Jump to content
xisto Community

jipman

Members
 View Profile  See their activity

  • Content Count

    717

  • Joined

  • Last visited

Posts posted by jipman

  1. Posted · Report reply

    yup, above situation is incase you only know the usernameIf you don't know the username and the password, what you said with those OR's probably would work too but is quite difficult to understand, and i also recall something about ... OR .. OR .. structures. Let's make it a bit easierusername: a' OR '1password: a' OR '1SELECT * FROM users WHERE user = 'a' OR '1' AND pass = 'a' OR '1'although you should not put numeric values between quotes, you will get away with this. Since the INTEGER 1 still equals the string 1 (same byte)

  2. Posted · Report reply

    no, it's a just chops off the rest of the query. eg

    SELECT * FROM users WHERE user = 'foobar' -- AND 'a'='a' AND pass = 'thisdoesnotmatter'

    will become

    SELECT * FROM users WHERE user = 'foobar'

    I should have explained it better but the -- makes everything behind it comment so the server ignores them. It's not really pretty I guess, but it works.

    Read about them here:
    http://forums.xisto.com/no_longer_exists/

  4. Posted · Report reply

    I think he means that he has just a total amount of 75mb space showing up in his cPanel, I had that sort of problem too. You need to ask opaque (der uber admin) to fix this, since he's the only one with the appropriate clearance level) .... appropriate clearance level... dang, that sounds cool :(

  5. Posted · Report reply

    Unless you can create a model that creates the most possible combination of keys that you get when i mash my keyboard randomly you're not likely to find out my secret answer.TIPTake questions like "What's my pet's name" and answer like this.asdflj12l34j12089sdfasdlfkjl12j3l1j23409809qw8er0qwerjlasdjfWanna bet that noone guesses that? Only problem is that you cannot afford to lose your normal password.

  6. Posted · Report reply

    Secure PHP coding

    Today, PHP is a very common and very popular scripting language that is used by many people over the world. However, many php scripts that they make are vulnerable to 'hacks' by leaving some security holes open. This article will explain how someone can abuse your script and can alter your site/files, but also (even more important), this article will tell you how to PREVENT your site from being hacked and how to spot and fix those security holes.

    Contents:

    - Chapter 1 : To serve or not to serve
    - Chapter 2 : MySql, friend or foe?
    - Conclusion

    Chapter 1

    As many people know, you can use the include command to will save you from doing tedious copy's and paste's by including a file directly into the script for processing. Almost everyone that uses PHP in their website use it to make it easier to serve it's contents.

    a small example




    INDEX.PHP------------<?php  $page = $_GET['page'];   include ($page.'txt');?>

    The include-line opens the file $page, add the extension .txt to it and virtually pastes the contents instead of the include line. variable $page is filled by using a GET request in your browser.

    e.g. <a href="index.php?page=foobar">Click here</a>

    However, what if someone does this

    index.php?page=http://forums.xisto.com/no_longer_exists/

    This will have YOUR index.php running PHP code (from the file exploitcode.txt , the script adds the txt extension itself (in this case)) from another site, there's no need to say that now you're entire site is open and the attacker can run any code he/she wants at will.

    We ofcourse certainly don't want this, so here are a few ways to prevent this from happening.

    1. using the file_exists command that verifies if a file exists on the server itself. eg.
     



    <?php  $page = $_GET['page'];  if (file_exists($page)) {     include ($page.'txt');  }?>

    This will first check if the file exists on the server itself and will not include files from other servers. (In php5 it's slightly different, see http://php.net/manual/en/function.file-exists.php)

    2. Second method (my personal favorite), i like to call this method barrier style. It's perfect only it needs quite more code. example:
     



    <?php  $page = $_get['page'];  switch ($page)    default:      include ('home.txt');      break;    case 'foobar':      include ('foobar.txt');      break;    case 'links':      [I]etc etc[/I]

    This actually places some sort of barrier between the user input and the execution. This is what is does.

    the switch is an extended if-then sequence, it basicly checks every 'case' and watches if there is a value stated behind it that matches the input variable. If it matches it then will do the action stated under it and jump out of the switch at the break command. Since the input is always checked so it's no use to enter something that will leave your script open, e.g. If you'd enter http://forums.xisto.com/no_longer_exists/, it would not match up with any of the cases and will force the default action to be executed.

    3. Of course there are many other ways to do this but the most important thing is to check the user input.

    This brings us to the second chapter, mysql

    Chapter 2

    It's also a common sign for site use databases like MySQL, since I don't give a ** about M$-SQL, I will discuss MySQL only.

