blueman378 Posted June 26, 2008 Share Posted June 26, 2008 hi guys, can you please try to get into our site, www.webspirited.com please no destructive stuff, funny is ok, like changing title ect, but please dont delete databases ect if you do get in, so see what you can find, cheers please email me at, hailwood@webspirited.com dont post here, if possible Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/ Share on other sites More sharing options...
blueman378 Posted June 27, 2008 Author Share Posted June 27, 2008 either email, or pm cause so far ive got nothing through Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-575852 Share on other sites More sharing options...
blueman378 Posted June 28, 2008 Author Share Posted June 28, 2008 bump?? Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-576593 Share on other sites More sharing options...
LinuxForce Posted June 28, 2008 Share Posted June 28, 2008 I tried a RFI, and a blind SQL no access on my end but you should work on your design before putting up a website not trying to be rude but it isn't that good :/ Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-576863 Share on other sites More sharing options...
blueman378 Posted June 29, 2008 Author Share Posted June 29, 2008 may i ask what is so bad about it? Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-577102 Share on other sites More sharing options...
BAD311 Posted June 29, 2008 Share Posted June 29, 2008 Force is right. Here are a few pointers: Not enough color, especially for a "web design" company. Add some color. In your case all this black is very boring, on top of that you have white fonts. Change it up, add some color, make it pop. Also "I" would use a cool logo for my site name, not text at the very top that says "WEB SPIRITEDPROFESSIONAL WEBSITE DESIGN" It's all about impressing your clients. Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-577156 Share on other sites More sharing options...
blueman378 Posted June 30, 2008 Author Share Posted June 30, 2008 ok thanks for the pointers, ill think about a new theme, Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-577730 Share on other sites More sharing options...
darkfreaks Posted July 9, 2008 Share Posted July 9, 2008 Vulnerability description HTTP TRACE method is enabled on this web server. In the presence of other cross-domain vulnerabilities in web browsers, sensitive header information could be read from any domains that support the HTTP TRACE method. This vulnerability affects Web Server. The impact of this vulnerability Attackers may abuse HTTP TRACE functionality to gain access to information in HTTP headers such as cookies and authentication data. Attack details No details are available. View HTTP headers Request TRACE /TRACE_test HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: www.webspirited.com Connection: Close Pragma: no-cache Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION) Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse HTTP/1.0 200 OK Date: Wed, 09 Jul 2008 15:39:29 GMT Server: Apache/2.2.8 (Unix) mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 mod_perl/2.0.4 Perl/v5.8.8 Content-Type: message/http X-Cache: MISS from pxy1 X-Cache-Lookup: NONE from pxy1:80 Via: 1.1 pxy1:80 (squid/2.7.STABLE2) Connection: close View HTML response Launch the attack with HTTP Editor How to fix this vulnerability Disable TRACE Method on the web server. Vulnerability description A possible sensitive directory has been found. This directory is not directly linked from the website.This check looks for known sensitive directories like: backup directories, database dumps, administration pages, temporary directories. Each of those directories may help an attacker to learn more about his target. This vulnerability affects /webmail. The impact of this vulnerability This directory may expose sensitive information that may help an malicious user to prepare more advanced attacks. Attack details No details are available. View HTTP headers Request GET /webmail HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: www.webspirited.com Connection: Close Pragma: no-cache Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION) Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse HTTP/1.0 301 Moved Permanently Date: Wed, 09 Jul 2008 15:43:23 GMT Server: Apache/2.2.8 (Unix) mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 mod_perl/2.0.4 Perl/v5.8.8 Location: http://www.webspirited.com:2095 Content-Length: 0 Content-Type: application/cgi X-Cache: MISS from pxy1 X-Cache-Lookup: MISS from pxy1:80 Via: 1.1 pxy1:80 (squid/2.7.STABLE2) Connection: close View HTML response Launch the attack with HTTP Editor How to fix this vulnerability Restrict access to this directory or remove it from the website. Web references Security Focus : Ten Steps to a Cleaner Web Root Possible sensitive directories Vulnerability description A possible sensitive directory has been found. This directory is not directly linked from the website.This check looks for known sensitive directories like: backup directories, database dumps, administration pages, temporary directories. Each of those directories may help an attacker to learn more about his target. This vulnerability affects /blog. The impact of this vulnerability This directory may expose sensitive information that may help an malicious user to prepare more advanced attacks. Attack details No details are available. View HTTP headers Request GET /blog HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) Host: www.webspirited.com Connection: Close Pragma: no-cache Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION) Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse HTTP/1.0 301 Moved Permanently Date: Wed, 09 Jul 2008 15:43:39 GMT Server: Apache/2.2.8 (Unix) mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 mod_perl/2.0.4 Perl/v5.8.8 Location: http://www.webspirited.com/blog/ Content-Length: 240 Content-Type: text/html; charset=iso-8859-1 X-Cache: MISS from pxy1 X-Cache-Lookup: MISS from pxy1:80 Via: 1.1 pxy1:80 (squid/2.7.STABLE2) Connection: close View HTML response Launch the attack with HTTP Editor How to fix this vulnerability Restrict access to this directory or remove it from the website. Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-585476 Share on other sites More sharing options...
blueman378 Posted July 12, 2008 Author Share Posted July 12, 2008 thanks mate, neither of those "sensitive directories" are sensitive so thats all good, and is it possible to disable trace through htaccess? Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-588248 Share on other sites More sharing options...
darkfreaks Posted July 12, 2008 Share Posted July 12, 2008 im not sure it recomends you go into the server and turn it off. Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-588252 Share on other sites More sharing options...
pjheliking Posted July 22, 2008 Share Posted July 22, 2008 i found that template on a website about a year ago take it you bought the rights hence no copyright notices Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-596598 Share on other sites More sharing options...
blueman378 Posted July 23, 2008 Author Share Posted July 23, 2008 of course had you read the disclaimer on the template you would have seen they say you dont need to leave any notice Link to comment https://forums.phpfreaks.com/topic/111947-solved-hack-me-non-destructive-please/#findComment-597018 Share on other sites More sharing options...
Recommended Posts