Waraxe IT Security Portal

gone · Regular user

on the net it says there is some kinda cross site scripting holes. I checked every place I could think of to add HTML code and simple scripts.

the script tags are turned into a string and are red. All HTML characters

become special characters so HTML is turned off so there is no hole in this site I was messing with.

Is there a work around besides the admin hack I read so much about.

waraxe · Site admin

I have seen similar exploits, but they are hard to exploit and chance of success is slim.
If target forum is located on shared webserver, then enumerate neighbor websites.
If you can find neighbor website with exploitable vulnerability,
then there is chance to use it against main website (if webserver is configured not very securely).
And look for third-party add-ons -> vbseo, etc.
Such third-party software components are usually less secure than VBulletin itself Smile

gone · Regular user

the server has gone down a few times but I'm not sure what other sites they host.

what do you mean by add-ons, the only thing I know of are Google adds. this is a very basic VB forum.

plus the admin hack may not work on an admin who changed his permission level to a Gmod.

waraxe · Site admin

There are ways to find out other websites hosted on same server.
Try this for example:

http://domainsbyip.com/

gone · Regular user

there is only one site on that server but there are some nearby Ip addresses

ultimatetoronto.com, mysticlovenetwork.sslpowered.com, womackconstruction.net ...
pseudo-flaw.net, libertycentersf.org, maxb.net ...
us-creations.com, indianovo.com, aakritisolutions.com ...

the admin hack will work now. if I take some cookies, can I use the cookies any time or do I have to use them now?

gone · Regular user

I have everything set up but I want to test this on a vb forum. I can't find a free one to test on. are there free Vb sites, I haven't found any.