Collaborate Disseminate
Since PHP has loose type comparison, we have:
php -r ‘var_dump("1234e03"=="1234000");’
bool(true)
And since MD5 hashs are often reprensented as hexa string like 713f44b3d2c680df02eb5a0bde86fcd7
Are there two already kn… Continue reading Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?
I am trying to find bugs in a source code in php and I found this
<?php
$Key=$_POST["key"];
$FileName=$_POST["filename"];
$FileData=$_POST["filedata"];
$Key=(base64_decode($Key));
$FileName=(ba… Continue reading File can upland on my localhost but it’s not uploading on the client site [closed]
I want to clear my doubt that Is there any issues coming from adding ‘Strict-Transport-Security’ and ‘X-XSS-Protection’ headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header set X-XSS-Protection "1; mode=block&… Continue reading Headers X-XSS-Protection issue
On lab.com there is a file upload for blogs posted on it. All files are put in /userfiles/, where no PHP can be executed, it just throws file right out in the browser.
My question is: Can this be somehow bypassed to execute uploaded shell?… Continue reading Bypass File Execution Prevention
I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web accessible and the subdomain points to … Continue reading unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel)
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" style="display: none">
<… Continue reading Is PHP json_encode sufficient for HTML data blocks?
i’ve a problem, i hve a source code for data encryption aes256 based, but this code is Java and I want transform to php, i was try with this example, but isnt correct, can u help me, the examples in php use random iv but i require them to … Continue reading AES 256 encryption Java to PHP
We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest – api. All communication is over a secured https channel. The REST api is programmed to resist XSS and obviously injection problems (but p… Continue reading use md5 hashed guid as app login and REST interface
Checked many blogs for 2 way ssl(Mutual Authentication) for magento api’s or PHP but did not get end to end implementation details.
Below is my understanding.
Lets consider client (sslclient.com) and server (sslserver.com), both will commu… Continue reading 2 Way SSL for Magento API
I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php
This is the notification:
——————————-
Request:
——————————-
* URL : http://\local… Continue reading Ruby on Rails: Request to http://\localhost/admin/config.php