Hot answers tagged

6 votes
Accepted

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source. This is obviously true for user activation tokens, since it ...
user avatar
4 votes
Accepted

nonce generation based on php session id

The protection with nonce works reliably only if content returned form server to client each time has a new nonce. Each nonce should be used only once. Where as in your approach for the same session ...
user avatar
  • 8,410
3 votes
Accepted

XSS inside of a javascript string, with unusual filter

Neat puzzle! Yes, that filter is exploitable. Attack For historical reasons, ECMAScript (aka Javascript) supports an extended syntax when run in a web browser context. One syntax feature is the ...
user avatar
  • 43.7k
2 votes

Can an empty uploaded file cause any security issues?

An empty file is not a problem by being empty, but can lead to problems down the line if the application processing it don't expect empty files. Throwing an error and stopping processing when ...
user avatar
  • 50.3k
2 votes

About vulnerability in the dependency

Regarding your first question, it is very hard to tell for sure that a vulnerability will not affect you. Even if you don't explicitly call the vulnerable function, maybe some function you call does. ...
user avatar
  • 64.2k
2 votes
Accepted

Securely transfer a file to a server via PHP

TL;DR: Either your first (FTPS) or third (SFTP) options are sound choices. There are some minor security differences between them, depending on things like whether you know the server D's public key ...
user avatar
  • 39.1k
2 votes

What can I do with a Pdf upload vulnerability on a CTF server?

Just in case and if you haven't already, spoof the MIME type - some poorly coded scripts may rely on the MIME type. What you describe doesn't seem to qualify as a vulnerability though (unless you ...
user avatar
  • 6,517
2 votes
Accepted

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

These are often known as "magic hashes", and have been found for lots of different hashing algorithms. You can find a list of them here. The easiest way to find them to to look for a hash ...
user avatar
  • 4,121
2 votes
Accepted

How do I prevent this PHP/Apache exploit?

How do I protect against this attack? There's no general answer. You obviously have some web script that allows execution of arbitrary commands. You have to figure out which script it is, based on ...
user avatar
  • 12.5k
2 votes
Accepted

Can POST request be changed in a HTTPS website?

This is not a javascript, POST or HTTPS problem, it affects all data received by a web server. Although realizing that someone might edit a URL might be easier to realize that cookies and other HTTP ...
user avatar
  • 5,700
2 votes
Accepted

Ruby on Rails: Request to http://\localhost/admin/config.php

Rails thinks the domain is "\localhost" because that's what the client asked for. In order to support virtual hosting (hosting more than one website on a single computer), HTTP since version ...
user avatar
  • 34.4k
1 vote
Accepted

Prevent reading PHP files

As you see, the settings.php can contain site-relative passwords and should not be readed(but should be normally included by include or require) You can't. You basically require that your php scripts ...
user avatar
  • 12.5k
1 vote

How to track which php file executed a malware binary

I have the same problem. Try to find "dir" file on your public folder like /var/www/. In my case I found this on my laravel website, there are file looks like this on my "public" ...
user avatar
1 vote

use md5 hashed guid as app login and REST interface

In this situation, it sounds like you're using a hash of a user ID as a credential. That's not particularly secure, because if the user ID ever leaks, then the credential is immediately known. It ...
user avatar
  • 6,950
1 vote

Getting Smaller Output From Public Key Cryptography In PHP

For RSA, the public key size determines the size of the ciphertext, and you need quite long public keys to achieve adequate security. However, there are actually quite a lot of problems with using RSA ...
user avatar
  • 39.1k
1 vote

What's The Best PHP Encryption For Email Addresses?

The difficulty here is that the web application must have access to the key in order to send emails. But if the application is breached, the attacker could obtain that key and decrypt the emails. So ...
user avatar
  • 1,048
1 vote
Accepted

Should including an external webpage in PHP be dangerous in principle?

Including external pages is just as dangerous as executing any other code sourced from the Internet (because that's exactly what you're doing). If you trust the source of the file - either because you ...
user avatar
  • 39.1k
1 vote
Accepted

Sending Post Requests Server to Server

Is this a secure model for a sever to server communication? Should I be considering other items? It's not. You are inventing a very complicated wheel after someone invented a better and simpler one ...
user avatar
  • 50.3k
1 vote

Attempting remote code execution, why does this php webshell code fail with single quotes?

Without seeing the code you're injecting into, it's hard to tell. It would be nice to see your entire payload too. To be clear, the parameter name, cmd in this case, does not need to be enclosed in ...
user avatar
  • 183
1 vote

About vulnerability in the dependency

Unknown, but it could be either vulnerable or not. You cannot rely on the description alone to determine why foo() was vulnerable. Perhaps foo() relies on an internal function like parseJson() that ...
user avatar
  • 33.6k
1 vote

How to protect client server app if both: client and server - located on client side?

Broadly speaking, you're just trying to implement DRM. DRM is fundamentally impossible to make truly secure - you can't give a user the ability to run a program / open a file / etc. without giving the ...
user avatar
  • 39.1k
1 vote

A Suitable Replacement for MCrypt?

As per the wikipedia entry: "The last update to libmcrypt was in 2007,[1] despite years of unmerged patches.[2] These facts have led security experts to declare mcrypt abandonware and discourage ...
user avatar
  • 146

Only top scored, non community-wiki answers of a minimum length are eligible