Adblock Detected

A dupla MySQL e PHP têm várias vantagens

Read

DAws - Advanced Web Shell (Windows/Linux)

Read

There's multiple things that makes DAws better than every Web Shell out there:

Bypasses Disablers; DAws isn't just about using a particular function to get the job done, it uses up to 6 functions if needed, for example, if shell_exec was disabled it would automatically use exec or passthru or system or popen or proc_open instead, same for Downloading a File from a Link, if Curl was disabled then file_get_content is used instead and this Feature is widely used in every section and fucntion of the shell.
Automatic Encoding; DAws randomly and automatically encodes most of your GET and POST data using XOR(Randomized key for every session) + Base64(We created our own Base64 encoding functions instead of using the PHP ones to bypass Disablers) which will allow your shell to Bypass pretty much every WAF out there.
Advanced File Manager; DAws's File Manager contains everything a File Manager needs and even more but the main Feature is that everything is dynamically printed; the permissions of every File and Folder are checked, now, the functions that can be used will be available based on these permissions, this will save time and make life much easier.
Tools: DAws holds bunch of useful tools such as "bpscan" which can identify useable and unblocked ports on the server within few minutes which can later on allow you to go for a bind shell for example.
Everything that can't be used at all will be simply removed so Users do not have to waste their time. We're for example mentioning the execution of c++ scripts when there's no c++ compilers on the server(DAws would have checked for multiple compilers in the first place) in this case, the function would be automatically removed and the User would know.
Supports Windows and Linux.
Openned Source.

Extra Info

Eval Form:

`include` is being used instead PHP `eval` to bypass Protection Systems.

Download from Link - Methods:

PHP Curl
File_put_content

Zip - Methods:

Linux:

Windows:

Vbs Script

Shells and Tools:

Extra:

`nohup`, if installed, is automatically used for background processing.

Download DAws

Web Application Protection - Tool to detect and correct vulnerabilities in PHP web applications

Read

WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP (version 4.0 or higher) and with a low rate of false positives. WAP detects and corrects the following vulnerabilities:

SQL Injection (SQLI)
Cross-site scripting (XSS)
Remote File Inclusion (RFI)
Local File Inclusion (LFI)
Directory Traversal or Path Traversal (DT/PT)
Source Code Disclosure (SCD)
OS Command Injection (OSCI)
PHP Code Injection

This tool semantically analyses the source code. More precisely, it does taint analysis (data-flow analysis) to detect the input validation vulnerabilities. The aim of the taint analysis is to track malicious inputs inserted by entry points ($_GET, $_POST arrays) and to verify if they reaches some sensitive sink (PHP functions that can be exploited by malicious input). After the detection, the tool uses data mining to confirm if the vulnerabilities are real or false positives. At the end, the real vulnerabilities are corrected with the insertion of the fixes (small pieces of code) in the source code. WAP is written in Java language and is constituted by three modules:

Code Analyzer: composed by tree generator and taint analyser. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.

False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyser, this module collects the presence of the attributes that define a false positive. Then, the Logistic Regression algorithm receives them and classifies the instance as being a false positive or not (real vulnerability).

Code Corrector: Each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created.

Download WAP

PHP Basics #5 : PHP Data Types

Read

PHP Basics #4 : Variables

Read

PHP Basics #3 : How to get Started with PHP coding ?

Read

How to get started with PHP Development ?

(Continue only if you Successfully Installed Apache, PHP and MySQL)

So now you know how to run a php file in browser and its time to get started in php development !!

Today we will talk about :

How to write PHP codes
Basic Syntax
Echo Statement

1) How to write PHP codes ?

PHP codes can be written in any php file which means a file with .php extension and you can write it using any text editor but you must know that to write php codes you have to tell the browser that these are php codes not html and to do that all you have to do is open the php tag like all other html tags and then when php codes finishes close the php tag .. The opening php tag is and the closing php tag is ?> . The browser will take all the codes between the as PHP codes. And after you complete each php like you have to end with a semi-colon ; . A semi-colon tell the browser that the command ended.

All codes here are PHP codes

?>

2) Basic Syntax of PHP

PHP has very easy syntax rules as compared to other programming or scripting languages, the most important rule is to end your every statement with a semi-colon. We will demonstrate it soon and you will get hang of it.
One more important thing in php to remember is that white spaces had no effect in php coding there is no indentation rules in php, which for me is quite good.

