Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
1
vote
1answer
47 views

MVC - Dynamic Routing potential security problem?

Is dynamic routing as described on https://www.sitepoint.com/the-mvc-pattern-and-php-2/ a potential security problem? Implementation <?php $model = $_GET['model']; $view = $_GET['view']; $...
1
vote
1answer
136 views

Islanding vs server lockdown

TL;DR: We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
1
vote
1answer
565 views

analyzing hacked website log : is there any link between ./etc and ./tmp when uploading files? [closed]

One of my friends got hacked and asked me for help. This guy had a single shared host and uploaded like 20 websites on it and one of them got hacked and now all of them are full of shells. I asked ...
3
votes
1answer
252 views

protection from Backdoor hacks from disgruntled developer/ employee

I created a ecommerce site with a developer. He completed almost all his work but in the end we had some financial disagreements so our partnership ended in a bitter dispute. That developer threatened ...
-1
votes
1answer
367 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
5
votes
3answers
361 views

Local file inclusion when URL is appended with .php?

During pentesting, I came across a target vulnerable to local file inclusiong: include("$rootpath/includes/dir/".$_GET["section"].".php"); When I visit the URL http://target.com/img?section=images ...
4
votes
2answers
3k views

Can Someone Fake A PHP Session Variable

I have a site where a user can create an account and log in. When the user logs in, after I validate the user's password and username, I give them a PHP session variable containing their username. ...
3
votes
1answer
372 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...
2
votes
1answer
91 views

Protecting WordPress from a single machine DoS (either in network/web level)?

I use a DigitalOcean Ubuntu 16.04 machine with Bash, LEMP and WordPress. I already did the best I can to protect the system and WordPress from BFAs and Backdoors, and to protect WordPress from DB ...
2
votes
1answer
120 views

Are these cryptographic methods along the right track?

I know we should never "roll our own crypto," but I want to understand the inner workings. I've written the following two encryption/decryption functions in PHP: function encrypt($message) { $...
3
votes
2answers
2k views

Is PHP OpenSSL safer than just using MySQL AES_ENCRYPT/DECRYPT alone?

I wish to encrypt/decrypt data in my MySQL database stored on my server. I use a salted hash for my passwords. All encryption/decryption would occur on the server. I use PHP end points which my remote ...
1
vote
3answers
4k views

How to decrypt a password for recovery with php [duplicate]

I have a website that people can sign up for and sign in to. I would like to implement a password recovery system that sends you the decrypted password. When the user signs up, the password is salted ...
1
vote
0answers
161 views

Problem in Cracking PHP rand() seed on windows

I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
4
votes
1answer
940 views

Trying to understand what this PHP malware does [closed]

My server has been hacked recently and the hacker has uploaded multiple malicious source code to the web server. I have already de-obfuscate the code, but I still don't understand what it does. It ...
0
votes
1answer
877 views

What web servers are affected by this user agent exploit?

I found this user agent logged in one of my websites: Array ( [IPaddress] => 115.89.123.121 [userAgent] => }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}...
1
vote
2answers
848 views

Can someone view the contents of my .htaccess file

I am storing hashed passwords in a file called passwords.htaccess. When a user fills out a login form, the passwords are checked. I am getting the contents of passwords.htaccess with file_get_contents(...
4
votes
1answer
970 views

How do I decode this hacker payload?

A hacker submitted this via apache $_SERVER["HTTP_IF"]: http://localhost/aaaaaaa潨硣睡焳椶䝲稹䭷佰畓穏䡨噣浔桅㥓偬啧杣㍤䘰硅楒吱䱘橑牁䈱瀵塐㙤汇㔹呪倴呃睒偡㈲测水㉇扁㝍兡塢䝳剐㙰畄桪㍴乊硫䥶乳䱪坺潱塊㈰㝮䭉前䡣潌畖畵景癨䑍偰稶手敗畐橲穫睢癘扈攱ご汹偊呢倳㕷橷䅄㌴...
2
votes
2answers
288 views

Single or double quotes in PHP?

In general which is safer to use, with regards to XSS evasion in particular? echo '<input name="'.$input_name.'">'; echo "<input name='$input_name'>"; I'm guessing single quotes, but ...
3
votes
1answer
333 views

Is it a security risk to be using Doctrine1 today, as the PHP Library has not been updated in 8 years?

We have an application that is running Doctrine1 and it would be a VERY large undertaking to upgrade from Doctrine1 to the current Doctrine3 (essentially a complete rewrite). From a security ...
5
votes
2answers
1k views

Is an AJAX call less secure than the normal POST method?

I currently have a standard login form like this: <?php if( isset( $_POST['username], $_POST['password'] ) ) { // escape both strings and compare them to database } ?> <form action="" ...
-1
votes
1answer
533 views

Is an undefined index PHP error a vulnerability?

