New answers tagged


PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder. Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application ...


Absolutely possible. Imagine you have a page like this http://victimIP&Port/?page=contact.php http://victimIP&Port/?page=../../../../var/www/payload.jpg It can be executed like PHP files. In your case http://victimIP&Port/?page=../../../../var/www/.../images/md5.jpg


Before I answer this, I should ask: is there a reason you think changing the anti-CSRF token on every request is necessary, or even beneficial? I don't want to say that there categorically cannot be a good reason, but I can't think of one. The rest of the answer is based on that. Is this a good idea? Not really. There's no need, and no good reason, to ...


For Linux systems, gnutls-cli is available. For example: gnutls-cli qnap --no-ca-verification GET index.html gets the index.html from my Qnap-NAS via port 443. You can of course easily make invalid http requests like your example this way. If you just want to exploit all sorts of possible URLs with valid requests, then perhaps curl is the better tool.


This is always a tricky question, and from an attackers view, it is always possible to reverse engineer your "backend", if you provide it to run locally at the attackers server. You could use some obfuscators and anti debugging frameworks (usually one doesn't implement this from scratch) to make it more difficult to get the data out of the app, ...


Anything you do on the client-side can be ignored by an attacker. They don't even need to visit your web page in order to send requests to the PHP script - they can send those requests directly with whatever inputs they like. If you're just using functions like strlen, intval, etc. for parsing the string and converting it into numbers for calculations, there'...

Top 50 recent answers are included