Waraxe IT Security Portal

dasatti · Regular user

Hi,

I am new. Is their some way to bypass magic_quotes when turned on in PHP. I read that it is possible throught hexa encoding the urls. How do I do that. So if that is possible in this way does it mean that it is virtually possible to inject any site with even magis_quaotes turned on if we get a proper url to inject and the coder has not taken any extra coding measures to prevent the injection other than relying on magic_quotes??

I have another question, I obtained user ids and passwords from a site through sql injection. Even the passwords were not hashed but they were of use since I could not find the path to the admin area of the site to log in. I tried many techniques in google to find out the path to admin area but no success. So how can I do that other than google. Is their some way to get whole directory structure of some site.

My questions may seem foolish to you but I am new.

Thanks

compe2004 · Regular user

you just need to hex the value

for example

load_file('/etc/passwd/file')

to be transformed to something like

load_file(3fd071072b0acd0c16c9b0b9f236df26)

if you know php, then there's a function that can convert that to hex value.

no, there are still ways to secure a site even if magic quotes are on. server side scripting is one. i guess.

Cyko · Moderator