darkfreaks Posted November 30, 2008 Share Posted November 30, 2008 its good Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-702421 Share on other sites More sharing options...
ricmetal Posted December 1, 2008 Author Share Posted December 1, 2008 edit as far as injections, looks like it inject me still produces errors when i type in extra variables on my code that have nothing to do with the db but they are all 302 errors and the db isnt populated, so i guess thats ok Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-702766 Share on other sites More sharing options...
ricmetal Posted December 1, 2008 Author Share Posted December 1, 2008 must add the other stuff to further protect the site Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-702769 Share on other sites More sharing options...
darkfreaks Posted December 1, 2008 Share Posted December 1, 2008 please paste your code so we can see why exactly it is failing Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703213 Share on other sites More sharing options...
darkfreaks Posted December 1, 2008 Share Posted December 1, 2008 ok let me know if the code i sent ya works it should filter and sanitize your $_GET[msg] code Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703276 Share on other sites More sharing options...
darkfreaks Posted December 1, 2008 Share Posted December 1, 2008 just incase you didnt get my inbox <?php ]echo "<div class=\"msgOk\">" filter_var($_GET[msg],FILTER_SANITIZE_STRING);" </div>"; ?> erase the code i originally gave you, it wont work right. let me know if u still get errors it may be syntax if anything. Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703338 Share on other sites More sharing options...
ricmetal Posted December 1, 2008 Author Share Posted December 1, 2008 still getting errors with the filter sanatize but im sure its not because of the gets its something else i added ill strip down the code to where it stoped giving me trouble then ill let you know Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703365 Share on other sites More sharing options...
darkfreaks Posted December 1, 2008 Share Posted December 1, 2008 what were the errors ??? Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703366 Share on other sites More sharing options...
darkfreaks Posted December 2, 2008 Share Posted December 2, 2008 nvm Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703683 Share on other sites More sharing options...
ricmetal Posted December 2, 2008 Author Share Posted December 2, 2008 hey, pm sent, with the code that doesnt get triggered by inject try out on the site, ull see 0 errors, but my db gets populated Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-703718 Share on other sites More sharing options...
ricmetal Posted December 5, 2008 Author Share Posted December 5, 2008 well,m not anymore Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706579 Share on other sites More sharing options...
Hinty Posted December 5, 2008 Share Posted December 5, 2008 XSS is present on the deals section. when inserting a deal enter <script>alert(document.cookie);</script> and a popup will appear when viewing list of deals. Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706616 Share on other sites More sharing options...
ricmetal Posted December 5, 2008 Author Share Posted December 5, 2008 gracias *fixed now* thanks Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706636 Share on other sites More sharing options...
Hinty Posted December 5, 2008 Share Posted December 5, 2008 Thers also another XSS vulnerability present with same deals section. You can use it by entering javascript:alert(document.cookie); into the '** I JOIN' field. This requires the user to click the link for the attack to happen. Its also displaying the values twice, is that supposed to happen? Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706643 Share on other sites More sharing options...
ricmetal Posted December 5, 2008 Author Share Posted December 5, 2008 thanks for that im getting on checking xss out thanks Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706671 Share on other sites More sharing options...
ricmetal Posted December 5, 2008 Author Share Posted December 5, 2008 ok, i figured out how to use a code i had here. thanks dark! hinty plse check now thanks for all help so far, really, im plain lazy when it comes to learning but implementing, im there thanks Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706685 Share on other sites More sharing options...
Hinty Posted December 5, 2008 Share Posted December 5, 2008 yup all good, cant find any others at the moment Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-706689 Share on other sites More sharing options...
darkfreaks Posted December 5, 2008 Share Posted December 5, 2008 XSS me and SQL inject me checks out good Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-707007 Share on other sites More sharing options...
ricmetal Posted December 8, 2008 Author Share Posted December 8, 2008 yeo thanks very much Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709305 Share on other sites More sharing options...
darkfreaks Posted December 8, 2008 Share Posted December 8, 2008 your adddeals.php still has injection try this: <?php function clean($var) { $var=trim(mysql_real_escape_string(strip_tags($var))); $var=htmlspecialchars($var,ENT_QUOTES); return filter_var($var,FILTER_SANITIZE_STRING); } $referralForm=clean($_POST['referralForm']); $dealForm=clean($_POST['dealForm']); $my_ptcForm=clean($_POST['my_ptcForm']); $his_ptcForm=clean($_POST['his_ptcForm']); $contact_userForm=clean($_POST['contact_userForm']); $recaptcha_challenge_field=clean($_POST['recaptcha_challenge_field']); $recaptcha_response_field=clean($_POST['recaptcha_response_field']; $submit=clean($_POST['submit']); ?> Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709450 Share on other sites More sharing options...
ricmetal Posted December 8, 2008 Author Share Posted December 8, 2008 still has 302 errors but doesnt inject anything but blank spaces... check here http://www.dealsground.byethost7.com/adddeal.php ill postie the code for you maybe u can see whats wrong thanks Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709548 Share on other sites More sharing options...
darkfreaks Posted December 8, 2008 Share Posted December 8, 2008 is test@test.com still the login im having trouble logging in ??? Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709549 Share on other sites More sharing options...
ricmetal Posted December 8, 2008 Author Share Posted December 8, 2008 dealstesting@fake.com 12345678 Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709556 Share on other sites More sharing options...
darkfreaks Posted December 8, 2008 Share Posted December 8, 2008 im still seeing injection can you paste the link to the current code so i can see it? and copy the 302 errors ??? Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709561 Share on other sites More sharing options...
ricmetal Posted December 8, 2008 Author Share Posted December 8, 2008 sure http://www.pastie.org/private/csd8h7sohvjrxagvfsdn2w Link to comment https://forums.phpfreaks.com/topic/134547-please-test-for-security/page/4/#findComment-709563 Share on other sites More sharing options...
Recommended Posts