Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 23, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 71 Members: 0 Total: 71 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> Newbies corner -> How to upload a php file to the server? View previous topic :: View next topic How to upload a php file to the server? Posted: Sun Dec 09, 2007 10:38 pm gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine Hello everyone, i am a bit new to this one... I wont to upload my own php file to the server, can you give me any example how to do this? The only way thats this server accepts uploading is throu the image section... And the validating is done with php so it doesnt allows me to upload anythin else then image, Any idea how to bypass this? I searched google but only found a well known bugs for some forums and etc... This site that i am trrying to hack got no forums or software that i know of... Thanks for any advice! Posted: Sun Dec 09, 2007 11:44 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria Посмотри на соседей.Всегда есть такие. Posted: Mon Dec 10, 2007 1:21 am akens Regular user Joined: Dec 06, 2007 Posts: 22 Try out other options Posted: Mon Dec 10, 2007 10:28 pm gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine koko wrote: Посмотри на соседей.Всегда есть такие. соседи = другие сайти на сервере? Posted: Tue Dec 11, 2007 1:31 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria Да на других сайтах которъе на серваке посмори.Если есть такие конечно. Posted: Wed Dec 12, 2007 3:56 am gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine Quote: Да на других сайтах которъе на серваке посмори.Если есть такие конечно. А какой самий лутший метод нахадит сколка сайтов на сервере? Пару дней назат я вставил IP етого саита на какомто поискавике(нашол здесь), но мне нечево не нашло... Как понят какая ип самая главная на сервере? The site I am trying to hack seems to be using a simple PHP validation. Its only checks the files extention. I guess the script should look something like this: Code: $ext = substr($filename, strrpos($filename, '.') + 1); if ($ext == "jpg") { echo"Uploaded!"; }else { $error .= "Wrong Filename"; } Is there any known way to expose this? Obviously i am able to upload php files with jpg extension... Is there anyway i can rename those files while they are on server? Posted: Wed Dec 12, 2007 10:40 am pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria run>>cmd Ping victim.com Then go here: http://domainsdb.net/64.193.62.130 or here http://www.seologs.com/ip-domains.html And type IP.No you can't rename files on server except if you have shell. Posted: Wed Dec 12, 2007 2:37 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu gtal3x wrote: Quote: Да на других сайтах которъе на серваке посмори.Если есть такие конечно. А какой самий лутший метод нахадит сколка сайтов на сервере? Пару дней назат я вставил IP етого саита на какомто поискавике(нашол здесь), но мне нечево не нашло... Как понят какая ип самая главная на сервере? The site I am trying to hack seems to be using a simple PHP validation. Its only checks the files extention. I guess the script should look something like this: Code: $ext = substr($filename, strrpos($filename, '.') + 1); if ($ext == "jpg") { echo"Uploaded!"; }else { $error .= "Wrong Filename"; } Is there any known way to expose this? Obviously i am able to upload php files with jpg extension... Is there anyway i can rename those files while they are on server? Can you post all the src code from upload script? Maybe there are some possibilities, you never know ... Posted: Wed Dec 12, 2007 5:30 pm gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine waraxe wrote: Can you post all the src code from upload script? Maybe there are some possibilities, you never know ... Sadly i dont have a src code, but I am only guessing what it looks like... By the way... I have access to their ftp server, but with username thats i am able to login, there is no www directory there... also i tried logging in with SSH seens i have got an account there... It does logs me in but then as soon as the message comes "Your last login: MON ... from myhost.com" the connection dies... no error at all... I am very confused! Thanks again for your replys! Posted: Wed Dec 12, 2007 6:30 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria Если нет www че тода есть там?Сделай листинг диров если можно.Про ssh не очень понял.Тъй конектишся но тебя въбрасъвает или?Если логин:пароль для ssh не рутовские то тебя логирует в логах что тъй входил. Posted: Wed Dec 12, 2007 7:54 pm gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine koko wrote: Если нет www че тода есть там?Сделай листинг диров если можно.Про ssh не очень понял.Тъй конектишся но тебя въбрасъвает или?Если логин:пароль для ssh не рутовские то тебя логирует в логах что тъй входил. Там очен много файлов, но все они или фильми или музыка... Я не нашол там не один файл который можно скачать через сайт... Как я понял, они зделали левого юзера на сервере каторий на имеет не кокой связи с сайтом, на катором они просто обмениваются файлами мезду собой. А бот это я палучаю когда захазу через SSH: Code: login as: (myuser) Using keyboard-interactive authentication. Password: Linux (somehost) 2.6.18-028test015.1+31-ovz-smp #1 SMP Tue Feb 6 20:33:47 CET 2007 x86_64 GNU/Linux The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Dec 12 22:49:12 2007 from (my host here) So everything looks fine! However after this i am getting disconnected! Posted: Wed Dec 12, 2007 8:12 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria Так.С соседей что получилось?На их сайте какой нить движок или все самописное? Posted: Thu Dec 13, 2007 1:03 am gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine koko wrote: Так.С соседей что получилось?На их сайте какой нить движок или все самописное? Кстати тока шяс замаетил что у них есть форум PHPBB2... Незнаеш как ат туда зделать upload? У меня па идее узе есть md5 пароль модератора все что осталось зделать ето его крякнуть... узе 3й чяс крякаю и всё не как не крякнется... Posted: Thu Dec 13, 2007 1:23 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu gtal3x wrote: koko wrote: Так.С соседей что получилось?На их сайте какой нить движок или все самописное? Кстати тока шяс замаетил что у них есть форум PHPBB2... Незнаеш как ат туда зделать upload? У меня па идее узе есть md5 пароль модератора все что осталось зделать ето его крякнуть... узе 3й чяс крякаю и всё не как не крякнется... Post you hash here Posted: Thu Dec 13, 2007 1:27 am gtal3x Active user Joined: Dec 03, 2007 Posts: 33 Location: Ukraine waraxe wrote: gtal3x wrote: koko wrote: Так.С соседей что получилось?На их сайте какой нить движок или все самописное? Кстати тока шяс замаетил что у них есть форум PHPBB2... Незнаеш как ат туда зделать upload? У меня па идее узе есть md5 пароль модератора все что осталось зделать ето его крякнуть... узе 3й чяс крякаю и всё не как не крякнется... Post you hash here Thanks for quick reply 3c0a7f7d5e9a14bea5621c3622b0a780 and if this uncrackble... 65efb79bfd80ad92970c3d4f58cc5bdc How to upload a php file to the server? www.waraxe.us Forum Index -> Newbies corner You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.047 Seconds