php-crypto-audit

PHP Encryption and Key Security Audit (php-crypto-audit)

Analyze the encryption and hashing implementations of passwords/tokens/sensitive data in PHP project source code, and detect:

• Weak hashing (MD5/SHA1/no salt)
• Insecure symmetric/asymmetric cryptographic usage (ECB, fixed IV, wrong mode)
• Signature verification flaws (JWT not verified, HMAC misuse, algorithm choice controllable)
• Hardcoded keys/plaintext key leakage

Severity ratings and numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-CRYPTO-{序号}

Mandatory Sinks (Mandatory)

The following implementation points must be searched and analyzed (replace according to the actual project):

• Password hashing:md5/sha1/hash(not password_hash),crypt parameter misuse
• Secure hashing:password_hash/password_verify(check whether the parameters are correct)
• Symmetric encryption:openssl_encrypt/decrypt(check mode/iv)
• Signatures:hash_hmac、openssl_sign, JWT verify/signature comparison implementations

Mandatory Inspection Requirements (Mandatory)

• Must locate the "key source": hardcoded/environment variable/configuration file/request parameter
• Must determine "whether verification is reliable": whether the algorithm is controllable or there is comparison timing leakage
• Must output remediation recommendations and migration plans (for example, upgrading the hash algorithm, enforcing parameterized modes)

PoC (Mandatory Framework)

Since cryptographic vulnerabilities may depend on the environment, the PoC must at least provide:

• An executable "verification framework" (for example, constructing a JWT payload and explaining the verification failure/bypass that should occur)
• Or provide observable evidence (for example, log leakage, error patterns producing reversible results)

Report Output

{output_path}/vuln_audit/crypto_{timestamp}.md