I found a website with the error below: Notice: Undefined index: welcome in /var/www/html/blah/index.php on line 14 Is that a vulnerability?
0
votes
2answers
800 views

SQL injection via update statement

I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials admin. The main page does not seem to be vulnerable to SQL injection but the forgot ...
2
votes
4answers
7k views

Simple SQL injection to bypass login in MariaDB

I'm trying out SQL Injection on my localhost. I have a simple HTML form, with a username, password and a submit button. So after clicking on the submit, user is redirected from login.html to a page ...
0
votes
1answer
283 views

Would this be secure enough? (ZF3 & Doctrine module using halite)

Recently PHP7.2 was released with the Sodium library included for encryption. Of course there were already encryption modules available, even working with Zend Framework 2 or Symfony. We were in ...
-1
votes
1answer
52 views

What character may cause to escape the left or right part of STRING?

Question 1) in PHP when we check: dir1/dir2/../file.txt ====(this is same as)=====> dir1/file.txt is something like this possible: file_get_contents('/home/path/' . $_GET['evil']. '/file....
1
vote
0answers
47 views

Malicious code found in Wordpress theme [duplicate]

I found the following code in a child theme's functions.php Even if you delete it it re-generates automatically if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($...
0
votes
2answers
210 views

Why does Kaspersky warn me about PHP trojans on a Mac?

I have a question regarding PHP Trojans on a Mac. I have downloaded a website's home directory which has been hacked to my local Mac. On this Mac I am running Kaspersky Internet Security which ran a ...
3
votes
0answers
275 views

Is setting the Apache's TimeOut directive to 3 hours risky?

In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
7
votes
1answer
612 views

Is this use of PHP eval() exploitable?

During a code review, I have found something similar to this: function foo() { $a = "a"; $expression = '$_GET["$a"]'; return eval('return ('.$expression.');'); } $a = foo();...
7
votes
2answers
257 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
0
votes
2answers
457 views

How is a random salt derived from output of password_hash(), given that hashing functions are deterministic?

Regarding the PHP function password_verify(), how is the "unhashed" random salt derived from the output of password_hash(), given that hashing functions are deterministic? It seems to me that, if the ...
-4
votes
1answer
739 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
0
votes
1answer
215 views

PHP - Does password_hash/Argon2i effectively truncate passwords after certain length?

If I'm not wrong, by default PHP's password_hash with PASSWORD_ARGON2I outputs a 43-character alphanumeric hash among other things. While this means that simple passwords that are shorter than 43 ...
27
votes
8answers
8k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
2
votes
1answer
441 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
1
vote
1answer
200 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
0
votes
3answers
276 views

How smart is storing passwords and usernames in files?

So, I wanted to make a login system with PHP, and basically what it would do would be to have a file for usernames and a file for passwords so when a user tries to log in, it just gets information ...
1
vote
0answers
37 views

How to get desired output from salt? [closed]

If you wanted to get a specific output from php's $salt. function, how would you do this. By this I mean, If you know $salt."some_value" gives you desired_value, how do you find that some_value, if ...
2
votes
1answer
708 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
4
votes
1answer
3k views

Exploit LFI bug when a “.inc.php” is appended to the file name?

I'm trying to exploit a LFI bug. My link looks like this: http://example.com/challenge/mypage.php?page=test When I put /etc/passwd instead of test it shows me: Warning: include() [function....
1
vote
0answers
98 views

Conditions under which PHP path-traversal with %2e works

While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file: <?php var_dump(file_exists(...
-1
votes
1answer
82 views

Can this be bypassed with SQL Injection?

This is my php code: $uname = $_POST['username']; $pwd = md5($_POST['password']); $sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'"; My friend gave me this code but I’d ...
1
vote
1answer
3k views

How can I prevent XSS on a $_POST input?

I already followed the suggestion here and added: /* Prevent XSS input */ $_GET = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING); $_POST = filter_input_array(INPUT_POST, ...
1
vote
0answers
98 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
1
vote
1answer
3k views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
8
votes
3answers
3k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
0
votes
1answer
102 views

Email in database security vs performance [closed]

I have to secure a B2B web application data in a MySQL database, currently the user register his data are like that : Last name (Plain text) First name (Plain text) Email (Plain text and indexed) ...
0
votes
1answer
840 views

Array in HTTP GET/POST requests

In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes ...
0
votes
1answer
75 views

Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

How can I send an encrypted file from a server to a client, encrypt and use it in the client without risking the user to access it? I saw an answer where the server saved a file in its memory, and ...
0
votes
1answer
113 views

What could be done with web shell on unrooted android device?

Is it possible to control unrooted android device through a web shell? I've been trying to execute various php shells but the whole response is error statements like this php is installed and all ...