Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
2answers
37 views

Secure GET-based remote API access via PHP

I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any ...
1
vote
1answer
152 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
0answers
17 views

RFI not working properly, how to open a shell? [on hold]

When i am trying to backdoor a web page given to me to find a specific file, upon requesting a shell i am given the following warnings on the page, and no other information is given. Should a shell ...
2
votes
1answer
65 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
0
votes
2answers
80 views

what should be done to use sodium in a secure way?

Now, I've done some research by googling about the subject and reading the manual and read other topics about this at stackoverflow. But still I have a question about the security and secrecy behind ...
0
votes
1answer
57 views

Does PHP unserialize work with an object inside a string

serialize($_POST); where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure? I coulnd't get ...
0
votes
1answer
44 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
1
vote
0answers
109 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
2answers
141 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
-1
votes
1answer
85 views

What should I do about this unrecognized PHP process?

I'm hoping you might be able to give me some advice. I'm new to linux system administration so go easy on me :) Was doing some checks around the directory that's being served by nginx and noticed ...
1
vote
1answer
46 views

Do PHP redirect information disclosure also apply to other languages or framework?

When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...
1
vote
1answer
97 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
3
votes
1answer
70 views

Protect page sms verification from spamming

I'm developing a merchant page where users can pay their bills. On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC). As a verification, we have a ...
2
votes
1answer
116 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
1
vote
0answers
67 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
2
votes
1answer
86 views

Is this schema between a Desktop App and an API secure?

From my previous question: How secure is this schema between a Desktop App (c++) and an API (php). Introduction I made a paid Desktop-app that required constant internet connection (because of its ...
0
votes
2answers
109 views

Unable to execute PHP, throws 500 error. Able to upload and execute all others

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I ...
1
vote
1answer
88 views

How secure is this schema between a Desktop App (c++) and an API (php)

as title says I'm writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. ...
0
votes
2answers
68 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
0
votes
1answer
121 views

How to block foreign language UTF-8 characters in usernames?

I am using UTF-8 for a new website, so I can do internationalisation on different pages, for example in greek (ελληνικά). I asked a question here earlier about possible security bugs this could bring ...
0
votes
2answers
109 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
0
votes
1answer
96 views

Is my session schema vulnerable to session fixation?

I have a PHP application, where two session IDs are being used. I will use foo and bar as example for those session IDs. The foo session ID is being generated at the login page. The bar session ID ...
3
votes
1answer
3k views

Exploiting the PHP readfile function when a filename is appended to the path

I would like to ask a question about exploiting the PHP function readfile. So I'm geting payed for hacking a site, and I need to read a PHO file named readme.php through a PHP file named read.php, ...
1
vote
1answer
92 views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
0
votes
0answers
35 views

user_roles getting deleted from wp_options table in wordpress

I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by ...
3
votes
2answers
83 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
1
vote
1answer
99 views

Is it possible to gain RCE from Arbitrary file write by an unprivileged user?

I am pentesting a PHP website running on Apache in a Ubuntu server. I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP ...
0
votes
1answer
113 views

I saw a weird url in my logs, dunno how to proceed [duplicate]

I'm by no means a security expert. I own a very small personal site which I wrote in php mostly for practice and all that. I noticed a weird url call in my logs process.php?d=MV0f+F6R+6Nn/...
4
votes
2answers
201 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
0
votes
0answers
51 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
0
votes
2answers
184 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
16
votes
7answers
14k views

Disable insecure/dangerous PHP functions

Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
4
votes
4answers
5k views

How is my website vulnerable for sql injections?

I am running a small website where I have published some articles. I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
0
votes
1answer
129 views

Securing a website for my school project [closed]

I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
1
vote
1answer
151 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
2
votes
1answer
708 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
1
vote
1answer
167 views

Securely interpret BBCode tags in PHP

I'm trying to make a kind of administratorpanel for my website, so I could e.g. easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, ...
0
votes
1answer
343 views

Any security reason to keep PHP short_open_tag off?

I recently found a couple of PHP server where short_open_tag is set to off. I would like to know if there is any security reason to set short_open_tag off.
10
votes
2answers
6k views

Is PHP unserialize() exploitable without any magic methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
7
votes
5answers
3k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
0
votes
0answers
57 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
-4
votes
1answer
132 views

How to prevent other users from accessing PHP source code?

The source code of my website is on a server multiple people can access via FTP. How can I prevent them from accessing the source code? Edit: Ok, so I can't do nothing about that. But, how about if ...
5
votes
2answers
946 views

Is directly echoing the user agent in PHP a security hole?

Is this script vulnerable to PHP or JS code injection? In my quick test I changed the useragent to a PHP script but it will not be executed just printed. If change the user agent to a javascript code ...
2
votes
1answer
595 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
3
votes
3answers
165 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
0
votes
2answers
246 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
5
votes
3answers
361 views

Local file inclusion when URL is appended with .php?

During pentesting, I came across a target vulnerable to local file inclusiong: include("$rootpath/includes/dir/".$_GET["section"].".php"); When I visit the URL http://target.com/img?section=images ...
2
votes
1answer
147 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
35 views

PHP stuff requests on Node.js based web app? [duplicate]

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...
0
votes
1answer
238 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...