Waraxe Forums

Dorsk · Regular user

Hey all!
I have a snippet of code here that I would like you to take a look at:

waraxe · Site admin

Your first example is common login form and has nothing wrong itself.
But if we do search on Google against "ws_user", then we will find something like this:

http://cms.webspell.org/index.php?site=demo

Comparing login forms we can see close resemblance - so it can be WebSpell CMS.
And next, looking for exploits for WebSpell:

http://www.securityfocus.com/archive/1/archive/1/460937/100/0/threaded

Your second example - what are You trying to say?

Dorsk · Regular user

I have done some searching in your forums and I was wondering if there was a way to query the database, either by the URL bar or by the search engine that is intergrated within a website.

For my ecample:

waraxe · Site admin

First - this "begone" messages is the result of some anti-sql-injection code in phpnuke scripts. It is meant to be used for making sql injection attacks and xss abuse more difficult and it works as expected.

Now - that "exploit line", you are using, is written specially for phpnuke.
If you want to attack other targets besides phpnuke-powered, then you can always make your own working "exploit strings".

One more thing - you must understand, that sql injection is security hole and programming bug or "feature" and if programmer was good and wrote php code carefully, then you just cant steal any information from database or make other db manipulations.
But if website is written unsecurely or webserver has "magic_quotes=off" and programmer expected "=on", then there are lots of possibilities - stealing admin passwords, customer data from e-shops, etc, etc.

Dorsk · Regular user

Thank you for your information about the "begone" message.

As for the "exploit line", I only use it for PHPNUKE, There are certain sites that do ban me for a "UNION ATTACK", and I am trying to find a way to change the code a bit so that will not happen, but no luck yet.

How do I go about checking if a webserver has "magic_quotes" on or off?

Currently I am interested in PHPNUKE sites only.
1 site in particular, it is PHPNUKE Platinum version 7.6.b.4
with NukeSentinel version 2.4.2pl1

Links, ideas, and information would be greatly helpful.

waraxe · Site admin

You have encountered "Sentinel" - powerful protection system for phpnuke. It is often very hard to bypass that anti-hacking system. And if someone finds the way, then Sentinel will be updated soon and evasion problem stays.

Now, about "magic_quotes=off". My suggestion - surf the web and try to insert ("inject") single quotes to various URI parameters. If you will see sql-related error messages, then you are in right direction.

Some random examples:

http://www.hot.ee/http123/sql01.png

http://www.hot.ee/http123/sql02.png

See ya Wink

Dorsk · Regular user

Thank you very much! It is all making more sense to me.

I am going to install that PHPNUKE PLAT version and nuke sentinal on a remote computer for testing. If I find anything or if you have any ideas do not hesitate to PM me or reply to this post.

I will check this post often and like always, browse the forum for more information.

Thanks again!