 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 75
 Members: 0
 Total: 75
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Admin in phpNuke, and now ? |
|
 Posted: Fri Apr 08, 2005 1:23 pm |
 |
|
| KingOfSka |
| Advanced user |
 |
|
| Joined: Mar 13, 2005 |
| Posts: 61 |
|
|
|
 |
|
 |
|
hi all 
i got admin on some nuke, then i only putted "this site was hacked" in the news and gone away...
but i saw many nuke being totally defaced, i mean eithere there was a "hackername.html" page with picture and other things saying the site was hacked, or the homepage was totally defaced, so you can't even access any function of phpnuke.
does anyone knows how they could have done ? |
|
|
|
|
| Posted: Fri Apr 08, 2005 1:34 pm |
|
|
| shai-tan |
| Valuable expert |
|
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
Yes this is something I have wanted to know about phpBB for a while.
Mabe they uploaded their own made database through forum administration > Database restore? |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
| Posted: Fri Apr 08, 2005 2:14 pm |
|
|
| LINUX |
| Moderator |
|
|
| Joined: May 24, 2004 |
| Posts: 404 |
| Location: Caiman |
|
|
|
|
|
|
| KingOfSka :men deface phpnuke not is good, waraxe IT Security and Insecurity Portal is not specialized for defacers, you need shared deface information - go to zone-h forum or irc.gigachat.net all channels all defacers not here |
|
|
|
|
| Posted: Fri Apr 08, 2005 4:04 pm |
|
|
| y3dips |
| Valuable expert |
 |
|
| Joined: Feb 25, 2005 |
| Posts: 281 |
| Location: Indonesia |
|
|
|
|
|
|
KingOfSka : u could use some html tag or some javascript to manipulate all the page  for example <div>
LINUX : i agree with u, so KingOFSka, let just talk about knowledge, n sharing it |
|
_________________
IO::y3dips->new(http://clog.ammar.web.id); |
|
|
|
| Posted: Fri Apr 08, 2005 4:26 pm |
|
|
| KingOfSka |
| Advanced user |
|
|
| Joined: Mar 13, 2005 |
| Posts: 61 |
|
|
|
|
|
|
|
ok sorry  i really just wanted to know how to do, not doing it really, if you see all my "hack" (don't know if i could call them "hack"...) i just put a message  |
|
|
|
|
| Posted: Fri Apr 08, 2005 5:27 pm |
|
|
| y3dips |
| Valuable expert |
|
|
| Joined: Feb 25, 2005 |
| Posts: 281 |
| Location: Indonesia |
|
|
|
|
|
|
u should change the wordz from "hack" to "defaced " : LOL
just give some try
use this tag before u wrote your "orwned/defaced/whatever"
<div id="Layer1" style="position:absolute; left:0; top:0; width:4000; height:4090; z-index:1; background-color: #000000; layer-background-color: #ccccc; border: 1px none #000000">
<!-- for example -->
<body> defa## by me coz im too lame : LOL </body> |
|
_________________
IO::y3dips->new(http://clog.ammar.web.id); |
|
|
|
| Posted: Fri Apr 08, 2005 6:02 pm |
|
|
| KingOfSka |
| Advanced user |
|
|
| Joined: Mar 13, 2005 |
| Posts: 61 |
|
|
|
|
|
|
|
hehehe i promis next time i wont say "hack" without saying "i'm joking" lol lol
thanks a lot y3
and theres no way block this use of <div> ?
wouldn't it be possible to use the "strip" function of php ? (i hope i'm not saying total nonsense thing, i just started learning php lol ) |
|
|
|
|
| Posted: Fri Apr 08, 2005 11:48 pm |
|
|
| y3dips |
| Valuable expert |
|
|
| Joined: Feb 25, 2005 |
| Posts: 281 |
| Location: Indonesia |
|
|
|
|
|
|
 why dont u give some try
i do it with POC , even NUKE and Phpbb dont parsing <div> in use ; for example the title of the forum name with <div> (then u find something interesting ) <-- try to make a new room , i dont suggest u to do it on somebody BOX , but DO it in our own box or another research box without harm anything
btw, its not to late to stop defacing .. coz i do that too
:peace: |
|
_________________
IO::y3dips->new(http://clog.ammar.web.id); |
|
|
|
| Posted: Sat Apr 09, 2005 4:34 am |
|
|
| shai-tan |
| Valuable expert |
|
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
| Yes do it on your own box like me. Well except for 2 sites I didnt like very much but that was in the past |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
| Posted: Sun Apr 17, 2005 9:52 am |
|
|
| KingOfSka |
| Advanced user |
|
|
| Joined: Mar 13, 2005 |
| Posts: 61 |
|
|
|
|
|
|
|
ok the time for the decision has come 
i'm root on a pretty big server, i could do a mass defacement or just leave a message to the admin
i think i'll only leave a message |
|
|
|
|
| Posted: Sun Apr 17, 2005 10:18 am |
|
|
| shai-tan |
| Valuable expert |
|
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
| Yes you only really need to prove to your self that you can do it. I did it once to prove they needed to update their forums from phpBB 2.0.6. They did after about a week. And I used the Waraxe proof of concept for 2.0.6 so it only got the first 25 characters of the hash. They were scared shitless. But Im not a bad person...... much |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
www.waraxe.us Forum Index -> PhpNuke
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
