Warptweet Posted June 15, 2008 Author Share Posted June 15, 2008 Nevermind. He hid a file called c992.php in one of my many many directories. It was a program that could edit anything of my website -- really clever really. I edited c992.php into a remote IP tracker. BANNED! Link to comment Share on other sites More sharing options...
corbin Posted June 15, 2008 Share Posted June 15, 2008 IPs easily change..... Now that you found it, you should be concerned about how he got it there.... (Or, if he got it there through the upload script, how he knew where it was.) Link to comment Share on other sites More sharing options...
dsaba Posted June 15, 2008 Share Posted June 15, 2008 I wonder if he's reading this thread... because that too would also be a security threat. I almost envy you a little bit warpweet, figuring out how he hacked your site would be fun.. but more so when I find out how and setup a trap for him. I edited c992.php into a remote IP tracker. I don't even get that sentence. Found this: http://l0pht.by.ru/$hell$cripts/c992.php Link to comment Share on other sites More sharing options...
helraizer Posted June 15, 2008 Share Posted June 15, 2008 I edited c992.php into a remote IP tracker. I don't even get that sentence. I think what he meant is that only the person who placed c992.php would access it, so if the OP edited it to captcher the user's IP address, he'd catch the person who placed it (IP wise). He kinda foiled his own plan there by telling everyone on here about it, thus getting more people to access it. Link to comment Share on other sites More sharing options...
Warptweet Posted June 17, 2008 Author Share Posted June 17, 2008 Lol, sillies. I deleted that script and replaced it with an IP tracker. It has no effect on my site. When my site was FIRST hacked, he hid that file there. That was the origin of all the problems. I hope I'm safe... for now. Also, even if he/she does manage to upload the script again, he/she won't know the location. Nobody gets to know the location of files anymore Link to comment Share on other sites More sharing options...
Daniel0 Posted June 17, 2008 Share Posted June 17, 2008 A couple of bugs... I picked a random file from my desktop and uploaded it (p.patch), however, when downloading it it's renamed to uploadpoints. Also, the link to it from "My Files" is broken. When logging in the menu on the right is still as though you were logged out until you go somewhere else. It's a bit confusing. Same goes for logging out. Link to comment Share on other sites More sharing options...
ev5unleash Posted June 17, 2008 Share Posted June 17, 2008 Dude, Are you using a host? Or your own server? I think you might want to upgrade Apache. I'm just saying no one has hacked my site so easily (http://www.ev5unleash.com) with Apache 2, PHP, MySQL with the latest updates. I know Apache has log files so I'm sure from your cPanel you can look at the log and see exactly what this hacker is doing to get into this site. Link to comment Share on other sites More sharing options...
phpscriptcoder Posted June 17, 2008 Share Posted June 17, 2008 You might want to use a better way of checking the extension. I renamed a php file to .png.php and was able to upload it. So people could upload any file type they want if they rename it. Link to comment Share on other sites More sharing options...
Warptweet Posted June 18, 2008 Author Share Posted June 18, 2008 If you guys read the earlier posts -- the hacking problem is completely gone. The site is very safe and unless it's an image -- you don't even get to know where the file is stored. Link to comment Share on other sites More sharing options...
whiteboikyle Posted June 18, 2008 Share Posted June 18, 2008 Uhmm i have an upload script that uploads to direct files with register/login.. it would probably be way more secure then using your MySQL. Contact me Via aim whiteboikyle69. I mean its still in beta since i am still working on it.. But it is way more secure! Link to comment Share on other sites More sharing options...
corbin Posted June 18, 2008 Share Posted June 18, 2008 No it wouldn't be WBK. Warp's site allows uploads of any kind.... If you allow direct access to all kinds of file types, you're asking for problems... (Unless of course, you made Apache serve all content in user directories as static....) MySQL was not vulernable in this situation. MySQL is very secure when rational precations are taken... Why does everyone keep hating on it in this thread?! Dude, Are you using a host? Or your own server? I think you might want to upgrade Apache. I'm just saying no one has hacked my site so easily (http://www.ev5unleash.com) with Apache 2, PHP, MySQL with the latest updates. I know Apache has log files so I'm sure from your cPanel you can look at the log and see exactly what this hacker is doing to get into this site. What I did... "telnet warptweet.com 80 HEAD / HTTP/1.1 Connection: close " Response: "HTTP/1.1 200 OK Date: Wed, 18 Jun 2008 05:58:21 GMT Server: Acenet Inc X-Powered-By: PHP/5.2.5 Connection: close Content-Type: text/html Connection to host lost." No idea what Acenet is... He's not even using Apache, and his PHP version is pretty much up to date. Also, Apache had no relation to this problem at all... (Well, it did, but not directly... Apache could've been configure to not parse foreign PHP files, but it could also have been fixed with PHP, and in this case, he's not even using Apache...) Sorry, it just annoys me when people throw out random advice. Edit: My bad on the "not even using Apache" part.... It seems that Acenet, Inc. is a hosting provider.... I thought maybe it was some lesser known webserver..... Link to comment Share on other sites More sharing options...
Warptweet Posted June 18, 2008 Author Share Posted June 18, 2008 Yes, my host is ace-host.net. An awesome company, support is often answered within 5 minutes. Anyways, they aren't the problem. And as you no longer get to know the direct location of a file that can be dangerous, it's of almost no risk to me. Basically everyone variable used in my site (not many, the site is as simple as possible) uses mysql escape string now. Link to comment Share on other sites More sharing options...
dsaba Posted June 19, 2008 Share Posted June 19, 2008 Welcome to UpoadPoints.com! Okway! Link to comment Share on other sites More sharing options...
Stephen Posted June 20, 2008 Share Posted June 20, 2008 By the way Warp, I remember your name from GMC. Link to comment Share on other sites More sharing options...
FIREBALL5 Posted June 21, 2008 Share Posted June 21, 2008 I just find that terribly funny; you're ASKING people to hack your site. LOL Link to comment Share on other sites More sharing options...
Stephen Posted June 21, 2008 Share Posted June 21, 2008 He's asking people to find vulnerability's so he can fix it. Link to comment Share on other sites More sharing options...
Daniel0 Posted June 21, 2008 Share Posted June 21, 2008 I just find that terribly funny; you're ASKING people to hack your site. LOL That's the point of this forum (partially). The "hacking" process is for finding security vulnerabilities. Link to comment Share on other sites More sharing options...
FIREBALL5 Posted June 21, 2008 Share Posted June 21, 2008 Alright, in that case, sign me up. [beta] my upload site! *url removed* EDIT: Please do not create a new account just to beta test. Please go to the login page and login as a guest. Edit by Daniel0: As Stephen said, create a new topic. I've removed your URL to prevent hijacking the topic. Link to comment Share on other sites More sharing options...
Stephen Posted June 21, 2008 Share Posted June 21, 2008 I don't like the layout Fireballs :/ but you should post a new topic for that Link to comment Share on other sites More sharing options...
Recommended Posts