Waraxe IT Security Portal

TehShady · Beginner

Hey everyone, I've been trying for a long time to get back at people that had me make forums for them, then kept my logo and layout and didn't compensate me as we agreed upon. This has been making me angry for quite some time to say the least. I'm pretty certain that they dont update their forums the way that they should, since I was the one who set it up for them. I even still know the database name and server (I have a few ideas for the password I used) The problem is that I can't connect to the database with any of the mySql tools I've found.

Anyone want to exact revenge, or at least point me to how I can connect to an external phpbb database if I know the info, so I can remove the fields and sleep peacefully at night?

waraxe · Site admin

First thing: is TCP port 3306 open at server? If so, then maybe you can access that mysql database, if you have username and password.
Next - if remote mysql access is not possible, then - have you info about phpmyadmin, cpanel, directadmin or some other administration interface? Maybe you have phpbb forum admin username and password? There is plenty of possibilities, because you possibly have insider information.
And if anything does not help, then it's time to put on black hat and try some exploits.

TehShady · Beginner

I have access to phpmyadmin, but it just asks for a database name and password, I do not see a way to specify the domain of the database I want to connect to (it seems to be only for databases on the server with the php tool)

Any other suggestions on ways I could connect to this database if I have the login, password, and database name?

Outside of that, my search for exploits has come up empty, and my username & IP address have been banned on the forums, so no look on those routes. Any additional help would be appreciated

waraxe · Site admin

Is that website on shared server? If you can find weak point on any of the co-located websites on same server and finally get php code execution level, then you can use mysql username and password for access to database. Even this is possible - you will pay for one month hosting service on same server as usual client and then write php script, which will log in to mysql with target's username and password.
And that phpmyadmin - why can't you use it? Is it the same interface, that's meant to be used by hosting clients?

TehShady · Beginner

the PHPAdmin I use is on a friends server, completely unrelated domain. I forget what company hosts the account for what I'm targeting. So there is no other way to gain access to an external mysql database?

I really wanna try the username and password and lay havoc to this site. They stole my logo and forums, then told me that I didnt really do any work on it, so I dont deserve anything. Sad

waraxe · Site admin

You know target's URL, right? Now take domain name form URL and resolve to webserver IP address. Now it's easy to find out hosting company and possible colocated websites on that webserver. Next, scan that server for TCP port 3306 - if it's open, then remote mysql access may be possible. If not, then consider other options.