It is the path of least resistance that makes rivers and men crooked. - Bj Palmer
Thursday, August 28, 2008
Navigation
Donate
Has this website helped you?
px
If so, please donate a little to help out with hosting costs.
Members Online
Total Online: 44
Web Spiders: 5
Guests Online: 31
Members Online: 13

Registered Members: 34608
Newest Member: Babaluno
Most Users online: 523
Latest Articles

_Realistic 4_


advertisement



website security I know loads of people are stuck so this may help

Ok this one is kinda hard at first but once you know where you need to be it's simple.

Part one: Finding directories
If you look in the source of the main page you should notice that if you submit your e-mail address it takes you to a file named mail.html, so let's submit our e-mail (you can type anything) you shoul notice it goes straight to an error page. Now if you have firefox what you can do is in the URL bar enter "view-source:http://the site" with no quotes. Now you should see where it takes you and you should also see a directory called /m*i*/ go there.

Part two: Logging in,
Now when you are in the directory called /m*i*/ you should see a link to a login page, but instead we want to view the source of the page we're in. So view it already! Now in the source you should see an admin login, now instead of going there we login as Drake in the members login and view the files in there.

Part three: Trying things,
Now we know what files are available in the users page try them in after the admin login page and voila we can view things without admin permissions! Now we need to remove Ghost's record so look around and see how to get to the records, try using "all.php" found them? Then lets move on.

Part four: Removing Ghost's record
Now if you know the basics of php you will find this kind of easy, so we know where the records are now right? Goooood now we need to remove them so try things on the lines of all.php?(action)=(thing)&&id=(something) and remember we're trying to remove _one_ record not loads of records. If you manage to remove his record you will get a password, we will need this soon.

Part five: Clearing logs,
Now if you've already found the log clearing from that's what you need the password for ;) but if not try and think what it could be if the records were in "all.php?id=records" think logs not reocrds this time. Found it? GOOD! Now we enter the pass and get our points w00t w00t!

Guest
Username

Password

Remember Me


Bookmark This Page
Affiliates
Adverts

 


By using, viewing or obtaining any information contained on this site, you agree to the disclaimer.

© HellBound Hackers 2007- 2008. Since 3rd December 2004.