Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
0answers
20 views

Secure GET-based remote API access via PHP

I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any ...
2
votes
1answer
61 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
0
votes
2answers
79 views

what should be done to use sodium in a secure way?

Now, I've done some research by googling about the subject and reading the manual and read other topics about this at stackoverflow. But still I have a question about the security and secrecy behind ...
0
votes
1answer
43 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
1
vote
0answers
109 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
1answer
46 views

Do PHP redirect information disclosure also apply to other languages or framework?

When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...
-1
votes
1answer
85 views

What should I do about this unrecognized PHP process?

I'm hoping you might be able to give me some advice. I'm new to linux system administration so go easy on me :) Was doing some checks around the directory that's being served by nginx and noticed ...
3
votes
1answer
69 views

Protect page sms verification from spamming

I'm developing a merchant page where users can pay their bills. On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC). As a verification, we have a ...
2
votes
1answer
114 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
1
vote
0answers
67 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
2
votes
1answer
86 views

Is this schema between a Desktop App and an API secure?

From my previous question: How secure is this schema between a Desktop App (c++) and an API (php). Introduction I made a paid Desktop-app that required constant internet connection (because of its ...
1
vote
1answer
88 views

How secure is this schema between a Desktop App (c++) and an API (php)

as title says I'm writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. ...
0
votes
2answers
109 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
0
votes
0answers
35 views

user_roles getting deleted from wp_options table in wordpress

I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by ...
3
votes
2answers
82 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
1
vote
1answer
97 views

Is it possible to gain RCE from Arbitrary file write by an unprivileged user?

I am pentesting a PHP website running on Apache in a Ubuntu server. I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP ...
0
votes
1answer
113 views

I saw a weird url in my logs, dunno how to proceed [duplicate]

I'm by no means a security expert. I own a very small personal site which I wrote in php mostly for practice and all that. I noticed a weird url call in my logs process.php?d=MV0f+F6R+6Nn/...
1
vote
1answer
97 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
0answers
51 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
0
votes
2answers
181 views

Does it really improve security to update PHP interpreter version without any code changes at all?

Our hosting provider wants to update our legacy application server (Plesk). We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL. ...
0
votes
2answers
109 views

Unable to execute PHP, throws 500 error. Able to upload and execute all others

I managed to upload a PHP shell using an upload form with some tweaking. No such restrictions except it renames the uploaded file to md5. But when I tried to execute the shell, It shows a 500 error. I ...
4
votes
2answers
199 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
1
vote
1answer
92 views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
7
votes
5answers
3k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
0
votes
0answers
57 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
5
votes
2answers
946 views

Is directly echoing the user agent in PHP a security hole?

Is this script vulnerable to PHP or JS code injection? In my quick test I changed the useragent to a PHP script but it will not be executed just printed. If change the user agent to a javascript code ...
-4
votes
1answer
132 views

How to prevent other users from accessing PHP source code?

The source code of my website is on a server multiple people can access via FTP. How can I prevent them from accessing the source code? Edit: Ok, so I can't do nothing about that. But, how about if ...
3
votes
3answers
165 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
1answer
104 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
2
votes
1answer
147 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
35 views

PHP stuff requests on Node.js based web app? [duplicate]

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...
0
votes
0answers
97 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
0
votes
1answer
238 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...
-1
votes
1answer
71 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
62 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
3
votes
2answers
185 views

What does The input is reflected inside a tag parameter between double quotes mean?

A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside ...
0
votes
2answers
245 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
2
votes
1answer
221 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...
0
votes
1answer
115 views

Bluehost Wordpress Site hacked multiple times FTP MMprobe php file [duplicate]

Anyone have experience and advice to locate the source and stop an ftp hack on my client's Wordpress site hosted on BlueHost? The hackers were able to do the following: Create multiple ftp accounts ...
1
vote
2answers
94 views

I want know if a file with php code but without extension name could be exploted?

I'm testing a site and I found a file with critical php code but this does not have extension name, my question is it could be exploited for a shell attack or something like? I don't found nothing ...
1
vote
1answer
147 views

When signing up a new user, is there a way to secure the password using jQuery/PHP?

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...
1
vote
1answer
69 views

Is emulated SQL query preparation less secure?

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
2
votes
1answer
267 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
-1
votes
1answer
70 views

In my webserver I found may PHP with random strings [duplicate]

In one of my webserver, I found some new folders got created and many files are there, In access log I found many files access from that folder. Sample file: After this strings: But it I copy ...
0
votes
0answers
47 views

How do i ensure that links are from OneDrive / Google Drive?

I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are ...
0
votes
0answers
42 views

Can you trace the path a file upload path without manually executing it?

In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
4
votes
1answer
267 views

Timing attack - Is safe to check if strings have the same length?

In Node, you can use crypto.timingSafeEqual() to check if two strings are equal in a timing-attack safe way. But, they must have the same length, so you have to do something like that: return ...
0
votes
1answer
129 views

Securing a website for my school project [closed]

I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
1
vote
1answer
74 views

What should I use to encrypt data between a centralized server and multiple devices running NodeJS?

I have a centralized server and DB that each of my devices polls every ten seconds. The centralized server may respond with a list of "active jobs", which the devices will then run. I need to ensure ...
3
votes
1answer
169 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...