6
votes
Accepted
Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?
As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source.
This is obviously true for user activation tokens, since it ...
- 13.9k
4
votes
Accepted
nonce generation based on php session id
The protection with nonce works reliably only if content returned form server to client each time has a new nonce. Each nonce should be used only once. Where as in your approach for the same session ...
- 8,410
3
votes
Accepted
XSS inside of a javascript string, with unusual filter
Neat puzzle! Yes, that filter is exploitable.
Attack
For historical reasons, ECMAScript (aka Javascript) supports an extended syntax when run in a web browser context. One syntax feature is the ...
- 43.7k
2
votes
Can an empty uploaded file cause any security issues?
An empty file is not a problem by being empty, but can lead to problems down the line if the application processing it don't expect empty files.
Throwing an error and stopping processing when ...
- 50.3k
2
votes
About vulnerability in the dependency
Regarding your first question, it is very hard to tell for sure that a vulnerability will not affect you. Even if you don't explicitly call the vulnerable function, maybe some function you call does. ...
- 64.2k
2
votes
Accepted
Securely transfer a file to a server via PHP
TL;DR: Either your first (FTPS) or third (SFTP) options are sound choices. There are some minor security differences between them, depending on things like whether you know the server D's public key ...
- 39.1k
2
votes
What can I do with a Pdf upload vulnerability on a CTF server?
Just in case and if you haven't already, spoof the MIME type - some poorly coded scripts may rely on the MIME type. What you describe doesn't seem to qualify as a vulnerability though (unless you ...
- 6,517
2
votes
Accepted
Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?
These are often known as "magic hashes", and have been found for lots of different hashing algorithms. You can find a list of them here.
The easiest way to find them to to look for a hash ...
- 4,121
2
votes
Accepted
How do I prevent this PHP/Apache exploit?
How do I protect against this attack?
There's no general answer. You obviously have some web script that allows execution of arbitrary commands. You have to figure out which script it is, based on ...
- 12.5k
2
votes
Accepted
Can POST request be changed in a HTTPS website?
This is not a javascript, POST or HTTPS problem, it affects all data received by a web server. Although realizing that someone might edit a URL might be easier to realize that cookies and other HTTP ...
- 5,700
2
votes
Accepted
Ruby on Rails: Request to http://\localhost/admin/config.php
Rails thinks the domain is "\localhost" because that's what the client asked for.
In order to support virtual hosting (hosting more than one website on a single computer), HTTP since version ...
- 34.4k
1
vote
Accepted
Prevent reading PHP files
As you see, the settings.php can contain site-relative passwords and should not be readed(but should be normally included by include or require)
You can't.
You basically require that your php scripts ...
- 12.5k
1
vote
How to track which php file executed a malware binary
I have the same problem. Try to find "dir" file on your public folder like /var/www/. In my case I found this on my laravel website, there are file looks like this on my "public" ...
1
vote
use md5 hashed guid as app login and REST interface
In this situation, it sounds like you're using a hash of a user ID as a credential. That's not particularly secure, because if the user ID ever leaks, then the credential is immediately known. It ...
- 6,950
1
vote
Getting Smaller Output From Public Key Cryptography In PHP
For RSA, the public key size determines the size of the ciphertext, and you need quite long public keys to achieve adequate security. However, there are actually quite a lot of problems with using RSA ...
- 39.1k
1
vote
What's The Best PHP Encryption For Email Addresses?
The difficulty here is that the web application must have access to the key in order to send emails. But if the application is breached, the attacker could obtain that key and decrypt the emails.
So ...
- 1,048
1
vote
Accepted
Should including an external webpage in PHP be dangerous in principle?
Including external pages is just as dangerous as executing any other code sourced from the Internet (because that's exactly what you're doing). If you trust the source of the file - either because you ...
- 39.1k
1
vote
Accepted
Sending Post Requests Server to Server
Is this a secure model for a sever to server communication? Should I be considering other items?
It's not. You are inventing a very complicated wheel after someone invented a better and simpler one ...
- 50.3k
1
vote
Attempting remote code execution, why does this php webshell code fail with single quotes?
Without seeing the code you're injecting into, it's hard to tell. It would be nice to see your entire payload too.
To be clear, the parameter name, cmd in this case, does not need to be enclosed in ...
- 183
1
vote
About vulnerability in the dependency
Unknown, but it could be either vulnerable or not. You cannot rely on the description alone to determine why foo() was vulnerable. Perhaps foo() relies on an internal function like parseJson() that ...
- 33.6k
1
vote
How to protect client server app if both: client and server - located on client side?
Broadly speaking, you're just trying to implement DRM. DRM is fundamentally impossible to make truly secure - you can't give a user the ability to run a program / open a file / etc. without giving the ...
- 39.1k
1
vote
A Suitable Replacement for MCrypt?
As per the wikipedia entry:
"The last update to libmcrypt was in 2007,[1] despite years of
unmerged patches.[2] These facts have led security experts to declare
mcrypt abandonware and discourage ...
- 146
Only top scored, non community-wiki answers of a minimum length are eligible