Waraxe IT Security Portal

nuker · Active user

Well, he has enough reasons to be paranoid, because i had hacked his site once and i deleted all his posts, forums and members hehe. But i dont think he needs to delete the admin directory if its enough just by changing its name. Im almost sure there must be exist something that scans and lists all directories of a website. Otherwise, what damage can i do to a board if i just have the password of an administrator??

gibbocool · Advanced user

You should install invision on your own server and then play around with moving the ACP and seeing if you can still find a link to it or something. You can also play around with other things that an admin can do without needing to log into ACP.

nuker · Active user

Hi,

i have IPB myself and know it almost very well. Unfortunately it doesnt seem like there is a way to find out the link of the admin directory if it has been renamed, other than being able to see the content of the ini.php file in the root directory that contains that information. But that file is not accessible via web. It would be great if there as a exploit or something that allowed you to get it some way.

Without logging in the ACP, there is not so much you can do, other than deleting posts one by one or suspending users, but it would take forever for you to cause a visible damage to the board doing it that way.