Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > rocksolid.programming > #154 > unrolled thread

Lynx

Back to article view | Back to rocksolid.programming

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Lynx Anonymous <poster@anon.com> - 2020-12-16 16:05 -0800
    Re: Lynx Retro Guy <retro_guy@retrobbs.rocksolidbbs.com> - 2020-12-16 22:34 -0700

#154 — Lynx

>>9c7631636504114e50
>I added lynx as a door a few years ago in synchronet and it worked great,

what does that mean: "as a door" ?
 
>that by default lynx would allow shell escapes, 

I checked for that, was not the case for me (unless I checked the wrong things). At least I was not able to inject any commands that way (over the webui).
Can you give an example of a successful attack string ?

For the design: I have to say that the hard work in this was done by somebody else (for free, as in free beer). I just adapted some sources to my needs. And yes, I am quite pleased with the outcome myself. I can also see that it is already used, although half the functionality is missing yet. :-)

-- 
Posted on def2

[toc] | [next] | [standalone]

#157

On Wed, 16 Dec 2020 16:05:14 -0800
Anonymous <poster@anon.com> wrote:

> >>9c7631636504114e50
> >I added lynx as a door a few years ago in synchronet and it worked
> >great,
> 
> what does that mean: "as a door" ?

A door is like a portal to an external program for a bbs. Mostly used
for games (commonly called 'door games'). I set up Synchronet to have a
menu option to browse the web, and it then provided you a lynx
interface (by actually running lynx and letting you use it).

> >that by default lynx would allow shell escapes, 
> 
> I checked for that, was not the case for me (unless I checked the
> wrong things). At least I was not able to inject any commands that
> way (over the webui). Can you give an example of a successful attack
> string ?

It's not really an attack string, but when I had it running in
Synchronet, a user could (no one ever did), just use the built in
command in lynx to jump to a shell prompt. I didn't want that, so I
specifically disabled that feature in the command string to run lynx.

I'm guessing that a bbx user can't really issue a lynx command
directly, but just wanted to mention that I believe lynx supports such.

Retro Guy

[toc] | [prev] | [standalone]

Back to top | Article view | rocksolid.programming

csiph-web