Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
64
questions with no upvoted or accepted answers
5
votes
3answers
359 views
Local file inclusion when URL is appended with .php?
During pentesting, I came across a target vulnerable to local file inclusiong:
include("$rootpath/includes/dir/".$_GET["section"].".php");
When I visit the URL
http://target.com/img?section=images ...
4
votes
0answers
259 views
Obtaining large data sets for research: MySQL, PHP, Apache, etc
I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
0answers
273 views
Is setting the Apache's TimeOut directive to 3 hours risky?
In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
2
votes
0answers
61 views
How do scanners know which apache2 modules are installed?
My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
2
votes
0answers
196 views
Does CVE-2019-0211 affect Apache w/ php-fpm?
Intro
From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019),
Apache HTTP suffers from a local root privilege escalation
vulnerability due to an out-of-bounds array access leading ...
2
votes
0answers
78 views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
2
votes
1answer
593 views
Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?
Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
2
votes
0answers
38 views
PHP static code analysis tool that follows includes (framework compatible)
I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis.
For example:
include "asdf.php"
//this is a function defined in asdf.php
echo test($...
2
votes
0answers
60 views
Disable php://filter globally or per php file
Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini:
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html
Clearly, ...
2
votes
0answers
146 views
Random Alphabetical String Added to URL
I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue:
Users have ...
2
votes
0answers
92 views
How to securely manage generating files on the client-side to download
While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript:
using data URLs
by generating the file on ...
2
votes
0answers
573 views
Why does the order of arguments to hash_equals() matter?
The documentation for PHP’s hash_equals() (a string comparison function which is safe from timing attacks) says,
It is important to provide the user-supplied string as the second parameter, rather ...
1
vote
0answers
109 views
Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?
Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
1answer
92 views
Local file inclusion to RCE
Here is the code:
<?php
$file=trim($_GET['img_name']);
//echo $file;
if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream'...
1
vote
1answer
74 views
Create a new database + user with php script — Secure
I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data.
The portal itself is another database ...
1
vote
0answers
185 views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
1
vote
2answers
140 views
Cross subdomain PHP security?
I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security?
If a user with subdomain FTP ...
1
vote
0answers
168 views
CSRF protection and Single Page Apps on hosted on S3 (with no backend.)
I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
1
vote
1answer
130 views
How to deny execution of any file on a specific directory?
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
1
vote
0answers
161 views
Problem in Cracking PHP rand() seed on windows
I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
1
vote
0answers
98 views
Conditions under which PHP path-traversal with %2e works
While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file:
<?php var_dump(file_exists(...
1
vote
0answers
731 views
php-reverse-shell in Wordpress can't connect to netcat
I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
1
vote
0answers
126 views
Choosing a more or less secure signature algorithm with very short signature length
For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app.
I would imagine to use RSA or something but the signature ...
1
vote
0answers
201 views
security breach: php file edited on codeigniter site, ubuntu server
I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
1
vote
0answers
259 views
Countermeasure for privilege escalation for TeamPass
I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal ...
1
vote
0answers
286 views
What is the difference in implementation between HybridAuth and OpenID Connect?
I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
0answers
140 views
Decryption with two-way authentication
We have a Customer who wants his sensitive user-data stored with an encryption.
These are the basic requirements:
Sensitive user-data is stored in a database using encryption
A remote-attacker who ...
1
vote
0answers
446 views
IIS | Block execution of files in directory
I am dealing with user uploads via a PHP application.
I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it.
I have set it so all ...
1
vote
0answers
3k views
Codeigniter RESTful web api creation for mobile and web applications general guidelines
I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
303 views
Secure Requests Between iOS App and PHP Server
I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
129 views
Where to save digital content and prevent sharing?
I've been inspired by the answer to the question here: Location to store an encryption key
It gave me a lot to think about.
My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
115 views
trackback spotted in multple http errors
[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php
Does ...
1
vote
0answers
2k views
Do I keep my PHP simple auth session secure enough?
I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
315 views
Implementation of different BCrypt versions
I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
1
vote
0answers
100 views
Is what flexi_auth does with its use of its $this->auth object good practice?
I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used
Like this:
`$this->auth =...
0
votes
1answer
43 views
Backend Authentication of Mobile App: Session ID vs. OAuth
Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused.
For now I am using a session ID ...
0
votes
0answers
35 views
user_roles getting deleted from wp_options table in wordpress
I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL
I am looking at the following:
select *
from wp_options opt
where option_name like '%wp_user_roles%'
order by ...
0
votes
0answers
51 views
How to Stop Cookies from Being Set
We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
0
votes
0answers
97 views
SQL Injection bypass UNION filter/restriciton
I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used.
The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
0
votes
0answers
47 views
How do i ensure that links are from OneDrive / Google Drive?
I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are ...
0
votes
0answers
42 views
Can you trace the path a file upload path without manually executing it?
In a current bug bounty target I have found an unrestricted file upload, it just shoots whatever you give it through a multipart form, that being said I have full freedom of payloads to employ, how ...
0
votes
1answer
57 views
Does PHP unserialize work with an object inside a string
serialize($_POST);
where $_POST is always an array. I have control over one of the array values, e.g. $_POST['evil']. Is the unserialize exploit possible with this kind of structure?
I coulnd't get ...
0
votes
1answer
96 views
Is my session schema vulnerable to session fixation?
I have a PHP application, where two session IDs are being used.
I will use foo and bar as example for those session IDs.
The foo session ID is being generated at the login page.
The bar session ID ...
0
votes
0answers
63 views
Is php code with such features vulnerable to RCE?
I'm participating in one bugbounty program.
This site runs on php (Apache) and uses amfphp library.
Here are the things I found I can make this library do for me:
Include (include_once call) any ...
0
votes
0answers
30 views
Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini
I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/
But I cannot use wp-cli if I do that.
Any solution please?
0
votes
1answer
93 views
Securimage php library for Captcha Code showing security issues in Arachni Scanner
I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
0
votes
0answers
244 views
XenForo website hacked through PHP shell script
My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18).
I'm not too experienced with backend stuff so I apologize if I use the wrong technical names.
...
0
votes
0answers
809 views
How to extract and verify PDF signature (PKCS7) with openssl?
I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below.
What it does is:
Extract the PKCS7 code (it works because I ...
0
votes
0answers
113 views
PHP socks proxy with no port opening
let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port.
Is there a way to do this exactly this :
create a socks proxy on ...
0
votes
0answers
492 views
Cookie issue on same server with different domain
I am using Zend framework 2 for my two applications (xyz.com and pqr.com) on the same server.
I have a problem with cookie, when I logged in into xyz.com and edit the browser cookie settings using ...
