Collaborate Disseminate
I am going through a few tutorial lessons on DVWA in order to reinforce web security concepts. (security setting = low)
At the link below, we are trying to do the following (starting at section 11):
https://www.computersecuritystudent.c… Continue reading DVWA – Browser cannot load c99.php
I’m trying to bypass a page that has an eval() and it works like this:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,applicatio… Continue reading How to abuse eval() in PHP
I have a website built with MediaWiki CMS.
This website contains a ContactPage contact form in which the subject field is hardcoded to the form wrapper via PHP;
This is odd, because all other fields aren’t hardcoded like thi… Continue reading Is there an advantage in removing an element both from CSS and JS?
I am trying to determine the type of encryption used for a site whose password is stored in the database. The site is built using the fuelphp. It has the password of the form (B65qdjYiMWzizMol7BmG4knKh4OAu9033kSAPcCK5Cs=) whi… Continue reading Determine the type of encryption used
Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (E… Continue reading SQL injection using URL query string (web application/php server)
I’m building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I’ve decided to decouple the back-end and the front-end. That way I can easily in… Continue reading Protect public(?) API endpoints
Context: I had a virus on my WordPress website server that injected itself into every functions.php file on the server across two different sites. After removing the heavily obfuscated virus code I decoded it. (I won’t bore y… Continue reading Possible to decode md5 hash of a malicious URL?
So i have a webserver and i would like to have users login and then be able to download an exe file directly from the webserver the issues with this is that users can easily download the file directly eg “example.com/download… Continue reading Prevent unauthorized download of files from a webserver
I have a website with a contact form on PHP and a mail server.
Email are sent with the help of PHP mail function like so
$name = cleanInput($_POST[“name”]);
$e = $_POST[“email”];
$email = filter_var(cleanInput($e), FILTER_SA… Continue reading POST requests are bypassing PHP checks
Today I accidentally miss-typed a popular’s website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the web app that I am runnin… Continue reading How did a malicious website managed to serve me the app that is running on my local apache server?