[From-Scratch] Coded forum - (PHP/MySQL)

[Phrate]

Dec 10, 2009 18:39:44 GMT -8 Renegade said:

i found some security flaws

And apparently you downed the whole website. Please change it back.

Edit: Seems to be only on Safari

[Renegade]

i didnt do anything that major

[Phrate]

Yeah, nevermind. Had to do with my reputation feature, I guess.

[S|P|L|A|T]

lol so you ip banned me for finding an exploit in your forum? I didn't do anything malicious with it... shows your maturity level.

[Phrate]

I didn't ban you.. I was informed that one of my staff members just wanted to see if you were any good at what you were doing, so they banned you, tempting you to get back in I guess?

[Malagrond]

I know your site warns that it's best viewed in Internet Explorer, but this with Safari?



I'll try to test some injections for ya too.

~Mala

[Phrate]

Yes, that's with just about any browser besides IE. But, a fellow named Luke is going to help make it cross-browser.

And, that's not necessary. In fact, I'd appreciate it if everyone stopped trying.

[Charles Stover]

And, that's not necessary. In fact, I'd appreciate it if everyone stopped trying.

It's better someone find it now than a member who's intent is malicious.

[Renegade]

you still haven't fixed the major flaw i found last week, or even disabled the way I was using it. do you need a demonstration of the damage I could do with it before you decide its worth changing?

[Jordan]

Dec 18, 2009 13:04:11 GMT -8 Renegade said:

you still haven't fixed the major flaw i found last week, or even disabled the way I was using it. do you need a demonstration of the damage I could do with it before you decide its worth changing?

What is the exploit that you did? I did some messing around on the forum, but since I'm not very knowledgeable about common exploits I didn't find anything before I was banned.

I'm not going to be going back on the forum, but I plan on making a simple website in the future and I'm just wondering what the common injections are. I saw that you made a post and then modified it to remove the exploit. What exactly did you do? Did you just put a Javascript code in it?

[Michael]

Would be rather handy for coders if common exploits were listed etc...

[Renegade]

yeah, that's a good plan, i'll just post here how to wreck his forum.


oh wait - that's not a good plan at all

[Luke]

Dec 21, 2009 8:38:07 GMT -8 Michael said:

Would be rather handy for coders if common exploits were listed etc...

Try this: www.securereality.com.au/studyinscarlet.txt

[Ryan]

Nov 25, 2009 13:28:48 GMT -8 frufru said:

Remember when Renegade, Martyn, and Pat Clinger came and had fun with some guy's web app that was full of security holes?

[RedBassett]

Common suggestion:

Do not tell someone when they (fail to) login if it is the username or password that they have wrong. This makes it easier to guess at the login, especially under some circumstances.