3) echo

If you have any experience with any programming languages then I guess you know what this statement does and for those who dont know this statement simply prints out anything you want on the screen. So if you have gone through the Last Tutorial of this series you must have created a folder in you localhost path named test and now time to use this folder for demonstration of all the exercises.
The syntax of echo statement is
To print text in browser -> echo "Quotes if Text";
To print numbers in browser -> echo 1;
So create a new file named echo.php and inside the folder test and type the following inside the echo.php file..

echo "Hello World!!";

?>

If you open the file in browser the result will be..

Hello World!!

You can also do other things such as maths calculations..

echo 2+2;

?>

Result :

This was some basics of php codes and in next tutorials we will learn about PHP Variables and all..Till then do some experiments with your codes and try some more examples .. If you get stuck anywhere please comment

PHP Basics #1 : Introduction to PHP

Read

PHP Basics #2 : How to Install Apache, PHP and MySQL

Read

PHP Secure Configuration Checker - Check current PHP configuration for potential security flaws

Read

Among the most tedious tasks of PHP security testing is the check for insecure PHP configuration. As a successor of our PHP Security Poster, we have created a script to help system administrators as well as security professionals to assess the state of php.ini and related topics as quickly and as thoroughly as possible. For later reference, the script is called "PHP Secure Configuration Checker" , or pcc.

Inspiration and previous work

phpinfo(): Just like phpinfo() the pcc is supposed to give a brief overview of security related configuration issues.
phpsecinfo: This is an alternative project that appears to have been discontinued in 2007.
SektionEins PHP Security Poster (2009-2011): Some text snippets and recommendations of our own work we put into the popular poster have been reused.

Ideas, Features and Software Design

One single file for easy distribution: In respect to an update process and access restrictions, a single file can be handled easier than a whole web application monster.
Simple tests for each security related ini entry: Testing php.ini on a live system is the main aspect of this project. Each entry is supposed to be checked or otherwise actively ignored.
A few other tests: pcc is not restricted to php.ini checks. Other ideas can be implemented as well.
Compatibility: PHP 5.4 is supposed to work. Older PHP versions are not supposed to be used in the wild anyway.
NO complicated/overengineered code, e.g. no classes/interfaces, test-frameworks, libraries, ...: In most cases, a recommendation is based on a simple boolean decision, e.g. is it 1 or is it 0. The corresponding code is supposed to reflect this simplicity. Also, simple code leads to fewer programming errors.
Novice factor: The result is supposed to help secure the PHP environment. There is no need to obfuscate, encrypt or hide the code. Even unexperienced developers or system administrators may take a glance at the code - free of charge.
NO (or very few) dependencies: pcc is supposed to run in the most simplistic (yet still realistically sane) PHP environment. Writing files and loading bloated library code should be avoided.
Safeguards: In order to prevent information disclosure, IP restrictions are implemented, as well as a lock-out mechanism based on the script's modification time.
Suhosin: pcc checks the correct configuration of the Suhosin extension.

Download PHP Secure Configuration Checker

FuckShitUp - Multi Vulnerabilities Scanner written in PHP

Read

Basically, FSU is bunch of tools written in PHP-CLI. Using build-in functions, you are able to grab url's using search engines - and so, dork for interesting files and full path disclosures. Using list of url's, scanner will look for Cross Site Scripting, Remote File Inclusion, SQL Injection and Local File Inclusion vulnerabilities. It is able to perform mass bruteforce attacks for specific range of hosts, or bruteforce ssh with specific username taken from FPD. Whenever something interesting will be found, like vulnerability or broken auth credentials, data will be saved in .txt files - just like url's, and any other files. FSU is based on PHP and text files, it's still under construction so i am aware of any potential bugs. Principle of operation is simple.

More url's -> more vuln's. For educational purposes only.

