Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

Filter by
Sorted by
Tagged with
2
votes
1answer
396 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
0
votes
4answers
163 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
0
votes
1answer
51 views

Best strategy to share some sensitive user data between Node and PHP

I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
3
votes
2answers
87 views

Protect a page from email collectors

I'm creating a page where a customer can edit their order before they pay for it. The page will delete as soon as the order is paid for, but what's the best way to protect against email/phone number ...
2
votes
1answer
400 views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
5
votes
2answers
810 views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
1
vote
1answer
262 views

Javascript asymmetric password-based encryption

I want to code a web app that allows 2 users to send encrypted messages to each other, and I want to maximize security, so I want to minimize the amount of trust I put in my cloud provider (both the ...
0
votes
1answer
68 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
0
votes
1answer
503 views

My site was hacked and has injected code on index.php and 404.php [duplicate]

Here is the code injected to index.php if(@isset($_GET[bots])){ echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="...
0
votes
2answers
443 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
2answers
75 views

Are contents of PHP sessions forensically valuable?

PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/...
0
votes
1answer
2k views

How exploiting RCE in jpg file actually works?

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct. <?php $test = array('image/jpeg', '...
0
votes
1answer
76 views

RxR__kyfet.php - Found this in the Root of my site's directory. What does it do? [duplicate]

While going through the root directory of my site I found this RxR__kyfet.php file. This is a wordpress site. I don't know php well enough to tell exactly what it does but it seems rather suspicious. ...
0
votes
2answers
265 views

Check for vulnerabilities on website having an error with realpath PHP

I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
2
votes
1answer
662 views

How could a hacker access my Wordpress admin area?

I have two sites which appear to have been hacked. I checked the access logs and found these log entries: "GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/...
0
votes
4answers
275 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
1answer
1k views

Integrate PHP and WebSocket authentication securely

I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your ...
2
votes
2answers
523 views

Revealing IP of an email recipient using remote PHP script or pixel tracking

I read through the search items and similar threads but my query is rather specific. I know it's possible to reveal IP of an email recipient if we can get the person to click on an attached image or ...
6
votes
2answers
9k views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
2
votes
2answers
437 views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
2
votes
1answer
6k views

Command injection — filtering bypass

I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id However the ...
-2
votes
1answer
439 views

How to secure PHP code for uploading avatar images?

I can bypass an avatar upload image verification process and upload a PHP file or any other extension binding a valid jpeg image. This is the code: if ($image->valid()) { $mimeType = $...
2
votes
2answers
315 views

If the cypher-text, plain-text and nonce is known, can the secret key be determined?

I'm using the sodium_crypto_secretbox and sodium_crypto_secretbox_open functions in PHP (currently PHP 5.6, using paragonie/sodium_compat). If a user has cypher text, nonce and decrypted plain text, ...
8
votes
1answer
2k views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
1
vote
1answer
356 views

How to reverse engineer str_shuffle (PHP) to get its mt_rand outputs

$output = str_shuffle("12345"); E.g. $output is now 25134 How do I find out what numbers came out of mt_rand() to allow for the shuffle I want to know this because I want the seed of mt_rand() and ...
0
votes
1answer
78 views

What is the function call for escaping `php` in php

So I'm working on a boot to root and I think I may have found a section that I can inject php. The problem is when I inject my php it gets commented out. I'm trying to find what function this is so I ...
0
votes
1answer
298 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
2answers
1k views

Execute an uploaded php script on a vulnerable server if I know it's location? [closed]

I need to test a website and I found a vulnerable file upload. It is only checked whether or not the file extension is .jpg, .png or .pdf. I can bypass this by uploading a file named script.php.jpg. I ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
8
votes
2answers
6k views

How does password_hash/password_verify in php work?

Why does this example from the PHP manual give different results every time it runs? echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT); And then, password_verify() knows that ALL those hash ...
2
votes
1answer
677 views

Why has salt option been deprecated as of PHP 7.0.0?

http://php.net/manual/en/function.password-hash.php Is that less secured ? echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT); => $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K ...
2
votes
1answer
216 views

Is this code vulnerable to a CSRF attack?

I am utilizing tokens to protect from a CSRF attack but to make the "back" button still work I reuse old tokens if they are set. Does this still provide CSRF protection or can an attacker just set ...
-1
votes
1answer
109 views

Secure PHP coding without frameworks

I am very new to PHP and some people said that writing PHP code without a framework is insecure. I am not sure about that! Is it possible to write highly secure code without any frameworks? If so, ...
3
votes
2answers
1k views

What harm could malicious PHP code cause?

What harm can virus sites that contain malicious PHP code cause? What is an example of a piece of PHP code that could potentially harm your computer or steal information? I know that most if not all ...
2
votes
0answers
221 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
1
vote
2answers
2k views

Is it possible to include a PHP Function while performing SQL Injection?

Consider this code: ?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit Will this work out? SQL Query: if(isset( $_GET[ 'submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check ...
1
vote
1answer
146 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
0
votes
2answers
728 views

Source Code analysis tools available? [closed]

In the near future I have to check the source code of a web application on security vulnerabilities. The web application mainly consists of PHP files and contains more than 300 files. Do you know ...
0
votes
1answer
4k views

Cookie stealing with Redirection

I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like http://...
6
votes
2answers
1k views

How to store nonce and key when working with libsodium secretbox?

Why am I asking? I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
3
votes
1answer
1k views

Is using `file_get_contents` on a URL with concatenated parameters secure?

I'm auditing some PHP code for a friend, and there are a couple of file_get_contents usages for GETting URLs where the user-supplied parameters are concatenated without any escaping, e.g.: function ...
1
vote
1answer
59 views

Bash wildcards - Manipulate globbing to delete arbitrary files

I am currently auditing a plugin and have the following situation (simplified for example purposes): <?php $post_id = false; $absolute_path = "/var/www/html/wordpress/cache"; $extension = ".min....
1
vote
1answer
48 views

MVC - Dynamic Routing potential security problem?

Is dynamic routing as described on https://www.sitepoint.com/the-mvc-pattern-and-php-2/ a potential security problem? Implementation <?php $model = $_GET['model']; $view = $_GET['view']; $...
1
vote
1answer
142 views

Islanding vs server lockdown

TL;DR: We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
1
vote
1answer
599 views

analyzing hacked website log : is there any link between ./etc and ./tmp when uploading files? [closed]

One of my friends got hacked and asked me for help. This guy had a single shared host and uploaded like 20 websites on it and one of them got hacked and now all of them are full of shells. I asked ...
3
votes
1answer
261 views

protection from Backdoor hacks from disgruntled developer/ employee

I created a ecommerce site with a developer. He completed almost all his work but in the end we had some financial disagreements so our partnership ended in a bitter dispute. That developer threatened ...
-1
votes
1answer
385 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
6
votes
3answers
474 views

Local file inclusion when URL is appended with .php?

During pentesting, I came across a target vulnerable to local file inclusiong: include("$rootpath/includes/dir/".$_GET["section"].".php"); When I visit the URL http://target.com/img?section=images ...
4
votes
2answers
4k views

Can Someone Fake A PHP Session Variable

I have a site where a user can create an account and log in. When the user logs in, after I validate the user's password and username, I give them a PHP session variable containing their username. ...
3
votes
1answer
516 views

Is allow_url_fopen always a security risk?

Is allow_url_fopen always a security risk or only when you let others to insert URL? like when you want to set video stream links from your another server, and the only way to add new URL is from your ...

1
3 4
5
6 7
29