 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 139
 Members: 0
 Total: 139
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
phpbb hack without cookie? |
|
 Posted: Fri May 19, 2006 12:28 pm |
 |
|
| smile |
| Regular user |
 |
|
| Joined: May 19, 2006 |
| Posts: 5 |
|
|
|
 |
|
 |
|
Hi all,
i'm a total noob to the whole hacking world but i want to test a certain phpbb board if it's secure. It's phpbb 2.0.11
After two days of research all i can find are exploits which use some sort of cookie fakes. Unfortunatly my board doesn't send any cookie at all.
Is there another way to hack that board anyway?
greetz, smile |
|
|
|
|
| Posted: Fri May 19, 2006 3:17 pm |
|
|
| sljyro |
| Advanced user |
 |
|
| Joined: Mar 23, 2006 |
| Posts: 53 |
|
|
|
|
|
|
|
why do you want to test if it's secure? after 2 days of research you should know its one of the most vulnerable versions. there's loads of perl sripts too i think.
if its your board, why not upgrade it to the latest version? that way you will know its more secure than now |
|
|
|
|
|
|
|
|
| Posted: Fri May 19, 2006 3:33 pm |
|
|
| smile |
| Regular user |
|
|
| Joined: May 19, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
| sljyro wrote: | why do you want to test if it's secure? after 2 days of research you should know its one of the most vulnerable versions. there's loads of perl sripts too i think.
if its your board, why not upgrade it to the latest version? that way you will know its more secure than now |
It's not my board, im just a mod there and want to wake up our lazy admins because we got some bots there recently.
And you're absolutly right - we need to upgrade! Thats the purpose of my mission!
Sure i know that it's vulnerable but even the pearl scripts refer to any kind of cookie stealing/altering etc.
Maybe i'm wrong in that and you can show me a perl script which goes another way? |
|
|
|
|
| Posted: Fri May 19, 2006 5:50 pm |
|
|
| sljyro |
| Advanced user |
|
|
| Joined: Mar 23, 2006 |
| Posts: 53 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Posted: Fri May 19, 2006 6:49 pm |
|
|
| smile |
| Regular user |
|
|
| Joined: May 19, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
Thanks, for your efforts!
| sljyro wrote: | try this, it says 2.0.13 or lower versions
http://www.milw0rm.com/exploits/907
its to get a md5 hash of any user, thus giving you the chance to crack the password |
Nope. That one is related to the download.php. But we don't use this.
Yeah, i spent almost one of my two research days on this site. But it's like i said. There's no exploit not related to cookies.
I'm not familiar with sql queries. Maybe that could do the job - dunno. Brute force it's nothing i care of here.
It seems that phpbb 2.0.11 with disabled cookies isn't that vulnerable as it's supposed to be.
Maybe any other ideas? |
|
|
|
|
|
|
|
|
| Posted: Fri May 19, 2006 7:20 pm |
|
|
| sljyro |
| Advanced user |
|
|
| Joined: Mar 23, 2006 |
| Posts: 53 |
|
|
|
|
|
|
|
this is as far as i can go, im new to this myself. ive tried couple of perl scripts and cookie exploits here and there, and thats about it 
there might be another way, but im not familiar with it if there is. |
|
|
|
|
| Posted: Sat May 20, 2006 9:25 am |
|
|
| smile |
| Regular user |
|
|
| Joined: May 19, 2006 |
| Posts: 5 |
|
|
|
|
|
|
|
Thanks, anyway.
Maybe somebody else? |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