Intro

Data grabbing:
- URL's (geturl/massurl) -> (scan)
- Configs, Databases, SQLi's (dork)
- Full Path Disclosures / Users (fpds) -> (brutefpds)
- Top websites info (top)
Massive scanning
- XSS, SQLi, LFI, RFI (scan)
- FTP, SSH, DB's, IMAP (multibruter)
- Accurate SSH bruteforce (brutefpds)

Plan

Web Apps
- Grab url's via 'geturl' or 'massurl' (massurl requires list of tags as file)
- Scan url's parameters for vulns with 'scan'
Servers
- Pick target, get ip range
- Scan for services on each IP and bruteforce with 'multibruter'
- Grab full path disclosures, and so linux usernames
- Perform SSH bruteforce for specific user with 'brutefpds'
Info grabbing
- Use 'dork' for automatic dorking
- Use 'fpds' for full path disclosure grabbing
- Use 'search' for searching someone in ur databases
- Use 'top' for scanning all top websites of specific nation
Others
- 'Stat' shows actual statistics and informations
- 'Show' display specific file
- 'Clear' and 'filter' - remove duplicates, remove blacklisted url's

Others

MultiBrtuer requirements (php5):

php5-mysql - for mysql connections
php5-pgsql - for postgresql connections
libssh2-php - for ssh connections
php5-sybase - for mssql connections
php5-imap - for imap connections

TODO:

Fix problems with grabbing large amount of url's
More search engines
SQL Injector
RFI shell uploader
FSU is not secure as it should be

Download FuckShitUp

PHP Security Update

Read

Hostscan - PHP tool for scanning specific range of hosts

Read

Two Security Updates: libyaml and PHP

Read

[Weevely v1.1] Stealth tiny PHP web shell

Read

PHP Basic Interview Questions and Answers for Web Developers - Part 1

Read

PHP Basic Interview Questions and Answers for Web Developers - Part 1

In this article on PHP Interview Questions, I have compiled a list of very basic and fundamental PHP interview questions and answers for web developers. Every PHP web developer should know these basic questions of PHP. So, if you are preparing for any interview in PHP development, you should go through the following list of PHP basic interview questions. There PHP questions are based on very simple PHP concepts like basic introduction to PHP, Sessions and Cookies in PHP, Input / Output in PHP, Error Management in PHP, MySQL database connectivity in PHP, SQL Injection in PHP, Encryption and Decryption in PHP, Sending Emails in PHP, datatypes in PHP and many more. Lets have a look...

1. What is PHP?

PHP is a server side scripting object oriented language commonly used for web applications.

2. What is the use of "echo" in php?

It is used to print a data in the webpage.

Example:

The above code print the text in the webpage

3. How to include a file to a php page?

We can include a file using "include()" or "require()" function with file path as its parameter.

4. What's the difference between include and require?

If the file is not found by require(), it will cause a fatal error and halt the execution of the script. If the file is not found by include(), a warning will be issued, but execution will continue.

5. What is difference between require_once(), require() and include()?

require() includes and evaluates a specific file, while require_once() does that only if it has not been included before (on the same page). So, require_once() is recommended to use when you want to include a file where you have a lot of functions for example. This way you make sure you don't include the file more times and you will not get the "function re-declared" error.

6. Differences between GET and POST methods?

We can send 1024 bytes using GET method but POST method can transfer large amount of data and POST is the secure method than GET method .

7. How to declare an array in php?

Eg : var $arr = array('apple', 'grape', 'lemon');

8. What is the use of 'print' in php?

This is not actually a real function, It is a language construct. So you can use without parentheses with its argument list.

Example:

print('PHP Interview Questions');
print 'PHP Interview Questions';

9. What is use of in_array() function in php?

in_array used to checks if a value exists in an array

10. What is use of count() function in php?

count() is used to count all elements in an array, or something in an object

11. What is the difference between Session and Cookie?

The main difference between sessions and cookies is that sessions are stored on the server, and cookies are stored on the user’s computers in the text file format. Cookies can not hold multiple variables, but Session can hold multiple variables. We can set expiry for a cookie while the session only remains active as long as the browser is open. Users do not have access to the data you stored in Session because it is stored in the server. Session is mainly used for login/logout purpose while cookies using for user activity tracking

12. How to set cookies in PHP?

Setcookie("sample", "ram", time()+3600);

13. How to retrieve a Cookie Value?

eg : echo $_COOKIE["user"];

14. How to create a session? How to set a value in session ? How to remove data from a session?

Create session : session_start();
Set value into session : $_SESSION['USER_ID']=1;
Remove data from a session : unset($_SESSION['USER_ID'];

