Say someone has managed to get into my server and have found the (web based) app code:

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
mailuser($password);//uses standard PHP mail function

The password is dynamically generated, a-zA-Z0-9 etc from a function with using PHP rand. Is there any trace of the exec() string on the server?

It's not in /var/logs and not in .bash_history.

I'm aware that someone can also:

1. brute force the file
2. find the email address from the database the email was sent to, send phishing email and get access to their account and search their mailbox for the email with the password.)

I need to know if this $password string can be recovered if the server was compromised. Ultimately can I claim the $password is not stored on the server?

Suppose I have the following code in a PHP web application.

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
}
mailuser($password);//uses standard PHP mail function

The password is generated at random by a function that uses PHP rand().

I have not found the password in /var/logs and not in .bash_history.

I need to know if the value of $password can be recovered from the server in the event that the server is compromised. Ultimately, can I claim that the value of $password is not stored on the server?

Say someone has managed to get into my server and have found the (web based) app code:

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
mailuser($password);//uses standard PHP mail function

The password is dynamically generated, a-zA-Z0-9 etc from a function with using PHP rand. Is there any trace of the exec() string on the server?

It's not in /var/logs and not in .bash_history.

I'm aware that someone can also:

1. brute force the file
2. find the email address from the database the email was sent to, send phishing email and get access to their account and search their mailbox for the email with the password.)

Say someone has managed to get into my server and have found the (web based) app code:

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
mailuser($password);//uses standard PHP mail function

The password is dynamically generated, a-zA-Z0-9 etc from a function with using PHP rand. Is there any trace of the exec() string on the server?

It's not in /var/logs and not in .bash_history.

I'm aware that someone can also:

1. brute force the file
2. find the email address from the database the email was sent to, send phishing email and get access to their account and search their mailbox for the email with the password.)

I need to know if this $password string can be recovered if the server was compromised. Ultimately can I claim the $password is not stored on the server?

Say someone has managed to get into my server and have found the (web based) app code:

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
mailuser($password);//uses standard PHP mail function

The password is dynamically generated, a-zA-Z0-9 etc from a function with using PHP rand. Is there any trace of the exec() string on the server?

It's not in /var/logs and not in .bash_history.

Say someone has managed to get into my server and have found the (web based) app code:

$encrypt ? $password = generatePassword($passwordstrength): $password="";
$estring = "7z a -p$password -mx0 packFoo.aes.7z mydir/foo";
if($encrypt) {
    exec($estring);
mailuser($password);//uses standard PHP mail function

The password is dynamically generated, a-zA-Z0-9 etc from a function with using PHP rand. Is there any trace of the exec() string on the server?

It's not in /var/logs and not in .bash_history.

I'm aware that someone can also:

1. brute force the file
2. find the email address from the database the email was sent to, send phishing email and get access to their account and search their mailbox for the email with the password.)