roadshow Posted December 7, 2007 Share Posted December 7, 2007 http://www.toxicana.com/forum/main_forum.php Link to comment Share on other sites More sharing options...
Coreye Posted December 7, 2007 Share Posted December 7, 2007 You can submit HTML into the fields when creating topics. Cross Site Scripting: http://www.toxicana.com/forum/register.php/"><marquee><h1>vulnerable Cross Site Scripting: http://www.toxicana.com/forum/login.php/"><marquee><h1>vulnerable Theirs cross site scripting if you submit code into the comment field when creating topics. http://www.toxicana.com/forum/main_forum.php Theirs cross site scripting if you submit code into the name field when creating topics. http://www.toxicana.com/forum/main_forum.php Theirs cross site scripting if you submit code when you register. http://www.toxicana.com/forum/members.php You can edit the maxlength value when creating topics for the name field. You can press the back button and use the same captcha when creating topics. It's easy to flood that way. You can submit blank usernames. You can can submit blank comments. Link to comment Share on other sites More sharing options...
gtal3x Posted December 7, 2007 Share Posted December 7, 2007 LOL Coreye, you just smaked that little forum Link to comment Share on other sites More sharing options...
Coreye Posted December 7, 2007 Share Posted December 7, 2007 Full Path Disclosure: http://www.toxicana.com/forum/main_forum.php?page=' http://www.toxicana.com/forum/main_forum.php?page=a Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/main_forum.php on line 58 Full Path Disclosure: http://www.toxicana.com/forum/members.php?page=' http://www.toxicana.com/forum/members.php?page=a Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/members.php on line 63 Full Path Disclosure: http://www.toxicana.com/forum/view_topic.php?id=14&page=' http://www.toxicana.com/forum/view_topic.php?id=14&page=a Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/view_topic.php on line 57 When you login with a username that does not exist, you get this error message "That user does not exist in our database. Click Here to Register" but when you click "Click Here" it goes to this page; http://www.toxicana.com/forum/add.php, which doesn't exist. Link to comment Share on other sites More sharing options...
roadshow Posted December 7, 2007 Author Share Posted December 7, 2007 He smate my little forum with the fist of an angry god. Link to comment Share on other sites More sharing options...
roadshow Posted December 7, 2007 Author Share Posted December 7, 2007 Any suggestions on how to secure some of that? Link to comment Share on other sites More sharing options...
gtal3x Posted December 7, 2007 Share Posted December 7, 2007 Any suggestions on how to secure some of that? Yes, your main problem seems to be XSS, well there are tons of articles how to prevent it just search here Link to comment Share on other sites More sharing options...
helraizer Posted December 7, 2007 Share Posted December 7, 2007 Array http://www.toxicana.com/forum/view_topic.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/view_topic.php on line 9 XSS http://www.toxicana.com/forum/view_topic.php?id=%22%3E%3Cmarquee%3Evunerable Link to comment Share on other sites More sharing options...
Coreye Posted December 7, 2007 Share Posted December 7, 2007 Cross Site Scripting: http://www.toxicana.com/forum/edit_topic.php?id="><marquee><h1>vulnerable Array: ]http://www.toxicana.com/forum/view_profile.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/view_profile.php on line 9 Array: ]http://www.toxicana.com/forum/edit_topic.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/edit_topic.php on line 8 Array: ]http://www.toxicana.com/forum/del_topic.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/del_topic.php on line 8 Link to comment Share on other sites More sharing options...
Coreye Posted December 7, 2007 Share Posted December 7, 2007 Array: ]http://www.toxicana.com/forum/members.php?page[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/members.php on line 17 Array: ]http://www.toxicana.com/forum/main_forum.php?page[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/main_forum.php on line 13 Array: ]http://www.toxicana.com/forum/view_topic.php?id=11&page[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/view_topic.php on line 45 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/view_topic.php on line 57 Link to comment Share on other sites More sharing options...
agentsteal Posted December 8, 2007 Share Posted December 8, 2007 Cross Site Scripting: http://www.toxicana.com/forum/register.php/"><marquee><h1>vulnerable</marquee> Cross Site Scripting: There is Cross Site Scripting if the ID_my_site cookie contains code. Cross Site Scripting: There is Cross Site Scripting in the forum if a post contains code. Cross Site Scripting: There is Cross Site Scripting if your username contains code. Cross Site Scripting: http://www.toxicana.com/forum/login.php/"><marquee><h1>vulnerable</marquee> Full Path Disclosure: http://www.toxicana.com/forum/view_topic.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/view_topic.php on line 9 Full Path Disclosure: http://www.toxicana.com/forum/view_topic.php?page[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/view_topic.php on line 45 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/view_topic.php on line 57 Full Path Disclosure: http://www.toxicana.com/forum/members.php?page=a Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/members.php on line 63 Full Path Disclosure: http://www.toxicana.com/forum/edit_topic.php?id Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/edit_topic.php on line 8 Full Path Disclosure: http://www.toxicana.com/forum/main_forum.php?page=a Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/toxicana/public_html/forum/main_forum.php on line 58 Full Path Disclosure: http://www.toxicana.com/forum/del_topic.php?id[] Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in /home/toxicana/public_html/forum/del_topic.php on line 8 Insecure cookie: You shouldn't put the username in the cookie. User Enumeration: http://www.toxicana.com/~toxicana User Enumeration: http://www.toxicana.com/~root You can log in as any member by changing the username cookie to their username. You can log in as Array if the ID_my_site cookie is an array. Link to comment Share on other sites More sharing options...
helraizer Posted December 8, 2007 Share Posted December 8, 2007 XSS - woops.. http://www.toxicana.com/forum/main_forum.php *whistles to self...* I didn't do it. Also you have a problem with really long usernames.. on the register page, maxlength=60 whereas on login.php maxlength=40. (You might want to delete my user account on your forum now.. else no one can view that page.. or anyother page come to that ) - sorry 'bout that, I didn't realise that'd be quite as bad as it was. Just shows you, though. Sam Link to comment Share on other sites More sharing options...
roadshow Posted December 8, 2007 Author Share Posted December 8, 2007 Thanks all. I took the forum down. I pretty much have to redo everything, starting with secure sessions. Link to comment Share on other sites More sharing options...
roadshow Posted January 18, 2008 Author Share Posted January 18, 2008 Can anyone help me harden this forum script? I need it for a band site I'm working on. Link to comment Share on other sites More sharing options...
roadshow Posted January 18, 2008 Author Share Posted January 18, 2008 Ah, never mind. Forgot I'd have to redo the login script. Link to comment Share on other sites More sharing options...
RavenStar Posted January 18, 2008 Share Posted January 18, 2008 I know you wanted your forums tested, but I took a look at your site also full path disclosure http://www.toxicana.com/index.php?page=index Sorry ^.^ Link to comment Share on other sites More sharing options...
roadshow Posted January 18, 2008 Author Share Posted January 18, 2008 Very interesting. Any idea how I can remedy that? Link to comment Share on other sites More sharing options...
rcorlew Posted January 26, 2008 Share Posted January 26, 2008 The best way to fix disclosures I have found is this little snippet of code, only use this after you have fully tested the script or else you will not be able to debug your scripts. Just put this little gem right after your opening php tag. error_reporting(0); Then to stop xSs you should try something like this: function stopXss($var){ $var = addslashes($var); $var = htmlentities($var); $var = what_ever_else($var); return $var; } Then call the function like this $name = stopXss($_POST["name"]); $password = stopXss($_POST["password"]); I think you can get the picture. Link to comment Share on other sites More sharing options...
roadshow Posted January 26, 2008 Author Share Posted January 26, 2008 Yeah, that's very helpful. Thanks. Link to comment Share on other sites More sharing options...
Recommended Posts