Category Archives: PHP

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover

Posted on by

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover. Thus I can increase the impact and get more bounty then what they will pay now.
I have access to files like… Continue reading I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover→

Hackaday Links: March 3, 2024

Posted on by
Hackaday Links Column Banner

Who’d have thought that $30 doorbell cameras would end up being security liabilities? That’s the somewhat obvious conclusion reached by Consumer Reports after looking at some entry-level doorbell cameras available …read more Continue reading Hackaday Links: March 3, 2024→

How to prevent absolute path traversal in EasyPHP Webserver 14.1

Posted on by

In the EasyPHP Webserver 14.1 software, there is an Absolute Path Traversal vulnerability in the dashboard index.php page.
https://www.exploit-db.com/exploits/51430
I reviewed the source code and tried to look for the vulnerable code but I… Continue reading How to prevent absolute path traversal in EasyPHP Webserver 14.1→

TIOBE Index News (January 2024): Programming Language of 2023 Goes to C#

Posted on by

Keep an eye on Dart and TypeScript in 2024, TIOBE Software CEO Paul Jansen suggests. Continue reading TIOBE Index News (January 2024): Programming Language of 2023 Goes to C#→

How can I pen test my .php website that I host on my local machine?

Posted on by

Pen testing my own .php website
Well, I’ve made some kind of forum type website where you can share posts comments and information. There is a login panel (/index.php) at first and it’s already secure enough to block users from entering &q… Continue reading How can I pen test my .php website that I host on my local machine?→

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Posted on by

Problem
Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*.
Background
The block is coming from the PHPH… Continue reading How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?→