110%Nutter Posted August 10, 2009 Share Posted August 10, 2009 Hi, I went to look at my website last night and found that my homepage had been replaced by something created by some muslim albanian / kosovo hackers. I would be interested in hearing from any of you who could pin point the weak spot in my code, I'm pretty new to php so its likely there are some newbie errors in it that let them in!! Hope to hear from someone soon!! [attachment deleted by admin] Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/ Share on other sites More sharing options...
bundyxc Posted August 10, 2009 Share Posted August 10, 2009 I'll take a closer look in the morning, but for now, I'll assume that they got in using the unsanitized $_GET["page"] variable... Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-894708 Share on other sites More sharing options...
110%Nutter Posted August 10, 2009 Author Share Posted August 10, 2009 Thanks I'll look forward to hearing from you!! Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-894710 Share on other sites More sharing options...
bundyxc Posted August 10, 2009 Share Posted August 10, 2009 Until the morning, check out regex, and other ways of validating/sanitizing user input. Can't trust your users. Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-894711 Share on other sites More sharing options...
110%Nutter Posted August 11, 2009 Author Share Posted August 11, 2009 Did you find anything stupid in what I'd done? Hope to hear from you soon!! Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895841 Share on other sites More sharing options...
sford999 Posted August 11, 2009 Share Posted August 11, 2009 Its like bundyxc said, its most likely the unsanitized $_GET['']; input. As you could probably do something like: index.php?page=<script>alert('I can see this popup')</script> You could use something like <?php function make_safe($unsafe) { mysql_connect($server, $user, $pwd); $safe = mysql_real_escape_string(strip_tags(trim($unsafe))); return $safe; } ?> Then do <?php make_safe($_GET['something']); ?> Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895843 Share on other sites More sharing options...
110%Nutter Posted August 11, 2009 Author Share Posted August 11, 2009 I'm not using a mysql database but i think i can see what your getting at. Any chance you could modify that so its more suited to the way i'm using my page variable? Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895848 Share on other sites More sharing options...
sford999 Posted August 11, 2009 Share Posted August 11, 2009 Try this <?php function make_safe($unsafe) { $safe = add_slashes(strip_tags(trim($unsafe))); return $safe; } ?> you will need to use the strip_slashes() function on anything which has single or double quotes and backslashes passed though. Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895850 Share on other sites More sharing options...
110%Nutter Posted August 11, 2009 Author Share Posted August 11, 2009 Where would that go in my source file? Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895871 Share on other sites More sharing options...
SetToLoki Posted August 11, 2009 Share Posted August 11, 2009 is your site genera Hi, I went to look at my website last night and found that my homepage had been replaced by something created by some muslim albanian / kosovo hackers. I would be interested in hearing from any of you who could pin point the weak spot in my code, I'm pretty new to php so its likely there are some newbie errors in it that let them in!! Hope to hear from someone soon!! is your homepage generated by a cms, I have an issue with a clients website they used sql injection. the guys have been round hacking many a site recently word of warning they seem to upload malicious code to some sites so if you goolge for these guys and find other sites they have hacked don't click on them. mysql_escape_strings and real_mysql_escape_strings is a way to stop sql injection. if they have hacked database content. Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895883 Share on other sites More sharing options...
110%Nutter Posted August 11, 2009 Author Share Posted August 11, 2009 No its not generated by a cms nor does it have a database running in the background. I found out who it was by looking in the server log. They had decided to post the hack on their own forum and link to it.... Link to comment https://forums.phpfreaks.com/topic/169587-php-exploit-but-how/#findComment-895913 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.