auditing-php-applications

Auditing PHP Applications

This is the PHP-specific layer on top of auditing-code-for-vulnerabilities. Take the methodology from that skill — context → attack surface → bug-class hunt → variant analysis → the four-question verification gate — and apply the PHP sink catalog below to it. This skill exists because PHP has footguns no language-agnostic methodology carries: features that turn a file read into remote code execution, and comparison rules that turn == into an auth bypass.

The collection deliberately has no per-language audit skills except this one. PHP earns the exception because it dominates the legacy-web and WordPress/Magento space where critical bugs actually live, and because its dynamic features fail in ways a reviewer must be primed for specifically.

When to Use

• Reviewing a PHP codebase or plugin for exploitable vulnerabilities
• Auditing a WordPress, Magento, Joomla, or Laravel application's source
• Tracing a suspected RCE, LFI, SQLi, or object-injection path in PHP
• Deciding whether a unserialize, include, or == on user input is exploitable

When NOT to Use

• General audit methodology, or a non-PHP language — use auditing-code-for-vulnerabilities; this skill assumes it
• Finding a planted webshell or backdoor rather than a vulnerability — use hunting-web-backdoors
• Building the deserialization exploit chain once you have the sink — use exploiting-deserialization
• Black-box testing a running app — use testing-web-applications
• Reviewing only the diff of a change — use reviewing-code-changes

Sinks by Bug Class

Trace user input (superglobals, headers, uploaded filenames, DB values that were once user input) to each of these. A sink is only a bug when a source reaches it.

Remote code execution

• Direct eval sinks: eval, assert (string arg, pre-8.0), preg_replace with /e (pre-7.0), create_function (pre-8.0), mb_ereg_replace/mb_eregi_replace with the e option.
• Command execution: system, exec, passthru, shell_exec, backticks, proc_open, popen, pcntl_exec. Watch escapeshellarg vs escapeshellcmd misuse — escapeshellcmd does not prevent argument injection.
• Dynamic dispatch: $func() where $func derives from input, call_user_func/call_user_func_array, array_map/usort/ preg_replace_callback with a user-influenced callback.