called "Lootably", and in order to verify postback requests, they require you to verify using a SHA256 hash, like this:
hash("sha256", userID . ip . revenue . ...
CommunityBot
- 1
3
votes
2
answers
2k
views
Changing file extensions in PHP file upload to prevent code execution?
I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
- 133
0
votes
1
answer
108
views
This is supposed to be vulnerable to SQL injection but I can't really see how. Is it really that bad?
See bellow php code that takes a url param, queries a db and then returns a string:
$inpt = ereg_replace("[^A-Za-z0-9" . '' . "]", "", $_GET['param']);
$rtrn = $...
- 44.1k
2
votes
1
answer
211
views
What is the recommended way to generate API tokens using Laravel framework?
I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
CommunityBot
- 1
0
votes
1
answer
184
views
Is this really a way to filter LFI?
I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd.
Is it possible to bypass in_array function?
<?php
$...
- 1
1
vote
2
answers
698
views
DVWA - Converting Local File Inclusion to Remote Code Exploitation
I'm reading this blog and it says:
If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
CommunityBot
- 1
1
vote
1
answer
63
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
CommunityBot
- 1
2
votes
2
answers
2k
views
What is the best file permission for .user.ini in hosting folder?
My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
- 127k
1
vote
1
answer
245
views
Ways to detect CVE-2017-12419 intrusion
I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.
After fixing the gap and changing the passwords, what are some ways to detect if the ...
CommunityBot
- 1
4
votes
1
answer
189
views
User isolation in LAMP
As I understand, in a typical LAMP (or be it LEPP) setup, all PHP code is executed using the same user and group ("www" or similar). In a multi-user scenario (e.g. some variant of allowing ...
- 265
1
vote
1
answer
175
views
MongoDB NoSQLi in Cockpit CMS - use of $func?
Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave?
As I understand ...
CommunityBot
- 1
0
votes
2
answers
2k
views
Bypass Local File Inclusion(LFI) prevention filters
I have these two LFI filters and i want to bypass them
$bad = str_replace('../','',$_GET['bad']);
while( substr_count($bad, '../', 0)) {
$bad = str_replace('../', '', $bad);...
CommunityBot
- 1
2
votes
2
answers
1k
views
How to detect malicious files or web shell on a vps web server
How is it possible to detect malicious files or web shell on a vps web server?
I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
CommunityBot
- 1
-2
votes
2
answers
59
views
PHP 7+ custom salt hashing algorithm [closed]
I'd like to hash email addresses with the same salt to make the hash searchable\indexable and make it hard to figure out the actual data. I wanted to use bcrypt, but I found that from PHP 7 custom ...
- 127k
0
votes
1
answer
190
views
Implementing secure two factor authentication with Google Authenticator?
I would like to add two factor authentication to a login screen. My understanding of the process is the following:
Generate a QR Code
Scan this Code with Google Authenticator app
Use a library to ...
- 15.2k
0
votes
1
answer
174
views
Feedback wanted regarding my functions to Encrypt/Decrypt data using PHP (Openssl) [closed]
I am creating a web app (HTML, CSS, JavaScript, PHP & MySQL) where the users register, and only logged users can create and save personal Notes (encrypted) in a MySQL Server database I have for ...
- 127k
33
votes
1
answer
4k
views
Crashing the sha1() function in PHP?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Here is my methodology:
Reset the ...
- 2,126
0
votes
1
answer
35
views
Post-EOL security patches for PHP7
Imagine the following situation: you have a third party software which still uses PHP7 despite of the EOL.
The risk there will be further post-EOL vulnerabilities is as I estimated considerably higher ...
- 2,443
0
votes
1
answer
104
views
JWT secret part from php password_hash() (128bit random salt and password hashed together)?
We are using JWT (Json Web Token), with HS256 algorithm.
Is it ok to use PHP's password_hash() functions output for the secret part?
It's output is a 128 bit random salt with the user's password ...
- 44.1k
0
votes
2
answers
210
views
Running PHP commands on my website from a form input
I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like :
mkdir('Folder'); file_put_contents();scandir()...
- 11
3
votes
6
answers
27k
views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
- 65
9
votes
3
answers
2k
views
How to implement client side encryption for CalDav & CardDav content?
I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider.
Server side: PHP or ...
1
vote
1
answer
179
views
Is running PHP file_get_contents on random user-generated links safe?
In one of my PHP apps, I have a part where it scrapes the content of random links on the internet using file_get_contents, and then it runs a regex on this content to find all the email addresses in ...
