33
votes
What security risks are there in allowing someone to upload PHP scripts?
It's very dangerous, because you are allowing to someone to upload PHP file with unknown code and unknown intentions, so if you need this functionality as part of your web site, you should harden your ...
- 1,059
28
votes
What security risks are there in allowing someone to upload PHP scripts?
If you allow somebody to upload and execute a PHP script on your server, you effectively give this person the right to do whatever he or she could do, if she had ssh access with username/password for ...
- 7,772
26
votes
Is hashing user input data redundant on HTTPS?
But with https, is this unnecessary? Https encrypts any data with a key, so if something was altered during transfer, the decryption on the server would fail, right?
It's not uncommon for a file ...
- 3,447
25
votes
What security risks are there in allowing someone to upload PHP scripts?
To me it sounds like you are about to shoot yourself in the foot. Letting people you don't trust upload and run PHP on your server is extremely dangerous. Here are some things an attacker could try:
...
- 65.9k
23
votes
Accepted
How insecure is FTP?
With plain FTP the credentials are passed in plain and thus can be easily sniffed. Also, the files are not only send in plain but they are also not protected against modifications, i.e. an active man ...
- 213k
17
votes
What security risks are there in allowing someone to upload PHP scripts?
While there are sites that allow you to run PHP code on demand (i.e. 3v4l), they severely limit what you can do and jump through some major hoops to do it safely
I use a setup where scripts are ...
- 3,788
12
votes
How insecure is FTP?
Credentials are transfered in clear text, but you know that from the other posts. But how easy is it to get those details?
As an example I ran tcpdump and connected to an FTP server. Lets take a ...
- 3,012
11
votes
How to prevent XSS in SVG file upload?
Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic:
Direct view with content-disposition: attachment - not vulnerable -...
- 211
11
votes
Is hashing user input data redundant on HTTPS?
Hashing alone cannot ensure integrity. If you assume the file can be manipulated by an attacker, then nothing prevents this attacker form also changing the hash and making it match the new file ...
- 38.2k
10
votes
Securing HTTP File Transfer over local network
For security, you need authentication. If Alice wants to sends a file to Bob's computer, Alice's app needs a way to verify that it's Bob's computer it's talking to, and not an attacker's computer. So ...
- 35.6k
10
votes
Is hashing user input data redundant on HTTPS?
With https, data is first encrypted, then decrypted. The data could be damaged before or during encryption, or during or after decryption. To https, everything may look fine.
Adding a checksum will ...
- 3,114
9
votes
Accepted
CSRF attack on file upload functionality
Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.
So how can this be exploited? If your site ...
- 65.9k
8
votes
Accepted
Is it possible to get XSS through uploading an image via the filename?
Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as ...
- 53.9k
8
votes
Is hashing user input data redundant on HTTPS?
Another problematic factor of your method is data integrity in storage. Once the file is uploaded to the server, it's important to ensure that said file remains unchanged while stored. Hashing can be ...
- 4,795
7
votes
MIME Type vs. Magic Numbers
If you are talking about file uploads to a server use various methods to check the filetype. The overhead is tiny. Magic numbers give you a more robust way to verify the filetype but can still be ...
- 2,869
7
votes
Pentesting file upload functionality
If it is an Apache server, you might be able to upload a .htaccess file, enabling you to establish directory listings or specifying file extensions to run like php, jsp, py or whatever the server is ...
- 1,523
7
votes
Accepted
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
shell.php.jpg should be treated as a .jpg file
You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, but ...
- 1,749
7
votes
CVE-2017-15580: Getting code execution with upload
I don't think that you read the CVE or the PoC properly.
The PoC says that the reverse shell is to get a shell "of the end user". Not the server.
So, you are not doing anything wrong. You ...
- 134k
7
votes
Is hashing user input data redundant on HTTPS?
Hashing has a secondary purpose of also verifying that the data is complete -- e.g. was not truncated due to a connection interrupt. There are other ways to check for this, depending on how much ...
- 277
6
votes
Accepted
Is using enctype="multipart/form-data" always a bad idea?
Using enctype="multipart/form-data" creates both a binary and an ascii upload
I consider this statement wrong. There is application/x-www-form-urlencoded where the body of the POST request consists of ...
- 213k
6
votes
Accepted
Malicious PDF file upload
Run them all through a converter into PDF/A format.
It forbids any sort of active content.
If they won't convert, trash them.
IDS/IPS with Anti-Malware license
Scanning is a losing battle. No ...
- 300
5
votes
What security risks are there in allowing someone to upload PHP scripts?
PHP has a lot of functions to disable features and restrict certain actions so it can be used in shared hosting scenarios. So it is much safer to allow people to upload php scripts than i.e. perl ...
- 3,512
5
votes
Accepted
What are the potential vulnerabilities of allowing a large http body size?
I'm going to go for an answer but I'm also not an expert on this particular topic, so I'll be curious to read any other answers that might come in.
I believe that the short answer is this: allowing ...
- 31.9k
5
votes
Accepted
File upload security in webapp - overview of setup
I think the only way to answer this is through a collaborative commenting effort, so here goes a community wiki:
Of course only registered users can upload, but I know that doesn't mean anything.
...
5
votes
How can I inject real php code into this website?
This is... strange. My guess is that you are right in that this is some sort of protection mechanism, but it doesn't look like a very stable one. A better approach would be to block files with .php or ...
- 65.9k
4
votes
How to prevent XSS in SVG file upload?
While @ThorTL67 points out some completely vaild solutions, I don't feel comfortable with any of them, and they seem kinda irresponsible to me.
This is because any malicious JS within the SVG is ...
- 2,155
4
votes
Accepted
Does opening an arbitrary file in a language (such as Python) pose a security risk?
No.
If the filename is controlled by the user, then you might open yourself up to vulnerabilities (e.g. an attacker might try to read config files with the database password). But just opening a file ...
- 33.3k
4
votes
Accepted
Can an XXE attack be carried out from within an docx file?
In an XXE attack, the attacker sends XML including an external entity referencing some secret file or resource on the server. For this to be useful to the attacker, the server needs to include the ...
- 65.9k
4
votes
Execute an uploaded php script on a vulnerable server if I know it's location?
Unless the server is severely misconfigured, it will never execute .jpg files as .php files. The last segment after a . is the relevant one when determining file extensions, which means that you are ...
- 29.8k
4
votes
How insecure is FTP?
How insecure… really… is FTP?
As insecure as any other application layer protocol that is not encrypted, for example HTTP.
But what exactly is the risk being posed?
The major risk is exposure (to ...
- 5,286
Only top scored, non community-wiki answers of a minimum length are eligible