New answers tagged php
0
Problem 0: You don't need to send the hash of the password, because you're already using TLS (HTTPS). If you do send the hash, then the hash becomes the password.
Problem 1: Preventing users from generating a fake JWT response.
You're already using TLS. Pin your server's certificate. That is, include the server's public key in your app. If anything ...
1
Always try to use the minimum permissions required to do the job, like this you can protect against current and unknown threats. With this in mind, there are three requirements that can be extracted from your explanation:
john needs to be able to read and edit the files
www-data needs to be able to read the files
Other users on the system have no business ...
1
like the documentation of password_hash states, a unique salt is being calculated for each time it is called.
It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.
(source: php manual - password_hash)
Additionally the used options of the hashing ...
0
If you read the documentation on php.net you can see that this function generates a secure salt every time you use it. So if you are using the same input there will be a different output because of this random salt.
In the password_verify section of your code the new salt will be used. The hash will be identical and a user is able to login.
If you want ...
1
You handle the upload with POST requests to a PHP script which checks the file extension and renames the file
You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system.
If I understand correctly, ...
0
Regarding the location in the file system hierarchy, there is no difference between /videos, and /var/www/html/site/videos, or the like. The issue is what permissions, i.e. the executable bit, the directory and files have, (which you mentioned), and also the user to which they are assigned, e.g., www-admin, nginx, etc.
Also, file uploads should be limited ...
0
Is there any technique that may help me get a RCE out of this
vulnerability? Or is this the most I can do with it?
No,in and of itself you cant exploit this for an RCE.You will simply be able to smuggle shells using this way and wont be able to execute them.You will have to chain this vulnerability with another one to gain RCE.A vulnerability like ...
3
This isn't a sign of anything to be concerned about.
As a general rule of thumb you should expect to find all kinds of strange URLs in your logs. This is the normal "background noise" of the internet. In essence, shortly after a server becomes accessible to the internet, automated bots will automatically start scanning it for any number of well known ...
0
Let people store anything they want, rename the file to something random (SHA1 of random long number is enough), move them off the server root, and record the new name and original name on a database, taking care of sanitizing the filename.
List files using the original names on the filename (again take care with sanitization), and use PHP fpassthru or ...
1
Even though you developed your code with security and privacy by design, audited the result and have continuously monitored CVEs to be sure that there are no (known) issues that affect you, that doesn't mean everyone else has, too. Presumably you're in a shared hosting or VPS environment: your hosting company is in the business of providing a secure OS, ...
2
Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered.
Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018.
So, can we say it is "fairly safe" to run an outdated PHP ...
0
As of 2019, I have worked with a startup that was against creating a whitelist as they are starting out development, but wanted a blacklist. They required access to the filesystem and to the cURL library for the AWS SDK, but are using custom HTTP calls so can't rely on the SDK using socket streams.
Importantly this was far from the only technique utilised ...
0
If the server is refusing to execute a php script on the uploads folder but runs php scripts elsewhere, it sounds like the server is working as it should. You'll need to use one of those other directories to pop and explore.
Top 50 recent answers are included
