Category Archives: PHP

Encoding Web Shells in PNG IDAT chunks

Posted on June 4, 2012 by Phil

If you carefully encode a web shell in an image you can bypass server-side filters and seemingly make shells materialize out of nowhere (and I’m not talking about encoding data in comments or metadata) – this post will show you how … Continue reading →

Posted in Exploits, PHP | Tagged , , , , | 22 Comments

Exploit: Symfony2 – local file disclosure vulnerability

Posted on February 25, 2012 by Phil

I recently discovered a vulnerability affecting the Symfony2 Framework versions 2.0.0-2.0.10. In short, by by parsing user supplied XML in any way (e.g. SOAP API, RSS feed, unserializing an object) it is possible to disclose the contents of arbitrary files from the … Continue reading →

Posted in Exploits, PHP, XML | Tagged , , , , , | 1 Comment

Decrypting suhosin sessions and cookies.

Posted on November 30, 2011 by Phil

The suhosin module provides transparent cookie and session encryption out of the box to PHP applications. Once enabled any session values stored on disk are encrypted with rijndael and a slight variation on base64 encoding, the same applies to any … Continue reading →

Posted in PHP | Tagged , , , | 5 Comments

Google TOTP Two-factor Authentication for PHP

Posted on July 25, 2011 by Phil

At the beginning of the year Google released 2 Factor Authentication (2FA) for G-Mail providing an application for Android, IPhone and Blackberry called Google Authenticator to generate one time login tokens. This post will show how to implement Google 2FA … Continue reading →

Posted in PHP | Tagged , , , , | 25 Comments

Exploit: PHPCaptcha / Securimage is not secure.

Posted on May 25, 2011 by Phil

Recently I discovered an easy way to bypass PHPCaptcha also known as SecurImage. The method described below will break the CAPTCHA every time, without fail and affects versions 1.0.4 and above. Previous versions are also probably vulnerable tho only exploit … Continue reading →

Posted in Exploits, PHP | Tagged , , , , | 21 Comments

PHP Remote File Inclusion command shell using data://

Posted on March 24, 2011 by Phil

PHP 5.2 and above provides stream wrappers. The general idea behind the stream wrapper is that you write one that interfaces with other protocols or services and you can still reference the data using your favourite functions. Here we open … Continue reading →

Posted in PHP | Tagged , , | 4 Comments

Hardening and securing PHP on Linux

Posted on February 28, 2011 by Phil

Hardening PHP on linux to increase security is a complex process involving a plethora of  settings. A while back I developed a script in order to check for any security settings that were out of place. The idea is that … Continue reading →

Posted in PHP | Tagged , , , , , | 14 Comments

Using php://filter for local file inclusion

Posted on February 23, 2011 by Phil

I came across a website where the site was vulnerable to LFI (local file inclusion) however the inclusion was done using a require_once and the script appended a .php extension to the end of the file; furthermore it was not … Continue reading →

Posted in PHP | Tagged , , | 3 Comments