Collaborate Disseminate
I have been trying to solve this challenge for all today and even if it should be really easy i do not manage to find a solution cuz i am a beginner i do not knoe anythign about php, i did not find on internet any similar challenge.
The ch… Continue reading php code injection with blacklist
Thermal receipt printers are finding their way into all sorts of projects that are well beyond the point-of-sale environment that they normally inhabit. And while we applaud all the creative …read more Continue reading Get GitHub Tickets IRL with a Raspberry Pi and a Receipt Printer
Edit: Question moved to https://stackoverflow.com/questions/71629399/decoding-and-decompiling-php-byte-code-payload
Recently I found a malicious PHP payload on my company’s server. The code seems to be encoded into two strings claster and … Continue reading Payload Decoding [closed]
For better security(or for better hacker-life-difficulty) i do not trust even on my php files and my question is :
<?php
//how to deny any reading of .PHP files from standard PHP functions like file_get_contents?
echo file_get_contents… Continue reading Prevent reading PHP files
I have seen in many source codes where developers used curly braces on the user input variable for ex:-
query("SELECT * FROM users WHERE email = ‘{$email}’ AND password = ‘{$password}’");
And I have seen that people created two … Continue reading What is the use of Curly Braces in PHP mysql? [migrated]
The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable to run any bash with the http request? … Continue reading How to perform php post request attack with javascript sanitization?
I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address MKkb4o9jUYmcQRRkpJWK82mW2S1ZZMtaLg, the executable fil… Continue reading How to track which php file executed a malware binary
What’s wrong with this sequence? 1. Step into the road 2. Check if it’s safe 3. Keep on walki… Continue reading Irony alert! PHP fixes security flaw in input validation code
For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains?
For the main site, example.com, I am currently using:
<?php
session_start();
//han… Continue reading What’s the best way to handle authentication across multiple different domains under the same service?
I am working on building a login page to demonstrate SQL injections. I’ve tried my best to build the most "simple" login. I’ve been using credentials such as 1′ or ‘1’ = ‘1 for username & password, and getting the "nay&q… Continue reading What SQL injections can bypass this authentication page? [migrated]