Skip to main content
4 votes

Can Hacker Post data through GET request?

The provided GET request appears to contain a payload that is attempting to execute malicious activities on a web server. Let's break down the elements of this payload: @ini_set("display_errors&...
GRAJA risha's user avatar
3 votes
Accepted

Is it secure to save a salt in session variables

Salt helps defend against attacks that use precomputed tables (source) You can store it in the session data ... but there is really no need to do so. It should be stored along side the hashed ...
CaffeineAddiction's user avatar
3 votes
Accepted

How to sanitize $_SERVER url variables?

This approach doesn't make sense. Cross-site scripting is an output problem, not an input problem. The vulnerability consists of inserting a string (which currently happens to be the referrer header) ...
Ja1024's user avatar
  • 9,170
2 votes
Accepted

How dangerous is this suspicious PHP code?

The first three lines create an array, with automatically incrementing indices, similar to this: $hello_dolly[0]='b8f878fc41d0fd3c'; $hello_dolly[1]=$_POST; $hello_dolly[2]='color'; This line: $dolly ...
Sjoerd's user avatar
  • 30.9k
2 votes

Backdoor:PHP/Webshell.O virus detected in an uploaded image file. Should I be worried? How can I prevent it?

Yes, you should be worried. Depending on how exactly the web server is configured, an attacker may be able to trick it into executing code embedded in images, e.g., with a PATH_INFO attack or with a ...
Ja1024's user avatar
  • 9,170
1 vote

Clamav can't detect encoded virus files

ImunifyAV is free and can possibly detect these types of malicious PHP code and uses low resources. I tried clamav-unofficial-sigs and this signature detected that pattern successfully, but clamav-...
Edgar Ortigoza's user avatar
1 vote

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover

If your goal is just takeover of the site, not necessarily the actual server, you have one obvious option: steal the TLS private key (it'll be somewhere the server can read; there's ways to avoid that ...
CBHacking's user avatar
  • 49.2k
1 vote

Can I set session time to 10 days without risking security issues?

is there any security risk to doing this? If your application is used from a business where people lock their computers, there's negligible risk in having longer session timeouts. If your application ...
Sjoerd's user avatar
  • 30.9k
1 vote

Can I set session time to 10 days without risking security issues?

Setting a long session duration isn't inherently insecure. The reason why sessions are typically short-lived is because many applications do use them for user authentication, and in this case, the ...
Ja1024's user avatar
  • 9,170
1 vote
Accepted

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Not dangerous at all. That rule is almost as bad as https://thedailywtf.com/articles/Injection_Rejection is. It will block a lot of legitimate things, and unless there's a vulnerability in your ...
Joseph Sible-Reinstate Monica's user avatar
1 vote

Server Side Request Forgery Vulnerability Question

In addition to what Steffen's comment mentions, you should note that there's no sign whatsoever of SSRF here. That is, the server does not, at any point, appear to making its own request; instead, it ...
CBHacking's user avatar
  • 49.2k
1 vote

SQL Lite Injection via CSS URL

tl;dr: I would expect this to be a false positive related to caching (which doesn't require a fix), not an SQLi. But it's definitely something to follow up on with the testers as well as the devs. A ...
tim's user avatar
  • 29.6k
1 vote
Accepted

Secure Serving of File Uploads on PHP Server without Root Config Possibilities? (Apache)

You don't need root access for any of that. If you are using PHP, you can use move_uploaded_file to send the file you receive from the client to any directory you have access, including somewhere ...
ThoriumBR's user avatar
  • 54.5k
1 vote

How to detect malicious files or web shell on a vps web server

Despite the fact we have grown accustomed to multiple vendors selling us stuff which will detect bad things, it is surprisingly difficult to do and limited in its abilities. While malware detection ...
symcbean's user avatar
  • 18.7k

Only top scored, non community-wiki answers of a minimum length are eligible