Waraxe IT Security Portal

hazzy · Beginner

I've recently social engineered a password for a forum (phpbb3 I think) that has since given me access to the admin panel and the ftp.

Since that I've installed phpmyadmin and later hacked the login script to send me non-md5'd passwords via email whenever a user logs into the forums. From there I now have access to other various websites the users use with the same password information - mainly email and things like that...

Is there any other nefarious acts I can accomplish on this forum or is it pretty much cooked? I guess the most interesting would be some sort of keylogger that can send me passwords for other applications they use, maybe even single out certain members... I don't know, as the title suggests, I'm a newb.

Thanks!

gibbocool · Advanced user

Well if you know everyone's password and email address, you may have access to their email accounts. And if they use different passwords then you can always request a lost password for accounts that you are interested in. Otherwise you can check if there are other websites on that server, and use that site to hack into other sites you may be interested in.