15. What types of loops exist in php?

for,while,do while and foreach

16. How to create a mysql connection?

mysql_connect(servername,username,password);

17. How to select a database?

mysql_select_db($db_name);

18. How to execute an sql query? How to fetch its result ?

$my_qry = mysql_query("SELECT * FROM `users` WHERE `u_id`='1'; ");
$result = mysql_fetch_array($my_qry);
echo $result['First_name'];

19. Write a program using while loop

$my_qry = mysql_query("SELECT * FROM `users` WHERE `u_id`='1'; ");
while($result = mysql_fetch_array($my_qry))
{
echo $result['First_name'.]."
";
}

20. How we can retrieve the data in the result set of MySQL using PHP?

1. mysql_fetch_row
2. mysql_fetch_array
3. mysql_fetch_object
4. mysql_fetch_assoc

21. What is the use of explode() function?

Syntax : array explode ( string $delimiter , string $string [, int $limit ] );

This function breaks a string into an array. Each of the array elements is a substring of string formed by splitting it on boundaries formed by the string delimiter.

22. What is the difference between explode() and split() functions?

Split function splits string into array by regular expression. Explode splits a string into array by string.

23. What is the use of mysql_real_escape_string() function?

It is used to escapes special characters in a string for use in an SQL statement

24. Write down the code for save an uploaded file in php.

if ($_FILES["file"]["error"] == 0)
{
move_uploaded_file($_FILES["file"]["tmp_name"],
"upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
}

25. How to create a text file in php?

$filename = "/home/user/guest/newfile.txt";
$file = fopen( $filename, "w" );
if( $file == false )
{
echo ( "Error in opening new file" ); exit();
}
fwrite( $file, "This is a simple test\n" );
fclose( $file );

26. How to strip whitespace (or other characters) from the beginning and end of a string?

The trim() function removes whitespaces or other predefined characters from both sides of a string.

27. What is the use of header() function in php?

The header() function sends a raw HTTP header to a client browser.Remember that this function must be called before sending the actual out put.For example, You do not print any HTML element before using this function.

28. How to redirect a page in php?

The following code can be used for it, header("Location:index.php");

29. How stop the execution of a php script?

exit() function is used to stop the execution of a page

30. How to set a page as a home page in a php based site?

index.php is the default name of the home page in php based sites

31. How to find the length of a string?

strlen() function used to find the length of a string

32. What is the use of rand() in php?

It is used to generate random numbers.If called without the arguments it returns a pseudo-random integer between 0 and getrandmax(). If you want a random number between 6 and 12 (inclusive), for example, use rand(6, 12).This function does not generate cryptographically safe values, and should not be used for cryptographic uses. If you want a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.

33. What is the use of isset() in php?

This function is used to determine if a variable is set and is not NULL

34. What is the difference between mysql_fetch_array() and mysql_fetch_assoc()?

mysql_fetch_assoc function Fetch a result row as an associative array, While mysql_fetch_array() fetches an associative array, a numeric array, or both

35. What is mean by an associative array?

Associative arrays are arrays that use string keys is called associative arrays.

36. What is the importance of "method" attribute in a html form?

"method" attribute determines how to send the form-data into the server.There are two methods, get and post. The default method is get.This sends the form information by appending it on the URL.Information sent from a form with the POST method is invisible to others and has no limits on the amount of information to send.

37. What is the importance of "action" attribute in a html form?

The action attribute determines where to send the form-data in the form submission.

38. What is the use of "enctype" attribute in a html form?

The enctype attribute determines how the form-data should be encoded when submitting it to the server. We need to set enctype as "multipart/form-data" when we are using a form for uploading files

39. How to create an array of a group of items inside an HTML form?

We can create input fields with same name for "name" attribute with squire bracket at the end of the name of the name attribute, It passes data as an array to PHP.