    For password authentications, MySQL databases can prove to be very usefull and hold a few advantages to flat-files, they are encrypted, they are password protected and they are way easier to manage. Here's a little example system
     



    <?php  $handle = mysql_connect($server,$user,$pass);   mysql_select_db($databasename);       $input_user = $_POST['user'];   $input_pass = $_POST['pass'];   $result = mysql_query('SELECT * FROM users WHERE user = '{$input_user}' AND pass = '{$input_pass});   if (mysql_num_rows($result) == 0)   {      echo 'Not logged in';    }    else    {      echo 'Logged in';     }?>

    The system first connects to the database server with the username and password. Then it selects the database. (note. I left out the error handling code because it's not relevant in this case).

    Then it searches the table users for records (rows) that have $user as user and $pass as password. Since every user must be unique, all you need is to count the number of rows that has the correct password/username. For that we use the mysql_num_rows command, it simply returns the number of rows that are in the result of the previous query.

    This system can also be easily exploited.

    let's say that we have something like this

    SELECT * FROM users WHERE user = 'foobar'-- AND 'a'='a' AND pass = 'thisdoesnotmatter'

    In this case, the inputted username is foobar'-- AND 'a'='a
    Since the input is not checked, the script plainly passes the input to the query. The query will do something different now, the -- tells the SQL server to ignore everything that comes after it so the query would look like this : SELECT * FROM users WHERE user = 'foobar' ...... Well I guess anyone would see this is a free login without even needing to know the password. There are endless variations like using .. OR .. statements, or UNION statements etc etc.

    To prevent this kind of abuse you need to know the following stuff. MySQL is very sensitive for quotes placed on the wrong place. Luckily, there is a command that will addslashes to a string to neutralize those bloody quotes, mysql_real_escape_string() does that, it makes the input foobar'-- AND 'a'='a looks like
    foobar\'-- AND \'a\'=\'a, which can be inserted into a query without a prob since it will check for the username foobar'-- AND 'a'='a, which is not a danger. Because now it cannot cut off the rest of query as it previously could.

    Conclusion

    This kinda wraps it up for today, these are the most important things to look at if you ever decide to create some site in PHP. There is one rule that is highly important and if you live by it you should be quite safe:

    Don't ever ever trust the bloody user input

    Why? you ask, that's logical, it's USER input.

    normal-user = user
    american = user
    hacker = user

    On the other hand, if you do get hacked, check the serverlogs and see how he got in. These mistakes aren't beginner-mistakes, most bulletin board software system exploits also work in this way (slightly more complicated though).

    tip: If you learn to write cleanish and neat code, indents and stuff. It's much easier to debug :(.

    There could be errors in this, if you see any, feel free to reply below
    version 0.1


  10. Posted · Report reply

    small note from me:I think he maybe used some kind of an array with predefined characters, and did something with the original ascii code of the input so it would return a number within the array's range and match the appropriate character for it.Also, it seems that he also used somekind of way to randomize his output, because i can't see much frequency in the used characters. Maybe something with the position of the file.I really doubt it if this secret will be solved one day.

  18. Posted · Report reply

    Talking about the asta frontpage, I do think it needs some remaking forinstance, the sounds quite annoy me especially the start ones and those bleeps you hear when you go over a menu item.Also the links with the 2 boxes in the center (that arrow like link) does'nt link to anythingFinally when i click on a menu item on the left, there's no way to return to the homepage( I think).But, I do like the news thingy and the features of the site and the specifics of the hosting are very well explained and listed.Kinda off topic I guess :|, sorryps. I usually skip the frontpage though, just jump right into the forumsps2. Your not going to kick me away for this are you Opaque :D :D?

  19. Posted · Report reply

    Would it be a good idea to ban the combination of the username and (multiple) IP's?For reference, in games like SoF2 or CoD, when you get banned, you have a big problem. Since you don't get banned by IP but by CDkey, and since you get only 1 cdkey for each time you buy the game (serialgenerators don't work) you can never play again.So, what if you could have a ban based on a computers hardware specs or something. Something like MAC addresses ?

  25. Posted · Report reply

    Good news is that the entire Fedora project is more open now.Also, Fedora Core is one of the most popular Linux distributions out there, so there is no need to worryps. Fedora was never fully under control of red hat, the reason red hat started Fedora was because they wanted to abandon red hat linux for personal use and concentrate on the server market.

×
×
  • Create New...

Important Information

Terms of Use | Privacy Policy | Guidelines | We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept