Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
October 28, 2020
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 322
Members: 0
Total: 322
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> invision ibf admin session sql inject??
Post new topic  Reply to topic View previous topic :: View next topic 
invision ibf admin session sql inject??
PostPosted: Fri Nov 25, 2005 8:07 pm Reply with quote
super
Active user
Active user
 
Joined: Sep 19, 2005
Posts: 30




when I log on to admin center of ipb forum then then a session id address comming to url bar.
example
Quote:
http://www.domin.com/forum/admin.php?adsess=cb4785be40e351a27c93fde67a4f8091


ok I geting this session id cb4785be40e351a27c93fde67a4f8091 after loging as admin on admincp center.

I just want to know have any exploit or sql injection which can get this session id whithout loging to admin cp center??

I mean how can I directly get this session id from SQL without loging to admin cp??
please help
View user's profile Send private message
PostPosted: Mon Nov 28, 2005 5:11 pm Reply with quote
lamaker
Beginner
Beginner
 
Joined: Nov 28, 2005
Posts: 4
Location: Moscow




it's not very easy, but whit my poor eng. is like this

post massage with image http://lol/sql.php that must include this

<? header:"Location: http://f*ckenforun/ipb/admin?asess='SQLCODEHERE" ?>

ok?
View user's profile Send private message ICQ Number
PostPosted: Mon Nov 28, 2005 7:35 pm Reply with quote
super
Active user
Active user
 
Joined: Sep 19, 2005
Posts: 30




thanks lamaker for help Smile

anyway I have few question
Code:
post massage with image http://lol/sql.php that must include this

Q1:you mean I need to make .php file and need to upload it to php support web server??

Q:2you said "post massage with image".ok but in where?? in Subject?? in comment??

Code:
<? header:"Location: http://f*ckenforun/ipb/admin?asess='SQLCODEHERE" ?>

Q3 what sql code i need to post on there??
View user's profile Send private message
PostPosted: Mon Nov 28, 2005 7:51 pm Reply with quote
lamaker
Beginner
Beginner
 
Joined: Nov 28, 2005
Posts: 4
Location: Moscow




1st of all check my php-syntax

2nd you need send PM with [*img]xxx[*/img]

You can do like this

\"SELECT '<? echo('i'm the lolakacker'); ?>' INTO OUTFILE 'path-shOt/file.php' FROM ipb_colum \"
View user's profile Send private message ICQ Number
PostPosted: Thu Dec 15, 2005 8:26 pm Reply with quote
super
Active user
Active user
 
Joined: Sep 19, 2005
Posts: 30




I don't inderstand it. Sad I need step by step help Sad
View user's profile Send private message
invision ibf admin session sql inject??
  www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.104 Seconds