Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #14663
| Newsgroups | comp.lang.php |
|---|---|
| Date | 2014-11-27 15:55 -0800 |
| References | <aea937c1-40e4-4b95-9857-8492730248de@googlegroups.com> <m57r5s$m1n$1@dont-email.me> <9ba81c8f-aad5-4830-9baa-bb74fbd7531f@googlegroups.com> <m581fq$eoh$1@dont-email.me> |
| Message-ID | <78bbaf48-df47-4fb7-93bf-e38fe80e37e0@googlegroups.com> (permalink) |
| Subject | Re: php challenge |
| From | Kiuhnm Mnhuik <gandalf23@mail.com> |
On Thursday, November 27, 2014 9:27:57 PM UTC+1, Jerry Stuckle wrote: > On 11/27/2014 2:31 PM, Kiuhnm Mnhuik wrote: > > On Thursday, November 27, 2014 7:40:21 PM UTC+1, Jerry Stuckle wrote: > >> On 11/27/2014 12:12 PM, Kiuhnm Mnhuik wrote: > >>> Here's the picture of the challenge "other2" found on http://halls-of-valhalla.org/: > >>> http://i.share.pho.to/fd1e7ff4_o.png > >>> AFAIK, we can only control $_GET['username'] and $_GET['password']. Since there aren't any evals or similar I don't see how we can inject code. > >>> I suspect we have to set $loggedIn to true, but how? > >>> > >>> Note: I think this post is in-topic because every programmer should know as much as possible about security. > >>> > >> > >> Just because you don't do any evals doesn't mean your code is secure. > >> SQL injection, for instance, is a much more common vulnerability. > > > > SQLi doesn't seem to work here. > > > > Not knowing what's in the functions being called, there is no way to tell. If the login succeeds or you can force a time delay, then it works. 99.9% of SQLi attacks are blind. I just said that, in this case, it doesn't *seem* to work. You almost never have the source code. > >> I might suggest you follow the "Get Help on this Challenge" link. They > >> know more about their code than anyone here. > > > > Unfortunately, the forum is kinda inactive. > > > > Which still does not mean it's not the best place to ask. Did you try? Yes, I did.
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 09:12 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 13:40 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 11:31 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:27 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:55 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:35 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:16 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 09:10 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-28 12:52 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 16:32 -0500
Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 19:52 +0100
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 14:18 -0500
Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 21:12 +0100
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:28 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 12:00 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:30 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:02 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:36 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:18 -0800
csiph-web