During our audits, we often encounter user enumerations that could be easily avoided with the right methods. In this article, we will discuss user enumerations on login forms, password reset forms, and account creation forms. However, user enumerations may be present on other features, such as search forms or message submissions.

The usual way to manage users’ sessions in a PHP application is to use session cookies, named “PHPSESSID” by default. When a user connects to the application, it generates a unique session identifier, that is stored on the server and then returned to the client with the “Set-Cookie” header. With that, the session cookie is stored on the web browser.
Cookies are designed to be systematically sent back to the server, on every request. That solution is a good way to handle usual user login and logout scenarios.

However, this type of mechanics does not allow multiple platforms or applications to easily authenticate a user with a single session. Also, the server needs to keep the session’s state and data in its memory.

This series of articles will walk you through the most important topics about security and mobile applications, whatever the platform is (iOS, Android or others).
The objective is to demystify the different aspects of mobile security, in simple words.

This third episode will walk you through vulnerabilities related to data transportation.

This series of articles will walk you through the most important topics about security and mobile applications, whatever the platform is (iOS, Android or others).
The objective is to demystify the different aspects of mobile security, in simple words.

This second episode makes a focus on insecure data storage.

This series of articles will walk you through the most important topics about security and mobile applications, whatever the platform is (iOS, Android or others).
The objective is to demystify the different aspects of mobile security, in simple words.

Topic number 1 this week: Server-side controls

Updated: 23 Dec. 2020

This article does not replace a good knowledge of security principles in PHP, but can give you some good advices that really boost security.
There will be nothing to copy/paste straight forward to your PHP files. But we believe that these tips and best practices will bring you long-term benefits if you understand and implement the different points according to your needs and context.

This article is the third of our series dedicated to PHP security. The first article gives you guidelines for PHP configuration, updates, data filtering and sanitization, as well as code organization.
The second article discusses protections against known and common attacks.

We will now take a look at file uploads, CRSF, cookies and security through obscurity.

Updated: 23 Dec. 2020

This article does not replace a good knowledge of security principles in PHP, but can give you some good advices that really boost security.
There will be nothing to copy/paste straight forward to your PHP files. But we believe that these tips and best practices will bring you long-term benefits if you understand and implement the different points according to your needs and context.

This article is the second of our series dedicated to PHP security. The first article “How to Protect Your Website: PHP Security Tips and Tricks #1” gives you basic guidelines for PHP configuration, updates, data filtering and sanitization, as well as code organization.

We will now look at common hacking attacks against PHP websites and how to defend yourself against them.

Updated: 1 Dec. 2020

PHP remains the most popular server-side programming language: it is used by almost 80% of websites (source). This language continues to be developed, and PHP 8 was released last week ! This version brings new features and should enhance security.

However, the security of PHP builds up from its ‘historical’ core features. The following article does not replace a good knowledge of PHP, and there will be nothing to copy/paste directly into your files. But we believe that these tips and best practices will bring you long-term benefits if you understand and implement the different points according to your needs and context.

Today we cover PHP configuration, updates, code organisation and data filtering/escaping.

What is 2FA

Two Factor Authentication (2FA) is a way to strengthen users authentication.
A good example is when you want to trigger a bank transfer from your bank website: depending on your bank, you may receive a text message on your mobile phone, containing a code that you must put back on the website to confirm the transfer.

The second factor can be a phone, a physical object in your possession, some physical characteristic (biometrics) or a secret that only you know.

A 2FA process comes with some disadvantages: it makes the authentication process more complex, and the second factor has to be “available”, which can be a problem with a mobile. Flat battery, bad network coverage or any other hazard can prevent the process from working properly.