Collaborate Disseminate
Pen testing my own .php website
Well, I’ve made some kind of forum type website where you can share posts comments and information. There is a login panel (/index.php) at first and it’s already secure enough to block users from entering &q… Continue reading How can I pen test my .php website that I host on my local machine?
Problem
Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*.
Background
The block is coming from the PHPH… Continue reading How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?
We have separate WordPress installation directories in one webspace on the same User. (Wordpress_01, Wordpress_02…)
It is possible to block PHP script Actions between the directories? (is the best method using .htaccess?)
A few weeks ago… Continue reading How to encapsulate PHP subdirectories in Apache?
I am working on a CTF called Internal. I know there are walkthroughs available but I am trying not to look at them for the time being and try and work through things myself. The admin page that is the apparent target is http://10.10.240.10… Continue reading Server Side Request Forgery Vulnerability Question
Slashdot reader sysadminafterdark writes:
Released on November 26, 2020, PHP 8 brought many optimizations and powerful features to the language.Fast forward to today, and PHP 8 is getting the boot in favor of 8.1, 8.2, and 8.3 with 8.4 in development…. Continue reading PHP 8.0 End of Life Is Today, November 26, 2023
I have developed a website with codeigniter 3 and I have also updated it to the latest version of codeigniter.
My website has been hacked in the same way for several days.
The hacker puts two files in my root of host (public_html directory… Continue reading Codeigniter website is hacked regularly by an unknown method [closed]
I’ve just inherited the maintenance of an old website. The code is awful and I’d like to demonstrate to my superiors that the code is bad and vulnerable.
<?php
if (!empty($_GET[‘page’])){
include ‘controleurs/’.$_GET[‘pa… Continue reading Inheriting Old Website Maintenance: Demonstrating Code Vulnerabilities [closed]
We had a "pentest" done on our website – and received the following alert (xyz.com is a placeholder for the real name.
I queried this with the testers, and they say their automated tools found this… so they can’t help till we f… Continue reading SQL Lite Injection via CSS URL
My website got hacked and the hacker snip this code in my index.php, i dont understand this, have try many tools online to de obsufuscated but not work at all
<?php
$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%7… Continue reading What does this malware PHP script do? [closed]
On my website, there is a store. The store uses CouchCMS to display the pages and store information about the items available for purchase. There is a purchase button on the item page that allows you to purchase that item, here is its code… Continue reading How do I stop users from changing the price of items in my shop? [migrated]