Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
30 views

Is there any quick or automated to way to check the version of PHP running on a remote server?

Currently running a vulnerability assessment. However, the IP I was provided is a load balancer and the client only wants to test one of the sites running on the load balancer. The vulnerabilities I ...
1
vote
1answer
145 views

Did PHP's rand() get better?

I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change? In case it still does, I am using Fedora 32. PHP states in ...
0
votes
1answer
136 views

Is my code safe enough to be publish on the server side? [duplicate]

I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code: Get the ID for choosing the Value ...
2
votes
1answer
87 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
0
votes
3answers
133 views

Php intermediate shell [closed]

Is there any way that i can use the compromised website as the shell What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
1
vote
2answers
46 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
2
votes
1answer
887 views

Missing HTTPOnly Cookie Attribute in Laravel 7 [duplicate]

I have a Laravel site, I thought I patched this issue already. I got these in my session.php 'secure' => true, 'http_only' => true, But OpenVas still detected that I still need to it. It ...
0
votes
1answer
68 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
0
votes
1answer
207 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
0
votes
1answer
145 views

I obfuscated my commercial software, i lost source [closed]

A VERY bad problem. I obfuscated my web software with srcProtector and i archieved files, i uploaded a new version of software on the website. The problem is i forgot to copy files in a new path for ...
0
votes
0answers
19 views

How can I prevent my server from receiving requests for a modified application? [duplicate]

I am developing an android application and in the future also for IOS, and I use a server in PHP. Is it possible for my server to know the source of the application sending the requests? For example,...
1
vote
1answer
287 views

What is the best file permission for .user.ini in hosting folder?

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
0
votes
2answers
279 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
0
votes
3answers
439 views

All 4 WP sites hosted in A2 Hosting were hacked

The hack redirects all my sites to another site All are running WP 5.4.1 (latest) and I even have a site that barely runs any plugins, just a simple open-source theme with 3 common plugins - Contact ...
1
vote
1answer
246 views

My WP site just got hacked for the third time even after following WP hardening guidelines

After the second hack, we did all the necessary things written here - https://wordpress.org/support/article/hardening-wordpress/ , https://security.stackexchange.com/a/180925 and we also changed the ...
1
vote
1answer
221 views

Why does OpenVAS warn about PHP 5 when I am running PHP 7?

OpenVAS found a vulnerability where it points to PHP versions 5.4.3 and 5.3.13. But both the two hosts I checked with OpenVAS are running PHP 7.2.x. Would this vulnerability be a false positive? High ...
1
vote
3answers
276 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
0
votes
0answers
49 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
1
vote
1answer
162 views

Is XSS possible when using htmlspecialchars and https prefix check in href?

There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example: <a href="javascript:alert(42);">please clickme</...
1
vote
0answers
90 views

Is it possible to exploit php curl? [duplicate]

I have been working on a project and I wonder if it's possible to exploit curl_exec function while in PHP. Scenario: I have the PHP script that checks a domain for me, but the curl is not secured, ...
0
votes
1answer
74 views

How to find PHP filename and ID of the URL?

.htaccess is now a very common URL rewrite to make it SEO friendly and cover the database IDs. What are the ways to explore php file on the server given to URL via .htaccess? Example : The URL is ...
0
votes
1answer
55 views

Am I missing something in regards to using third-party PHP libraries? [duplicate]

I "minimally trust" the PHP and PostgreSQL projects to provide non-compromised binaries of their respective programs, which I both depend on. This means that I trust them in the sense that I have no ...
27
votes
12answers
7k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
1
vote
0answers
30 views

Is there such a thing as “parameterized terminal commands”?

Long ago, I used to do SQL queries like: SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1; This was horribly scary and I probably messed it up by ...
-4
votes
3answers
65 views

Why is using prepared statements in PHP considered best practice?

Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story. I think most people agree with the idea that using prepared ...
1
vote
0answers
206 views

What is the approach to working on this?

I have a question I am working on with regards to PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php. My train of thoughts is that the following ...
0
votes
2answers
83 views

Is it safe to save a user's email into php session variable for later use?

I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link ...
0
votes
2answers
838 views

Installing xampp on virtual box?

I started learning PHP and I wanted to practice PHP code using xampp or wamp server. But after reading this and doing some google research,I thought that installing server software on my home pc ...
3
votes
3answers
178 views

Is SQL injection still a bad thing if the user is restricted to non-harmful queries?

Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table. To prevent a user ...
0
votes
1answer
333 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
1
vote
1answer
99 views

CVE-2020-5250 php vulnerability analysis

I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the ...
3
votes
1answer
68 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...
1
vote
1answer
908 views

There seems to have been an attempt to attack my website [duplicate]

I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious. I wonder what kind of attack the attacker attempted. The attacker ...
0
votes
1answer
88 views

A New Blog Post is showing on top of my home page from Unknown user cyberanon - How to Remove the post? [closed]

I have just launched our brand new blog website (php/mysql). I don't have any idea about cyber security. Yesterday we published a topic on coronavirus vaccine. I just noticed a new post is sitting on ...
1
vote
1answer
100 views

In a website that gives awards, is there anyway to ensure that one user isn't abusing the website and replaying the game by switching emails?

I'm building a website that gives awards to users. After each game I ask the user for their email and send them an email to claim their gift. Is there anyway to make sure that one user isn't simply ...
0
votes
2answers
162 views

Insecure File Upload on WebApps [closed]

I found a website where I can upload any file I want. Now what are the biggest threats for them if they didn't install PHP (so a php shell can be uploaded, but it won't execute)? I found no sign of ...
2
votes
0answers
59 views

Using a fix $key and variable $data vs partially variable $key with fixed $data in PHP's hash_hmac()

This question was originally asked in stack overflow, but it was suggested to ask it here as well.. not looking to improve on hash_hmac functionality. I'm rather interested in the $uri in the ...
0
votes
2answers
182 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
1
vote
0answers
209 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
1
vote
1answer
73 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
1
vote
0answers
273 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
0
votes
1answer
113 views

Unnecessary SSL encryption in API?

Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption. The server recieves POST request with two parameters: Action (int value) Data (base 64 ...
0
votes
1answer
78 views

Injecting script from outside for local machine url request

I have setup a local apache server with php module.I deployed a dvwa in my localmachinne..I am learning about XSS(DOM) type of attack.I setup the low level security in dvwa.When i added <script>...
0
votes
1answer
61 views

Does hiding php error messages increase security of the web app? [duplicate]

Many PHP frameworks such as Codeigniter on production environment opt-out to hide any PHP related error message. Also, that applies on other PHP frameworks as well such as Symphony and Laravel (with ...
1
vote
0answers
366 views

How to abuse eval() in PHP

I'm trying to bypass a page that has an eval() and it works like this: POST /anything.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 ...
0
votes
0answers
31 views

Determine the type of encryption used [duplicate]

I am trying to determine the type of encryption used for a site whose password is stored in the database. The site is built using the fuelphp. It has the password of the form (...
2
votes
2answers
1k views

SQL injection using URL query string (web application/php server)

Hacker is trying to attack the site by using the following SQL injection query to get the SQL version. Using URL site. example: www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
3
votes
1answer
706 views

Protect public(?) API endpoints

I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...

1
2
3 4 5
31