For instance :

40. Define Object-Oriented Methodology.

Object orientation is a software/Web development methodology that is based on the modeling a real world system.An object is the core concept involved in the object orientation. An object is the copy of the real world enity.An object oriented model is a collection of objects and its inter-relationships

41. How do you define a constant?

Using define() directive, like define ("MYCONSTANT",150)

42. How send email using php?

To send email using PHP, you use the mail() function.This mail() function accepts 5 parameters as follows (the last 2 are optional). You need webserver, you can't send email from localhost. eg : mail($to,$subject,$message,$headers);

43. How to find current date and time?

The date() function provides you with a means of retrieving the current date and time, applying the format integer parameters indicated in your script to the timestamp provided or the current local time if no timestamp is given. In simplified terms, passing a time parameter is optional - if you don't, the current timestamp will be used.

44. Difference between mysql_connect and mysql_pconnect?

There is a good page in the php manual on the subject, in short mysql_pconnect() makes a persistent connection to the database which means a SQL link that do not close when the execution of your script ends. mysql_connect()provides only for the databasenewconnection while using mysql_pconnect , the function would first try to find a (persistent) link that's already open with the same host, username and password. If one is found, an identifier for it will be returned instead of opening a new connection... the connection to the SQL server will not be closed when the execution of the script ends. Instead, the link will remain open for future use.

45. What is the use of "ksort" in php?

It is used for sort an array by key in reverse order.

46. What is the difference between $var and $$var?

They are both variables. But $var is a variable with a fixed name. $$var is a variable who's name is stored in $var. For example, if $var contains "message", $$var is the same as $message.

47. What are the encryption techniques in PHP?

MD5: PHP implements the MD5 hash algorithm using the md5 function.

eg : $encrypted_text = md5 ($msg);

mcrypt_encrypt: string mcrypt_encrypt ( string $cipher , string $key , string $data , string $mode [, string $iv ] );

Encrypts plaintext with given parameters

48. What is the use of the function htmlentities?

htmlentities Convert all applicable characters to HTML entities This function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities.

49. How to delete a file from the system?

Unlink() deletes the given file from the file system.

50. How to get the value of current session id?

session_id() function returns the session id for the current session.

51. What are the differences between mysql_fetch_array(), mysql_fetch_object(), mysql_fetch_row()?

Mysql_fetch_array Fetch a result row as an associative array, a numeric array, or both.
mysql_fetch_object ( resource result ) Returns an object with properties that correspond to the fetched row and moves the internal data pointer ahead. Returns an object with properties that correspond to the fetched row, or FALSE if there are no more rows
mysql_fetch_row() fetches one row of data from the result associated with the specified result identifier. The row is returned as an array. Each result column is stored in an array offset, starting at offset 0.

52. What are the different types of errors in PHP?

Here are three basic types of runtime errors in PHP:

1. Notices: These are trivial, non-critical errors that PHP encounters while executing a script - for example, accessing a variable that has not yet been defined. By default, such errors are not displayed to the user at all - although you can change this default behavior.

2. Warnings: These are more serious errors - for example, attempting to include() a file which does not exist. By default, these errors are displayed to the user, but they do not result in script termination.

3. Fatal errors: These are critical errors - for example, instantiating an object of a non-existent class, or calling a non-existent function. These errors cause the immediate termination of the script, and PHP's default behavior is to display them to the user when they take place.

53. What is SQL Injection?

SQL injection is a malicious code injection technique.It exploiting SQL vulnerabilities in Web applications

54. What is x+ mode in fopen() used for?

Read/Write. Creates a new file. Returns FALSE and an error if file already exists

55. How to find the position of the first occurrence of a substring in a string?

strpos() is used to find the position of the first occurrence of a substring in a string

56. What is PEAR?

PEAR is a framework and distribution system for reusable PHP components.The project seeks to provide a structured library of code, maintain a system for distributing code and for managing code packages, and promote a standard coding style.PEAR is broken into three classes: PEAR Core Components, PEAR Packages, and PECL Packages. The Core Components include the base classes of PEAR and PEAR_Error, along with database, HTTP, logging, and e-mailing functions. The PEAR Packages include functionality providing for authentication, networking, and file system features, as well as tools for working with XML and HTML templates.

57. Distinguish between urlencode and urldecode?

This method is best when encode a string to used in a query part of a url. it returns a string in which all non-alphanumeric characters except -_. have replece with a percentege(%) sign . the urldecode->Decodes url to encode string as any %and other symbole are decode by the use of the urldecode() function.

I will come up with more PHP interview questions and answers in second part of this post.