Collaborate Disseminate
This is where I took this example from:
<a href="<?php echo $_GET[‘e’];?>">Back</a>
In this code, I can do http://my_url?e=javascript:alert()
But what can I do if my code is like this:
<a href="e<?php… Continue reading can i execute javascript in href when i have text before my input?
In the company I work for, we have many clients and the vast majority of them have hosting with us and we make their web apps. One client, though, just applied for cyber security. Our CEH (certified ethical hacker) asked me to make an exac… Continue reading Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?
I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve already tried several injections but cannot f… Continue reading SQL Injection Training challenge including a PHP file
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in the database.
When a user activates his a… Continue reading Is my login script secure – how to improve it?
“PHP version 8.0 has arrived, bringing with it a major update to the 25-year-old programming language…” writes Tech Republic.
New language features include the nullsafe operator and attributes (commonly known as annotations in other languages) to a… Continue reading PHP 8.0 Brings Major (And Breaking) Changes to a 25-Year-Old Language
I read this post: How does hacking work? and I saw that Chris Dale answered the question with some PHP exploit instructions. However, how does a hacker can read a PHP file (or another back-end file), since it is in a server? What do hacker… Continue reading How does a hacker reach a back-end file to exploit it?
I was working with a freelancer from upwork and noticed they added this script titled .default in my config directory. It looks malicious and they were hired to do CSS style changes of elementor:
<?php
header(‘Cache-Control: private, … Continue reading Is this script malicious? What does it do? [closed]
I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS.
When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port 443 for some reason and getting blocked.
… Continue reading Why is php-fpm trying to connect somewhere on port 443?
[Niklas Roy] rolled his own photo diary, because he found the core functionality of something like instagram attractive, but didn’t want the social network baggage that it came with. His simple system is called my own insta 😉 and it consists of some javascript and PHP to create a nice …read more
Continue reading Roll Your Own Photo Sharing, Minus the Social Networking Baggage
I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are:
# iptables -A OUTPUT -d [mySmtpSmarthost]/32 -p tcp -m… Continue reading has my server been hacked?