Collaborate Disseminate
So basically I found this phishing page sent to my email. I am curious and wanted to see if the login credentials being gathered were being sent to another webserver. So I use ZAP to run through the response and requests step by step. I no… Continue reading Can some one tell me why this phishing page gives response headers with www.fbi.gov as host? [closed]
Sentry announced new and enhanced platform capabilities designed to improve developer workflows and productivity by making it easier to find and resolve the issues that really matter, faster. Developers are under pressure to write more code than ever t… Continue reading Sentry enhances platform capabilities to improve developer workflows and productivity
My code is that
if (in_array($file_ext, $extensions)) {
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $file_tmp);
if ($mime == ‘application/msword’ || $mime == ‘image/gif’ … Continue reading why the internal server error occured when using finfo_file function? [closed]
$_FILES[‘userfile’][‘type’] == "image/gif"
There is a problem to choose not only image.gif but whatever name is, such as *.gif . And, if it is possible, can you share some regex expressions for all names and especially image ext… Continue reading How to choose specific file names in php code? [migrated]
I am using Burp Intruder to upload a webshell to different directories.
These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I’m lucky the goal would be to get 1 200 response.
What is wr… Continue reading Uploading php webshell using Burp Intruder
Latest episode – listen now! (And please share with your friends.) Continue reading S3 Ep31: Apple zero-days, Flubot scammers and PHP supply chain bug [Podcast]
I am dealing with a website vulnerable to CSRF. Let’s say that the page (upload.php) has the following code
if (isset($file_submit)) {
//submit_file()
}
else {
show_submission_form()
}
submission_form()
{
$tool_con… Continue reading CSRF tokens in file that we can upload a file
Third time lucky! (The first two times were lucky, too, luckily.) Continue reading PHP community sidesteps its third supply chain attack in three years
Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded.
Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed.
I had also modsecurity on my nginx- fir… Continue reading How to recover a hacked site with WSO Shell [duplicate]
Before anyone asks, yes what I am doing is legal. I am testing an organization that has a bug bounty program.
I found a directory listing on this subdomain that has backend PHP files and a bunch of directories. I can see the file names, an… Continue reading How to view contents of "empty" PHP files from a directory listing? [closed]