Collaborate Disseminate
When redirecting using header(“Location MyPage.php”); in PHP, any code present after will be executed. So, if you’re using this as a way to avoid user accessing pages where they should be logged in, the content of the page wi… Continue reading Do PHP redirect information disclosure also apply to other languages or framework?
We currently have a hacker who is asking for a bounty before they will tell where a vulnerability is in our project that uses SQL. He sent us accurate screenshots of his successful attacks by showing the database architecture… Continue reading How to find and monitor a SQL vulnerability in a web project? [on hold]
I’m hoping you might be able to give me some advice.
I’m new to linux system administration so go easy on me 🙂
Was doing some checks around the directory that’s being served by nginx and noticed some files were set with pe… Continue reading What should I do about this unrecognized PHP process?
Is there a way to bypass the input check to get RCE with the include function?
php wrappers can’t be used because allow_url_include is off
Also, open_basedir=/var/www/html/
function waf($s, $type) {
if($type == 0)… Continue reading How to achieve RCE with include?
I’m developing a merchant page where users can pay their bills.
On this page, users must fill in their bank details (Card number, card holder name, expiration date, CVC).
As a verification, we have a phone field where the us… Continue reading Protect page sms verification from spamming
I am trying to pentest my friend’s site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.
Whenever I try very simple attacks containing SQL commands s… Continue reading Server returns 403 when I try SQL injection
I am building a simple website in my local machine using (apache 2.4.38) and PHP 5.3.29. Now my goal is to create a vulnerable php files (maybe LFI) that I can exploit and possibly get a reverse shell using python payload etc… Continue reading making vulnerable website in my local machine
This question already has an answer here:
I found unknown PHP code on my server. How do I de-obfuscate the code?
2 answers
… Continue reading What’s the point of this php shell? [duplicate]
From my previous question: How secure is this schema between a Desktop App (c++) and an API (php).
Introduction
I made a paid Desktop-app that required constant internet connection (because of its nature, not because of s… Continue reading Is this schema between a Desktop App and an API secure?
as title says I’m writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. There is no webpage or such,… Continue reading How secure is this schema between a Desktop App (c++) and an API (php)