0
votes
1answer
20 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
2
votes
2answers
109 views

WordPress keeps redirecting my users to install.php, Is it caused by an injection hack?

I don't really know how to express my problem, so bear with me. This is a bit hard to explain. I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the ...
0
votes
1answer
556 views

What does it mean to infect people with silent java drive?

I've got a weird contact message through my website, claiming they have found a security vulnerability and wonder if I have a bug bounty program. The details they shared: Only what I can say is ...
4
votes
2answers
166 views

Website hack resulting in auto redirect - where to start looking?

My website is being redirected to a non-existent page (/showpage.php) for some users when they hit the homepage. For other users, the site works fine. I have looked in the index.php files and some ...
0
votes
2answers
177 views

How to double protect admin access in PyroCMS

I have read how to protect admin folder with .htaccess and .htpasswd file but in PyroCMS admin login (ex: example.com/admin) just only routing system (no admin folder yet). So, how can I double ...
2
votes
0answers
59 views

Good security practice for writing a php/mysql web app [closed]

I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts. It will most likely not be very likely to be attacked in any way. Still I am ...
1
vote
1answer
517 views

Site got hacked while many / all security leaks have been removed [closed]

I've got a website with this code appended to my php document : <? #8f4d8e# ...
6
votes
1answer
568 views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
2
votes
1answer
482 views

Pass IMG SRC via GET and echo it? Is that really secure?

I was wondering how I can make a really simple GET and echo request more secure The code: $src = $_GET['src']; echo "<img src='$src' />"; Basically, I have a URL like ...
4
votes
2answers
97 views

What measures should I take after I find one of my scripts being vulnerable?

I maintain a few PHP-based websites for a small company on a LAMP server. The scripts include CMS such as Joomla or Wordpress, as well as SilverStripe and Drupal installations. A week ago, I found ...
4
votes
2answers
566 views

Number of page requests by any Bot in 5 secs

I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
2
votes
2answers
808 views

Is making my PHP files read-only a useful security measure?

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod. Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time? I'm ...
1
vote
1answer
252 views

MCrypt Module, Rijndael-256

An outside company is redoing our company Intranet. During some basic usage I disovered that the "User Edit" screens, with the "Password: *" boxes have the password in plain text, with the text box ...
0
votes
3answers
205 views

Need private personal access to ~three PHP pages

I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...
1
vote
1answer
556 views

SSL on multiple directories

I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
0
votes
1answer
438 views

How to deal with attacks on Zend Framework web site? site currently down

This is my first question on this "forum" please be indulgent with me if my questions are somewhat too simplistic for you. i joined this community in order to improve myself and help others.Thank you. ...
3
votes
3answers
263 views

Is there a way to scan websites externally for the recent PHP CGI flaw?

The recent PHP CGI flaw exposed (CVE-2012-1823) has me wondering if some of the legacy sites that I've inherited might be vulnerable. (see Physorg article) Does anybody know of a means to externally ...
1
vote
1answer
573 views

Is the php method md5() secure? Can it be used for passwords? [closed]

So executing a php script causes the form values to be sent to the server, and then they are processed. If you want to store a password in your db than you want it to be a cryptographic hash(so ...
5
votes
1answer
2k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
4
votes
2answers
368 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
2
votes
2answers
448 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
1
vote
2answers
164 views

How to setup SSL to protect secure information

At the moment I have a website running in quite an insecure way, I'll refer to it as example.com. To add better security we're starting to store passwords using bcrypt but we are currently not using ...
1
vote
1answer
380 views

Should I make pages on my website accessible by the admin only? How do I do it?

In my website idea I have got a number of pages that should be accessible by the admin only. Is this a good practice? (amateur alert) Also how do I protect these pages? I know about if ...
1
vote
1answer
123 views

Extra configuration needed after installing SSL certificate?

We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
1
vote
2answers
115 views

Opensource package for securly allowing users to log in and provide information

I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...
2
votes
2answers
67 views

How to block certain pages/files of a web domain?

How do I make certain pages only viewable by me? For example, let's say I own mydomain.com, and I want to be the only one that can see mydomain.com/mypage.php. I tried changing the permissions of ...
3
votes
3answers
2k views

What is deleteme.xxxxxxxx.php

I was going through page hit logs on awstats and I noticed the following two entries: /deleteme.lcivykmt.php /deleteme.nctqicjg.php I was wondering if anyone recognised them and whether I should ...
4
votes
1answer
103 views

How to promote the quality/security of your a website to your its customers?

Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of ...
4
votes
3answers
654 views

client website compromised, found a strange .php file. any ideas?

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
0
votes
3answers
176 views

File Access Permission

I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
2
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
3
votes
5answers
2k views

Disallow robots.txt from being accessed in a browser but still accessible by spiders?

We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't ...
1
vote
3answers
214 views

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
125 views

What is the purpose of the appserv_root requests?

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code. I am pretty ...
0
votes
1answer
1k views

Best free Vulnerability Scanners that check your websites PHP & MySQL code? [duplicate]

Possible Duplicate: Best free Vulnerability Scanners that check your websites PHP & MySQL code? I'm looking for a free vulnerability scanner to check whether my website has common ...
1
vote
1answer
460 views

Google Analytics shows 0 Visits?

I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday). Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...? How ...