 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 109
 Members: 0
 Total: 109
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Question about XSS Remote Cookie Disclosure Exploiting |
|
 Posted: Sat Apr 15, 2006 6:04 am |
 |
|
| Vixje |
| Active user |
 |
|
| Joined: Mar 25, 2006 |
| Posts: 35 |
|
|
|
 |
|
 |
|
Hi there,
I have setup a test account and managed to steal my own cookie. I guess this was the easy part. Here's the output of my cookie stealer:
Cookie: phpbb2mysql_t=a:1:{i:110;i:1145043838;}; phpbb2mysql_data=a:2:{s:11:\"autologinid\";s:33:\"205340551044400583937258.37903461\";s:6:\"userid\";i:193;}; phpbb2mysql_sid=dd583d8eb8a767dcaf15efc2f751a272
IP: 210.14.4.82
Date and Time: 14 April, 2006, 10:27 pm
Referer: http://10.23.44.4/forum/posting.php
I'm really having a hard time decyphering this and reading a hash from it. I can see the session id, but i dont think this would help me much since you always need to relog when u enter admin cp.
Any gurus out there? |
|
|
|
|
|
Re: Question about XSS Remote Cookie Disclosure Exploiting |
|
| Posted: Sat Apr 15, 2006 10:08 pm |
|
|
| Indiction |
| Regular user |
|
|
| Joined: Apr 12, 2006 |
| Posts: 11 |
|
|
|
|
|
|
|
| Vixje wrote: | | \"205340551044400583937258.37903461\" |
I think this is supposed to by the hash, but why is it a floating point number?
There is a way to get around relogging in admin CP you know with just the SID. Try this, for example
http://forum/phpbb/admin/usercp.php?sid=<your sid>&<enter an arguement for usercp here to execute>
Does this make sense? Correct me if I'm wrong and ask me if its unclear. |
|
|
|
|
| Posted: Sun Apr 16, 2006 10:36 pm |
|
|
| Vixje |
| Active user |
|
|
| Joined: Mar 25, 2006 |
| Posts: 35 |
|
|
|
|
|
|
|
Hmm weird, I always assumed phpbb uses md5. Guess i was wrong  |
|
|
|
|
| Posted: Tue Apr 18, 2006 1:41 pm |
|
|
| beastyarny |
| Regular user |
|
|
| Joined: Apr 18, 2006 |
| Posts: 5 |
| Location: Russia |
|
|
|
|
|
|
it's not a hash, this is user identifier in phpbb forum version 2.0.18/19....
so it cann't be decoded. the real hash is stored in data base and didn't transmitted in cookies |
|
|
|
|
| Posted: Tue Apr 18, 2006 6:45 pm |
|
|
| syntax9 |
| Active user |
 |
|
| Joined: Dec 21, 2005 |
| Posts: 33 |
|
|
|
|
|
|
|
| beastyarny if you know of a way with .18 / .19 with the new indentifier please let me know, ive been trying for months on a certain site and i always get the same cookies with the decial. 31 bit hash. |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
