Author Archives: Phil

PHP Remote File Inclusion command shell using data://

Posted on March 24, 2011 by Phil

PHP 5.2 and above provides stream wrappers. The general idea behind the stream wrapper is that you write one that interfaces with other protocols or services and you can still reference the data using your favourite functions. Here we open … Continue reading →

Posted in PHP | Tagged , , | 2 Comments

Hardening and securing PHP on Linux

Posted on February 28, 2011 by Phil

Hardening PHP on linux to increase security is a complex process involving a plethora of  settings. A while back I developed a script in order to check for any security settings that were out of place. The idea is that … Continue reading →

Posted in PHP | Tagged , , , , , | 12 Comments

Using php://filter for local file inclusion

Posted on February 23, 2011 by Phil

I came across a website where the site was vulnerable to LFI (local file inclusion) however the inclusion was done using a require_once and the script appended a .php extension to the end of the file; furthermore it was not … Continue reading →

Posted in PHP | Tagged , , | 3 Comments

Scanning the internal network using SimpleXML

Posted on February 14, 2011 by Phil

XML is widely used throughout PHP applications in the representation arbitrary data structures such as with SOAP and REST web services. It supports the use of external entities allowing you to bring in information from external sources. This is useful … Continue reading →

Posted in Web Services | Tagged , , , , , | 7 Comments

MongoDB Null Byte Injection attacks

Posted on February 12, 2011 by Phil

Following my earlier post on how MongoDB can be vulnerable to SQL injection I discovered that MongoDB is also vulnerable to Null Byte Injection. The attack could potentially let users overwrite fields in the database to which the application logic … Continue reading →

Posted in MongoDB | Tagged , , , | 4 Comments

Mongodb is vulnerable to SQL injection in PHP at least

Posted on July 1, 2010 by Phil

Its a common misconception that as MongoDB does not use SQL it is not vulnerable to SQL injection attacks. PHP uses objects rather than SQL to pass queries to the MongoDB server; for example the following script selects an item … Continue reading →

Posted in MongoDB | Tagged , , , | 6 Comments