Skip to content
Opsec

PHP & web applications

The web agent understands the frameworks your long-lived applications are built on, including the legacy code nobody wants to touch.

Request accessHow validation works

Coverage

  • PHP
  • Laravel
  • Symfony
  • WordPress
  • Drupal

What it finds

Vulnerability classes, confirmed.

  • Confirmed class

    SQL injection

    Concatenated queries, unsafe query builders and second-order injection through stored data.

  • Confirmed class

    File inclusion & upload

    Local and remote file inclusion, path traversal and upload handlers that execute content.

  • Confirmed class

    Session management

    Fixation, predictable identifiers, missing rotation and insecure cookie attributes.

  • Confirmed class

    Cross-site scripting

    Reflected, stored and DOM XSS through templates, plugins and rich-text fields.

  • Confirmed class

    Plugin & theme risk

    Vulnerable third-party extensions mapped to the code paths you actually expose.

  • Confirmed class

    Request forgery

    State-changing endpoints missing CSRF protection or relying on referer checks.

Validation

Nothing is reported until it is proven.

  1. Step 1 / 3

    Stand up the stack

    Opsec runs the application with its web server, PHP version and extensions pinned to production.

  2. Step 2 / 3

    Replay the request

    The agent submits the crafted request and captures the response, logs and database effects.

  3. Step 3 / 3

    Confirm the effect

    Only issues that read data, execute code or change state in the replica are reported.

Example finding

What lands in your queue.

Each finding carries the exploit path the validator walked and the repair it verified.

TSR-2304storefrontapp/orders/view.php
High

SQL injection in order lookup

CWE-89 · PHP & web agent · Exploitability 8.9

Exploit path

The id query parameter is interpolated directly into SQL. An unauthenticated request can read any row in the orders table.

Why the fix works

Validates the parameter as an integer and replaces string interpolation with a prepared statement bound by type.

Generated repair
$id  = $_GET['id'];
$res = mysqli_query($db, "SELECT * FROM orders WHERE id = $id");
$id   = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
$stmt = $db->prepare('SELECT * FROM orders WHERE id = ?');
$stmt->bind_param('i', $id);
$stmt->execute();
$order = $stmt->get_result()->fetch_assoc();
  • Injection payloads rejected
  • Integration tests pass (48)
  • No behavior change for valid IDs

Other solutions

See what's exploitable in your environment.

Opsec is available to a limited number of security teams. Request access and we'll scope a private deployment with you.

Request accessBook a briefing