Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #14658
| From | Jerry Stuckle <jstucklex@attglobal.net> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: php challenge |
| Date | 2014-11-27 15:30 -0500 |
| Organization | A noiseless patient Spider |
| Message-ID | <m581l9$eoh$3@dont-email.me> (permalink) |
| References | <aea937c1-40e4-4b95-9857-8492730248de@googlegroups.com> <m57rt5$s2e$1@solani.org> <2773651b-3133-4a5b-986b-b034c52f7f0f@googlegroups.com> |
On 11/27/2014 3:00 PM, Kiuhnm Mnhuik wrote: > On Thursday, November 27, 2014 7:52:26 PM UTC+1, Christoph M. Becker wrote: >> Kiuhnm Mnhuik wrote: >> >>> Here's the picture of the challenge "other2" found on >>> http://halls-of-valhalla.org/: http://i.share.pho.to/fd1e7ff4_o.png >>> AFAIK, we can only control $_GET['username'] and $_GET['password']. >>> Since there aren't any evals or similar I don't see how we can inject >>> code. I suspect we have to set $loggedIn to true, but how? >> >> If register_globals[1]=On that would be easy (because $loggedIn is not >> necessarily initialized, and it is tested for being == true, instead of >> === true). Fortunately, that misfeature had been removed as of PHP 5.4. > > Congratulations! You beat the challenge! > I modified the post request, but it didn't work. Then I sent a get request and it worked. Maybe the post request didn't work only because this is just a simulation. > If they (still!) have register_globals enabled, I don't know what else they might have screwed up. I wouldn't trust any of their challenges any more. It's hard telling what other bad habits they could be teaching. -- ================== Remove the "x" from my email address Jerry Stuckle jstucklex@attglobal.net ==================
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 09:12 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 13:40 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 11:31 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:27 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:55 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:35 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:16 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 09:10 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-28 12:52 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-28 16:32 -0500
Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 19:52 +0100
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 14:18 -0500
Re: php challenge "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-11-27 21:12 +0100
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:28 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 12:00 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 15:30 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 15:02 -0800
Re: php challenge Jerry Stuckle <jstucklex@attglobal.net> - 2014-11-27 20:36 -0500
Re: php challenge Kiuhnm Mnhuik <gandalf23@mail.com> - 2014-11-27 19:18 -0800
csiph-web