Recall on memory paging# Memory paging is a way Operating Systems manage userland process memory. Each process memory access is virtual, and the OS together with the hardware MMU must translate that address into a physical address used to access the data in main memory (RAM). Paging memory is dividing memory in chunks of fixed size, called pages. Under Linux, page size is usually 4Kb for many plat

A blog reader (I have readers???) recently shared his wishlist, "I'm trying to figure out how to show the opcodes like you have in your post...". I promised that I'd throw something together, so here it is: Slow down, wtf is an "Opcode"? Short answer: It's the compiled form of a PHP script, similar in principle to Java bytecode or .NET's MSIL. For example, say you've got the following bit of PHP s

The repository for this book is available on GitHub. The PHP internals book is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Updated: 2023-07-02 :: Published: 2011-11-22 :: JR :: 8 min read (1658 words) I wrote before a guide Howto install Nginx/PHP-FPM on Fedora 29/28, CentOS/RHEL 7.5/6.10, but this guide is just installation guide and many cases Nginx and PHP-FPM basic configuration is good enough, but if you want to squeeze all the juice out of your VPS or web server / servers and do your maintenance work little bit

An extension used for detecting XSS codes(tainted string), And also can be used to spot sql injection vulnerabilities, shell inject, etc.

Yasca Yasca is a source code analysis tool that I started writing in 2007. It could best be described as a "glorified grep script" plus an aggregator of other open-source tools. Yasca can scan source code written in Java, C/C++, HTML, JavaScript, ASP, ColdFusion, PHP, COBOL, .NET, and other languages. Yasca can integrate easily with other tools, including: FindBugs PMD JLint JavaScript Lint PHPLin

MOPS Submission 09: RIPS – A static source code analyser for vulnerabilities in PHP scripts During the last hours of the CFP we received the following MOPS submission by Johannes Dahse. It is a static code analysing tool for PHP based on the tokenizer extension. Johannes Dahse [PDF Version]  [Download RIPS] Table of Contents Introduction The concept of taint analysis The tokenizer The web interfac

vulnerabilities Code Execution Command Execution Cross-Site Scripting Header Injection File Disclosure File Inclusion File Manipulation LDAP Injection SQL Injection Unserialize with POP XPath Injection code audit interface scan and vulnerability statistics grouped vulnerable code lines (bottom up or top down) vulnerability description with example code, PoC, patch exploit creator file list and gra

Since PHP 5, there has been a bundle of built-in exceptions – the “SPL exceptions” – in PHP. However, the documentation for these classes is quite lacking in examples, and it can be difficult to understand when you should be using them. The short answer is always. You’ll find a longer answer if you continue reading :) There is also a french translation of this post, by Frédéric Blanc. What are the