18
votes
2
answers
3k
views
Is this expect.php file (in all the git repositories of my web server) malicious? [closed]
Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it:
<?php
function visit_cookie() {
$h = $_COOKIE;
...
- 2,372
0
votes
0
answers
22
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 65.1k
0
votes
0
answers
46
views
Are these cPanel processes malicious? [duplicate]
I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.
After investigating ...
- 297
0
votes
1
answer
76
views
Why can I not sql inject this piece of code? [duplicate]
This is the code:
$stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?");
$stmt->bind_param("is", $kurssi, $avain);
// prepare and bind
$...
- 1,559
1
vote
2
answers
52
views
Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?
This is actually a general question about template engines.
If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
- 1,559
16
votes
5
answers
6k
views
How can an attacker identify if a website is using PHP? How about the PHP version?
I have a vulnerable test site up that runs PHP.
How can an attacker identify that PHP is used?
if I type .../add.php the site gives back an error message, although the file is add.php.
If I type .../...
CommunityBot
- 1
0
votes
1
answer
52
views
How exactly do security fixes get to the users in PHP?
I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the ...
- 3,372
3
votes
1
answer
13k
views
Hydra + Tamper http post form syntax of the failure login attempt [duplicate]
I am doing a pentest of an internal site. I would like to check how secure is this when using Hydra as the password cracking tool.
I have used the Mozilla Tamper add-on to get the HEAD options (I ...
- 127k
0
votes
1
answer
250
views
CSRF tokens in file that we can upload a file
I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code
if (isset($file_submit)) {
//submit_file()
}
else {
show_submission_form()
}
...
CommunityBot
- 1
2
votes
3
answers
7k
views
Is it possible to exploit a file upload with whitelist and filename hashing?
I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
- 796
0
votes
0
answers
78
views
Path Traversal with rawurldecode and dots validation
I'm trying to check if it's possible to bypass a two dots verification to perform a Path Traversal, downloading files out of the allowed folder. The problem is that it uses rawurldecode when ...
- 121
0
votes
1
answer
304
views
PHP - How to block files access in specific directory from the external
I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
- 796
0
votes
2
answers
208
views
What's so bad about including "backdoors" to a Website?
I have a fundamental question about the harm of leaving a backdoor in one of my public websites / plattforms. I do not want to discuss the details why I wanted to do that, I just want to understand ...
1
vote
1
answer
646
views
PHP, is addslashes() in eval() really that unsafe?
A friend challenged me in a programming question: You have a list of paths, make the paths a multidimensional associative array of paths.
Sample input:
$paths = [
"a/a/a",
"a/a/...
- 116
2
votes
1
answer
657
views
Is PHP json_encode sufficient for HTML data blocks?
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" ...
- 425
0
votes
0
answers
27
views
SSH to a public account which is forced to run a PHP script. What additional security measures do I need to take?
I have an Ubuntu server with a user "demo". The user has been setup to run a php script on login with usermod demo -s /path/to/php/script.php. The password for the demo account will be ...
- 101
0
votes
1
answer
1k
views
Restrict file access in php.ini
What is the difference between include_path and open_basedir in PHP? My php.ini looks like this:
include_path = ".:/usr/share/php:/usr/share/pear:/var/www"
If, for example, I try using ...
- 5,437
2
votes
1
answer
2k
views
PHP File Upload Vulnerability
I'm assessing the security of a webportal for a client and I found a vulnerability.
I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function ...
- 127k
0
votes
0
answers
796
views
Best practices for storing passwords for PHP and MySQL applications [duplicate]
I am creating a simplified lead and call management system for a friend's small business.
I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
- 127k
0
votes
2
answers
421
views
nonce generation based on php session id
On an small audience highly confident web application we are about use CSP to add a level of security. Most parts of the application could be moved to script files and script-src set to 'self' would ...
- 147
0
votes
1
answer
357
views
How do I prevent this PHP/Apache exploit?
I'm running:
Ubuntu 20.02
Apache/2.4.41
PHP 7.4.3
I am running a simple web server that will accept file uploads, store them and catalog them in a database.
When I check /var/log/apache2/error.log, ...
- 111
0
votes
1
answer
882
views
What can I do with a Pdf upload vulnerability on a CTF server?
A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
- 7,717
4
votes
0
answers
58
views
Best practice for storing security tokens in source code [duplicate]
I have a PHP system and I need to store some tokens for operations like:
Database username and password
API token
Keys for encryption
It turns out that for a long time only I manage the source code, ...
- 127k