Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
118 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
216 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
50 views

Are public paths/folder structures mean security risks for a website? [duplicate]

I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. ...
0
votes
1answer
149 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...
0
votes
0answers
144 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
1answer
138 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
0
votes
1answer
82 views

Storing server-side secret key in environment variable - is a concern?

Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
0
votes
1answer
137 views

How do I escape webapp root directory in a php website?

This is part of a old CTF question which I've had trouble solving. I'm not sure what approach to take. I'm given a single site: http://user:token@host:port/public/index.php the flag is in /tmp/flag....
2
votes
0answers
64 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
0
votes
2answers
69 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
0
votes
1answer
119 views

Is this scenario a file upload vulnerability?

I'm testing for file upload and the website has an extension and content type check (png/ jpg). But on intercepting using burp, I'm able to change the content to php code (content-type being image/png)...
2
votes
1answer
3k views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
1
vote
1answer
113 views

Is my session schema vulnerable to session fixation?

I have a PHP application, where two session IDs are being used. I will use foo and bar as example for those session IDs. The foo session ID is being generated at the login page. The bar session ID ...
0
votes
0answers
68 views

Is php code with such features vulnerable to RCE?

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library. Here are the things I found I can make this library do for me: Include (include_once call) any ...
0
votes
1answer
285 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
2answers
234 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
0
votes
1answer
188 views

How to spoof file extension when it is appended to the file name every time?

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (...
0
votes
1answer
83 views

PHP code execution attempts on an ASP website

I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
-4
votes
1answer
102 views

encrypting file and user have public key to decrypt in barcode [closed]

I want code very secure system and I need some answers and help. Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it. I've thinking of ...
-1
votes
1answer
136 views

Unknown code on my website comments [closed]

During the last few weeks, I often find on my website these "Comment": {"name":"BryantFlogy","email":"cgorillamail@gmail.com","message":"Hi, htmlkurss.xyz \r\n \r\nI&#39;ve been visiting your ...
0
votes
1answer
769 views

Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)

I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...
4
votes
1answer
114 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
0
votes
1answer
514 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
1answer
232 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
0
votes
1answer
410 views

Bypassing password authentication in example PHP

I have pseudocode of the following script: $pass = '...'; $answer = '....' extract($_GET); if (($inp)) { if ($inp === get_contents($pass)) { return $answer } else { echo ...
1
vote
2answers
736 views

PHP password_hash (bcrypt) vs sha-3 [duplicate]

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The ...
3
votes
1answer
175 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
2
votes
0answers
209 views

Does CVE-2019-0211 affect Apache w/ php-fpm?

Intro From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading ...
2
votes
1answer
236 views

Found malware in my Wordpress, what is it and what it does? [closed]

Recently I found strange file inside Wordpress sources directory of a page I have written and I am maintaining. It was a luck case. I deploy my sources from git so when I typed git status on a server ...
1
vote
0answers
260 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
3answers
547 views

After running a string through mysqli_real_escape_string, is it safe to remove the backslash before echoing it into a page?

I'm using a rich text editor (Nicedit) with a cms project I'm making. In order to reduce the likelihood of SQL injections, I'm using the mysqli_real_escape_string function to escape the user input ...
0
votes
1answer
152 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
-1
votes
1answer
69 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
31 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
1answer
133 views

Is a “logged_in” session flag secure enough?

Is the code below enough to secure a login area? <?php if ($_SESSION['logged_in']) { // show content for logged-in users } Note: $_SESSION['logged_in'] is just a boolean value true after ...
0
votes
0answers
20 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
0
votes
1answer
43 views

`$_GET[1]`; payload why work in php short tag only? [closed]

when I try to use this payload: <?= `$_GET['1']`; ?> it works in php-short-tag but when I do this: <?php `$_GET['1']`; ?> it's not working, and give me blank page. Can anyone explain ...
7
votes
1answer
371 views

Can I inject a shell command here in PHP?

During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec() $arg = $_GET['arg']; // sanitization, I suppose... if(...
0
votes
1answer
141 views

Securimage php library for Captcha Code showing security issues in Arachni Scanner

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
0
votes
1answer
78 views

How do I create comparable security to PHPmyadmin?

I have a website hosted by netfirms, and phpmyadmin is part of the package. It's a very powerful general tool, but it takes a while to load and there are some very long and specific tasks I need to ...
0
votes
2answers
330 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
0
votes
1answer
355 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
0
votes
0answers
376 views

XenForo website hacked through PHP shell script

My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18). I'm not too experienced with backend stuff so I apologize if I use the wrong technical names. ...
2
votes
0answers
86 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
0
votes
1answer
71 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
0
votes
1answer
118 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
2
votes
1answer
75 views

PHP Code execution in function parameters and logical operators [closed]

After wondering about this and trying to better understanding, I tried the folowing code: is_string(3 and sleep(30)); Why PHP will execute code inside a parameter function (sleep in is_string) ? ...
2
votes
1answer
861 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
0
votes
0answers
1k views

How to extract and verify PDF signature (PKCS7) with openssl?

I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below. What it does is: Extract the PKCS7 code (it works because I ...
0
votes
2answers
178 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...

1 2
3
4 5
29