logo
::[Home]
::[News]
::[Challenges]
::[Ranking]
::[My Account]
::[Forum]
::[Chat]
::[Private Messages]
::[Vulnerable Code]
::[Tutorials]
::[Downloads/Scripts]
::[Support]
::[Links]
::[Contact/FAQ]
::[Login]
0 anonymous
Views: 1088973 Challenges: 342
Users: 12689 Online: 11

Settings
Search
0 new posts

Page 1 of 3

bright-shadows.net Click me :) – 24 Posts

  • bright-shadows.net Click me :)

    01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Oops<br>[image]http://www.bright-shadows.net/logout.php[/image]<br><br>Edit: yeah, it is annoying
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    quangntenemy's Avatar quangntenemy 7120
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Yeah that's an old CSRF bug that hasn't been fixed.<br><a href="%5C"><img alt="\&quot;link\&quot;" src="%5C">http://www.bright-shadows.net/forum/forum_showtopic.php?topicid=2329</a>
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Then let's try to fix it.<br>The most simple way would be a little form at the logout.php which asks \"Do you really want to logout?\" or something with a POST-Button i guess.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    quangntenemy's Avatar quangntenemy 7120
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Yeah but the admins are quite busy/lazy for now <img alt="\&quot;:P\&quot;" src="%5C"><br><br>PS. did u get urself logged out too? <img alt="\&quot;:P\&quot;" src="%5C">
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Well, i turned off loading images to bypass it. But that screws the layout up, so i just edited it <img alt="\&quot;:)\&quot;" src="%5C">
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    ok, i played around with this a while and noticed the fact that a POST-Form is worthless.<br><br>You can't just do an <img src="for" alt="for"><br>Example:<br><div class="\&quot;tbscode_standard_quote_headline\&quot;"><img alt="\&quot;Quote\&quot;" src="%5C">Quote:</div><div class="\&quot;tbscode_standard_quote\&quot;"><br>&lt;form id=\"test\" method=\"POST\" action=\"http://www.bright-shadows.net/logout.php\"&gt;<br> &lt;input type=\"hidden\" name=\"submit\" value=\"ya, log me out\"&gt;<br>&lt;/form&gt;<br><br>&lt;body onload=\"test.submit()\"&gt;&lt;/body&gt;<br></div><br>assuming the logout.php checks for $_POST['submit'] == \"ya, log me out\"<br>With this you could of course do other funny things, like giving admin-rights to yourself, adding news etc.<br>All you need is an admin clicking your link. I don't think everyone here is surfing with javascript turned off and checks the source of every page before visiting <img alt="\&quot;;)\&quot;" src="%5C"><br><br>A secure way would be to add an
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    this is pretty old news,<br>
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Oh well, maybe you overlooked the \"With this you could of course do other funny things, like giving admin-rights to yourself, adding news etc.\"-line.<br>The logout-thing is just a very simplified example.<br>The same way you can post forum-posts with the corresponding nick automatically for example, open topics, or if an admin clicks the link: delete topics.<br>Or if an admin is logged into the adminzone/ (htaccess) do nasty things. (assumed you know the field-names for the different actions.)
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    I didn't miss anything, It's just old news.<br><br><br>
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    quangntenemy's Avatar quangntenemy 7120
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    So there's no other way than using random/secret code?<br>Imagine we have to secure 100 pages like that...<br>It'll be a tedious and error-prone job.<br>I wonder what the www's evolving into...
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    <div class="\&quot;tbscode_standard_quote_headline\&quot;"><img alt="\&quot;Quote\&quot;" src="%5C">Quote from rhican:</div><div class="\&quot;tbscode_standard_quote\&quot;"><br>The fact that it isn't fixed is because it isn't considered to big of a deal to log people out, you will see that this works on nearly all challenge sites.<br></div><br><br>Looks to me like you say it's generally only possible to log people out, nothing else.<br><br>And no, i can't write anything that gives me admin rights without knowing the form-fields for everything.<br>But that's not the point, it's the idea itself - If I can make you write forum topics by clicking on a link, i can do other (and worse) stuff as well.<br><br>Btw: I really don't care where you throw your bones at, I didn't ask you to reply to this topic, did I?
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    .
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    Towley's Avatar Towley 1790
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Some probably wonder why the csrf logouts dont work for them.<br><br>It is because some of them use the url <br><br><a href="%5C"><img alt="\&quot;link\&quot;" src="%5C">http://bright-shadows.net</a><br><br>where others use<br><br><a href="%5C"><img alt="\&quot;link\&quot;" src="%5C">http://www.bright-shadows.net</a><br><br>(notice the www)<br><br>It seems like at least some browsers distinguish between these domains, and wont send the phpsessid's if the domain wont match.<br><br>So rhican, if you want to delete some thread, be sure to use your victims choices <img alt="\&quot;;)\&quot;" src="%5C"><br>
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    .
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    cba either.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    <a href="%5C"><img alt="\&quot;link\&quot;" src="%5C">Proof of concept</a><br>Happy now? <img alt="\&quot;:P\&quot;" src="%5C">
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    .
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Oh well, I see you don't get it.<br>Your last post is just ridiculous.<br><br>And to be honest, I don't wanna waste my time with you anymore.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    cba.<br><br>ps: you are for the loose.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    It's funny how you edit all your posts, so people don't see that everything you put in question had been already answered in my previous posts.<br>Over &amp; out.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    .
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    aceldama's Avatar aceldama 4340
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    yep, <a href="%5C"><img alt="\&quot;link\&quot;" src="%5C">content</a> i tried to make the admins see none the less. <img alt="\&quot;LOL\&quot;" src="%5C">
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    noother's Avatar noother 150
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    Another stupid comment by you, rhican.<br>You should really read all posts in this topic which were made, not only the first one and ignore the rest.<br><br>But yeah, I know, you're too busy with devising plans to annoy other people.<br><br>And no, i didn't know about the topic by quangntenemy before.
    Edit
    Reply
    Quote
    0 Likes
  • 01/21/2008 11:52
    UnknownUser's Avatar UnknownUser 2,7290
    Not SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot SpecifiedNot Specified
    <div class="\&quot;tbscode_standard_quote_headline\&quot;"><img alt="\&quot;Quote\&quot;" src="%5C">Quote from <a href="%5C">noother</a>:</div><div class="\&quot;tbscode_standard_quote\&quot;"> i didn't know</div><br><br>that really seems to be the theme of this thread.<br><br>facts:<br>- Quang posted about this in 2006<br><br>- aceldama had stated only 3 days before your thread that it was still around, and active<br><br>- and then you \"\"discovered\"\" it all on your \"own\". Hurray!<br><br>- And after all those people, annoyed with noother's tone. It was still my experience that got Inferno to disable all user generated images. Because unlike the people above, I could exploit it in a way that is harmful. And that's what security is all about. Convincing the people in charge that it is worth spending money on, and as this csrf issue illustrated you do not do that with Theory. Not even when the admins are ex-security geeks, which in turn motivates my in your face attitude.<br>
    Edit
    Reply
    Quote
    0 Likes

Page 1 of 3