A Random History of PHP

PHP 7 for the first time introduced simple consistent functions to access good quality pseudo-random values from within PHP applications. But many applications written for earlier PHP versions, or still supporting them, use other methods to generate random values – with mixed results.
Such home-cooked methods often use unsuitable pseudo-random generators and seeding methods. We will take a look at the weird and wonderful methods developers have used in common open-source applications such as Wordpress and Magento. After digging down into the PHP source to find what the underlying functions actually rely on we will be putting on our hacking hats to try breaking an example application using bad random.

Comments

Comments are closed.