Collaborate Disseminate
I have been trying to confirm which browsers will accept session.cookie_httponly but for my test each browser I am using fails. Which more than likely indicates my test is not correct. What I am wanting to do is test whether or not JavaScr… Continue reading Testing session.cookie_httponly .htaccess
I have a scenario as the following:
<?php include(“resource/” + $_GET[‘vuln’]); ?>
And I’m trying to get RCE from this, or atleast acquire some interesting information.
I already looked at /etc/passwd and other important files…. Continue reading Exploiting LFI with prefix in PHP?
I became mad by putting my head in to strange issue. I am working on an old machine with apache 2.2+ php 5.3. Session are not working when i change the page. For testing i simply made 2 pages (1.php & 2.php). The simplest code is as be… Continue reading session disappears when switch to a different page
I’m a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I’m currently using the Laravel framework. Based on its documentation here:
When using hashed API tokens,… Continue reading What is the recommended way to generate API tokens using Laravel framework?
I am doing a CTF style web exploit challenge which should be a ‘simple’ RCE.
I have two potential avenues, one of which is an image upload where I have already bypassed restrictions on file types by changing the character casing on phP.
… Continue reading Is PHP safe mode enabled on target webserver? [closed]
I have a local application which will be accessible only after login. Its single URL application, URL of application won’t change, just it use ‘XMLHttpRequest’ to refresh the content of screen based on action and other parameters.
mbadolato (Slashdot reader #105,588) shares this post from Belgium-based programmer Brent Roose:
It’s no secret among web developers and programmers in general: PHP doesn’t have the best reputation. Despite still being one of the most used languages t… Continue reading Is PHP Still a Worthwhile Language To Learn?
Im developing my first API but I think I can optimize the server response by eliminating an ssl decryption…
Server recieves data the following way:
POST request with 2 parameters – >
1 = action (int value), 2 = data (base 64 encoded).
… Continue reading Unnecessary SSL encryption in API?
I have setup a local apache server with php module.I deployed a dvwa in my localmachinne..I am learning about XSS(DOM) type of attack.I setup the low level security in dvwa.When i added <script>alert()</script>
in the url i got… Continue reading Injecting script from outside for local machine url request
There is a code snippet like that in a php based web application.
<form action=”home.php?parameter=<?php echo $_GET[‘parameter’] ?>” method=”post”>
Can I execute arbitrary code using get “parameter”?