Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
June 14, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 629
Members: 0
Total: 629
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> General discussion -> Problem with locating full path of index.php
Post new topic  Reply to topic View previous topic :: View next topic 
Problem with locating full path of index.php
PostPosted: Sun Dec 14, 2008 3:24 pm Reply with quote
stealth
Beginner
Beginner
 
Joined: Dec 14, 2008
Posts: 1




Hi dudes!

I have a small serious problem, it is my first try entering to a web-site, but soon im gonna hit my head into walls:S

The situation is the following... There is a server i need some data from there. Unfortunately i have not found any bug on their web... but it is located on a server which is hosting more domains.. so i have choosed an other subdomain of the target site and i found a vulnerable .php
Now i can download files with load_file() function.. for example yes etc/passwd.. but to explain more lets say these are the hosts:

1. szotar.blablabla.hu (<- this is i want to break in)
2. clgsm123.hu (i found bug here)

Site #1 and #2 has the same IP if i do a ping!

I downloaded httpd.conf using load_file() and it says:

Code:

<VirtualHost *>
    ServerName szotar.blablabla.hu
    ServerAdmin webmaster@xxxxxxx.hu
    DocumentRoot /www/szotar
    ErrorLog logs/common_err
    CustomLog logs/szotar_access vaccess5sp
#    CustomLog logs/szotar_access vaccess5
    ScriptAlias /cgi-bin/ /www/szotar/cgi-bin/
</VirtualHost>
<Directory "/www/szotar">
    Options Indexes Includes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
    IndexIgnore  *.inc
    AddType application/x-httpd-php .wml
    <Files ~ "\.inc">
   Order allow,deny
   Deny from all
    </Files>
</Directory>



But when i wanted to download the index.php i specified the path in load_file as "/www/szotar/index.php" and it fails!!!!

I dont know why, any idea pls? Crying or Very sad

It's very bad i cant do a directory listing only guessing in the dark :'(
View user's profile Send private message
PostPosted: Sun Dec 14, 2008 3:54 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Seems to be mod_rewrite in action and it may be perl, not php script. Try reading ".htaccess" file.
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Dec 14, 2008 8:05 pm Reply with quote
pexli
Valuable expert
Valuable expert
 
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




File index.php really exist if you enter the site blabla.hu/index.php?
View user's profile Send private message
PostPosted: Sun Dec 14, 2008 10:23 pm Reply with quote
mge
Valuable expert
Valuable expert
 
Joined: Jul 16, 2008
Posts: 142




unless you haven't actually visited www.domain.com/directory/index.php to check if that file exists you can't really be sure that www.domain.com/directory/ points to index.php.

your best bet is to look for the DirectoryIndex directive(s) in the httpd.conf and try every name in it (like index.php4, index.php5, index.pl, etc., whatever is listed there).
View user's profile Send private message
Problem with locating full path of index.php
  www.waraxe.us Forum Index -> General discussion
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.197 Seconds