Beginner Code Review(Part 1)

Objective

High-Level Summary

Vulnerabilities

addfile function in user.php
jwt.php — when creating a jwt, special characters can affect the values of the token.
jwt.php — when verifying a jwt, if no signature if provided, the signature will not be checked.
register function in user.php contains no sanitization
db.php contains the username and password.
deploy.sql contains the admin credentials hard coded.
The function to get files in user.php
Proof of concept code.
register.php setting the cookies.
login.php setting the cookie.
index.php — there are no custom error messages so any errors will output excess information.
user.php — Md5 is used for storing the password when registering.
Register.php — Error messages for the user already existing.
Login.php — The code for the login page.
The signing function on jwt.php

What’s next

Appendix A

jwtverify.php
createjwt.php
No signature but the function has no returned an invalid signature

--

--

--

Blogging

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Beware of Mallu Cyber Soldiers

Countdown to Zero Day

https://wn.nr/2N2Sgt

{UPDATE} World Of Craft Hack Free Resources Generator

Product Release | Anonymous Transaction Demo Images

Introducing Dexter

What is Access Management?

The Computer Firewall

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Adam C

Adam C

Blogging

More from Medium

How to use mv command in Linux?

Getting Started with Git Basics

Why even programming beginners should use GitHub

How to make Programming Fun?

Image with person frustrated in front of laptop