Collaborate Disseminate
Attempting to gain a little more information about a malicious C2.
Would there be a way to write a PHP script which automatically executes after being transferred back to a malicious command&control center?
The script… Continue reading Autoexecute PHP script after SFTP
My website is developed in PHP. But in last few months it got hacked more than 5 times. I don’t know why this is happening to me. Some of the directories got deleted due to this issue.
Please provide some security tips to s… Continue reading My website get compromised most of the time. Got security tips?
In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS.
Note, this would be used on a website that should never have more than perhaps 30 users.
I’m wondering if you could let me kno… Continue reading Security issues with 2-Step Verification Using SMS – Am I missing any vulnerabilities?
i want to creating xss filter for my own project, this is for html event filtering
preg_replace(“/ on\w+='[^’]*’/i”, ”, preg_replace(‘/ on\w+=”[^”]*”/i’, ”, $framed));
but considering to more efective way, i would thin… Continue reading How to filter HTML Event in Native PHP7
Is the code below enough to secure a login area?
<?php
if ($_SESSION[‘logged_in’]) {
// show content for logged-in users
}
Note: $_SESSION[‘logged_in’] is just a boolean value true after validating username/pass.
… Continue reading Is a "logged_in" session flag secure enough?
I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/
But I cannot use wp-cli if I do that.
Any solution please?
Continue reading Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini
This question already has an answer here:
How do I deal with a compromised server?
6 answers
Someone hacked into my websi… Continue reading My website is hacked and injected [duplicate]
when I try to use this payload:
<?= `$_GET[‘1’]`; ?>
it works in php-short-tag but when I do this:
<?php `$_GET[‘1’]`; ?>
it’s not working, and give me blank page.
Can anyone explain this?
Continue reading `$_GET[1]`; payload why work in php short tag only? [on hold]
During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec()
$arg = $_GET[‘arg’];
// sanitization, I suppose…
if(preg_match(“/[#\&\\+\-%@=\… Continue reading Can I inject a shell command here in PHP?
I have used the securimage PHP library to show a captcha on my form. But when I’m scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it’s trying to scan the same page with some different values r… Continue reading Securimage php library for Captcha Code showing security issues in Arachni Scanner