Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
41 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
1
vote
1answer
198 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
0
votes
1answer
61 views

Remotely included script cannot set session variables

I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging ...
0
votes
1answer
263 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
2
votes
0answers
38 views

PHP static code analysis tool that follows includes (framework compatible)

I have been looking for a PHP taint analysis tool, or a PHP parser that can include files within its analysis. For example: include "asdf.php" //this is a function defined in asdf.php echo test($...
0
votes
1answer
53 views

What is a secure way to use PHP tokens in a C# application

I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if ...
0
votes
1answer
35 views

What characters that are converted when running PHP on IIS?

I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload I saw this statement: Finding characters that are converted to other useful ...
3
votes
4answers
300 views

Can valid PHP be written and executed in non-ascii character encodings?

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii. ...
-4
votes
1answer
98 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
-1
votes
1answer
137 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...
2
votes
3answers
491 views

PHP - Needing help to encrypt/hash a password for small application

I have created a small script for work. It's an internal web script but has to be hosted on our public domain so I have created a very small PHP based login system using a login form and a session ...
2
votes
0answers
71 views

Disable php://filter globally or per php file

Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini: allow_url_fopen = Off allow_url_include = Off open_basedir = /var/www/html Clearly, ...
0
votes
2answers
147 views

Php parameters (username, password) in link

Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time. I was examining a web site on a remote server and i saw something like; www.myurl.com/login....
3
votes
3answers
2k views

How to deny access to my server end points ? (PHP)

I've developed some software installed e.g. on www.example.com. It's accessed via an HTML web page. Some HTML buttons can call PHP end points which are also on that domain. I use JWT to secure login. ...
3
votes
1answer
2k views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
1
vote
0answers
184 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
-1
votes
1answer
498 views

Using SQL to compare hashed passwords

Setup A LAMP system (Linux, Apache, MySQL, PHP). Access to db is over the loopback interface (maybe not in the future - dependent on hosting solution). The db contains a table with the username, ...
-3
votes
1answer
873 views

How To detect Fake mobile number for SMS verification [closed]

I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info How to detect the number is ...
0
votes
1answer
193 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
2
votes
1answer
324 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
0
votes
4answers
162 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
0
votes
1answer
48 views

Best strategy to share some sensitive user data between Node and PHP

I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
2
votes
2answers
83 views

Protect a page from email collectors

I'm creating a page where a customer can edit their order before they pay for it. The page will delete as soon as the order is paid for, but what's the best way to protect against email/phone number ...
2
votes
1answer
330 views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
5
votes
2answers
673 views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
1
vote
1answer
239 views

Javascript asymmetric password-based encryption

I want to code a web app that allows 2 users to send encrypted messages to each other, and I want to maximize security, so I want to minimize the amount of trust I put in my cloud provider (both the ...
0
votes
1answer
66 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
0
votes
1answer
421 views

My site was hacked and has injected code on index.php and 404.php [duplicate]

Here is the code injected to index.php if(@isset($_GET[bots])){ echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="...
0
votes
2answers
404 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
2answers
68 views

Are contents of PHP sessions forensically valuable?

PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/...
0
votes
1answer
2k views

How exploiting RCE in jpg file actually works?

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct. <?php $test = array('image/jpeg', '...
0
votes
1answer
70 views

RxR__kyfet.php - Found this in the Root of my site's directory. What does it do? [duplicate]

While going through the root directory of my site I found this RxR__kyfet.php file. This is a wordpress site. I don't know php well enough to tell exactly what it does but it seems rather suspicious. ...
0
votes
2answers
230 views

Check for vulnerabilities on website having an error with realpath PHP

I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
2
votes
1answer
635 views

How could a hacker access my Wordpress admin area?

I have two sites which appear to have been hacked. I checked the access logs and found these log entries: "GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/...
0
votes
4answers
200 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
1answer
880 views

Integrate PHP and WebSocket authentication securely

I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your ...
2
votes
2answers
471 views

Revealing IP of an email recipient using remote PHP script or pixel tracking

I read through the search items and similar threads but my query is rather specific. I know it's possible to reveal IP of an email recipient if we can get the person to click on an attached image or ...
5
votes
1answer
7k views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
2
votes
2answers
371 views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
2
votes
1answer
5k views

Command injection — filtering bypass

I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id However the ...
-2
votes
1answer
399 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
2
votes
2answers
296 views

If the cypher-text, plain-text and nonce is known, can the secret key be determined?

I'm using the sodium_crypto_secretbox and sodium_crypto_secretbox_open functions in PHP (currently PHP 5.6, using paragonie/sodium_compat). If a user has cypher text, nonce and decrypted plain text, ...
8
votes
1answer
1k views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
1
vote
1answer
312 views

How to reverse engineer str_shuffle (PHP) to get its mt_rand outputs

$output = str_shuffle("12345"); E.g. $output is now 25134 How do I find out what numbers came out of mt_rand() to allow for the shuffle I want to know this because I want the seed of mt_rand() and ...
0
votes
1answer
78 views

What is the function call for escaping `php` in php

So I'm working on a boot to root and I think I may have found a section that I can inject php. The problem is when I inject my php it gets commented out. I'm trying to find what function this is so I ...
0
votes
1answer
267 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
2answers
1k views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
7
votes
2answers
5k views

How does password_hash/password_verify in php work?

Why does this example from the PHP manual give different results every time it runs? echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT); And then, password_verify() knows that ALL those hash ...
2
votes
1answer
601 views

Why has salt option been deprecated as of PHP 7.0.0?

http://php.net/manual/en/function.password-hash.php Is that less secured ? echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT); => $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K ...