6
PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder.
Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application ...
4
Should I consider <a href></a> as dangerous mixed passive content?
While this is not considered mixed content (since it is not embedded into the page), it can of course still be dangerous: with a plain HTTP link an attacker could hijack the request or response and provide different content. And usually there is an expectation by the user that an ...
3
Can someone still use that browser cookie to impersonate me?
As @Hackndo noted, this is totally up to the web-developer.
am I safe now
Guessing, I would suggest you change your password, not just log out.
Here is a deterministic way to check:
Now take your cookie, then log in (or change your password) and compare the 2 keys to see if they are the same.
...
2
There is nothing inherent in a 404 response which protects against attacks like clickjacking (i.e. what X-Frame-Options tries to address). While most response bodies send with 404 are likely not vulnerable to clickjacking in the first place due to the shown content (i.e. just some more or less fancy error message), browsers do not add extra protection by ...
1
Generally there is a way for Chrome. You can try to exploit this vulnerability (not a product, but a demo to check if it works in your browser).
The vulnerability uses JavaScript to check from which cache the image was delivered: from F-cache or from disk cache.
Note: This method will only work if target site has a favicon.
1
You could poison log files for example if this is a LFI (which includes a file, i.e. executes any php code) to achieve RCE.
You could perform an HTTP request to the server using PHP code as the user agent, and try to load the log file using your LFI. If a require/include function call is made, the php code should be executed.
You will find additionnal ...
1
This depends on the different websites on which these cookies were valid. Normally, if you have logged out, the cookies should no longer be valid, and you should be safe.
Sometimes websites do not invalidate cookies even after logging out, they simply delete them on the user side. In this case, it is still possible to re-authenticate by re-using the cookies. ...
1
Get your own domain (I'll use attacker.com as an example). Create the subdomain sub.domain.com.attacker.com. Setup sub.domain.com.attacker.com to redirect to wherever you really want to redirect the user to. Done.
1
Burp has session handling functionality that allows you to make a request to check if your session is valid, and if it has expired then it will login again. You can find it in the Project Options > Sessions tab.
Official documentation is here: https://portswigger.net/support/configuring-burp-suites-session-handling-rules
1
Try to get account takover or user data manipulation. This will be a very dangerous subject.
Good form rules tell us not to be destructive. Just describe vulnerability to security team and list potential harm moments.
1
Here is the official response to this question from GIPHY:
GIPHY APIs are designed to be used on the client side (and hence the API key too). You should go ahead and use it that way. Once development is complete - please apply for Production access for the key through the Developer Dashboard, this removes Rate limits associated with a beta key, so you don't ...
Only top voted, non community-wiki answers of a minimum length are eligible
