Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14656

Re: php challenge

Show all headers | View raw

On 11/27/2014 2:31 PM, Kiuhnm Mnhuik wrote:
> On Thursday, November 27, 2014 7:40:21 PM UTC+1, Jerry Stuckle wrote:
>> On 11/27/2014 12:12 PM, Kiuhnm Mnhuik wrote:
>>> Here's the picture of the challenge "other2" found on http://halls-of-valhalla.org/:
>>>   http://i.share.pho.to/fd1e7ff4_o.png
>>> AFAIK, we can only control $_GET['username'] and $_GET['password']. Since there aren't any evals or similar I don't see how we can inject code.
>>> I suspect we have to set $loggedIn to true, but how?
>>>
>>> Note: I think this post is in-topic because every programmer should know as much as possible about security.
>>>
>>
>> Just because you don't do any evals doesn't mean your code is secure.
>> SQL injection, for instance, is a much more common vulnerability.
> 
> SQLi doesn't seem to work here.
> 

Not knowing what's in the functions being called, there is no way to tell.

>> I might suggest you follow the "Get Help on this Challenge" link.  They
>> know more about their code than anyone here.
> 
> Unfortunately, the forum is kinda inactive.
> 

Which still does not mean it's not the best place to ask.  Did you try?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 09:12 -0800
  Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 13:40 -0500
    Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 11:31 -0800
      Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:27 -0500
        Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:55 -0800
          Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:35 -0500
            Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:16 -0800
              Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 09:10 -0500
                Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-28 12:52 -0800
                Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 16:32 -0500
  Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 19:52 +0100
    Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 14:18 -0500
      Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 21:12 +0100
        Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:28 -0500
    Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 12:00 -0800
      Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:30 -0500
        Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:02 -0800
          Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:36 -0500
            Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:18 -0800

csiph-web