Hack Forums
[Team INTRA]'s Official Help-Desk - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Team INTRA]'s Official Help-Desk (/showthread.php?tid=3927956)

Pages: Pages 1 2 3 4 5 6 7 8 9

[Team INTRA]'s Official Help-Desk - Th3PonyWizard - Dec 14, 2013

[img]http://i1178.photobucket.com/albums/x362/JupiiterDesigns/try2-1.png[/img]

Team INTRA - Official HelpDesk Thread v2
Old one can be found here

Look who came back from the grave? It's been a while.
Welcome to our team's helpdesk.
This group's main ideal usually resolved around Web Applications and such.
Yet, we're not restricted to it, as we have people from a variety of subjects. Try us~

Rules:
  • Use Google, avoid asking trivial questions and just about anything that can be fetched one searching engine click away.

  • Respect thus be respected; We aren't here to show off nor mock others, it's a pleasant little gesture to share knowledge and support one each-other, so take it as such.

  • You can 'try' helping even if you're not within group borders, but expect your reply to be taken a tad less seriously, hence amplify the quality and only post if you're really needed.

  • Try to start arguments here over dead-end questions and backslash us and I'll bite your fucking head off. Thanks C:


There's a form for you guys to keep your questions in order, although it's not mandatory.
Quote:Question:
Optional details (Screenshot / Vulnerable link / etc):


We do:
Everything WebApp down to server security auditing.
Low-Level (Overflows, general software etc)
Networking+-, need a guy over here but I have a contact.
Current members:
Spoiler (Click to View)

* - hoer- - Dec 14, 2013

INB4: Is this site vulnerable 🤐

* - Th3PonyWizard - Dec 15, 2013

(Dec 14, 2013 02:55 PM)hoer- Wrote:  INB4: Is this site vulnerable 🤐
I don't really mind doing scans once a while, it's annoying though

* - VipVince - Dec 15, 2013

Sounds promising, good luck in your ventures.

* - BeggFoMercy - Dec 15, 2013

Willing to stay up-tuned on this thread as much as possible.

* - pwntoken - Dec 15, 2013

Question: https://hackforums.net/showthread.php?tid=3929724
I thought to post this since nobody responded. I think re-inventing the wheel would be so bad.

* - Im gone brah - Dec 15, 2013

Can personally vouch for my pony. :^^

* - Zixem - Dec 16, 2013

(Dec 15, 2013 10:11 AM)Encrypted32 Wrote:  Question: https://hackforums.net/showthread.php?tid=3929724
I thought to post this since nobody responded. I think re-inventing the wheel would be so bad.
https://hackforums.net/showthread.php?tid=3929724&pid=37011753#pid37011753

(Dec 15, 2013 10:53 AM)Zayne Wrote:  Can personally vouch for my pony. :^^
he's mine. g'rr.

* - Naww - Dec 16, 2013

Heyyy guys i have a question..i have this upload system but it only accepts images i tried changing the extension like shell.php.jpg but aint working..

My question is what should i do x) in order to upload the shell as an image.
Thnx for u time.

* - v3xr - Dec 16, 2013

Glad to see the group is still up and running. Best of luck lads!

* - Th3PonyWizard - Dec 16, 2013

(Dec 16, 2013 02:23 PM)Naww Wrote:  Heyyy guys i have a question..i have this upload system but it only accepts images i tried changing the extension like shell.php.jpg but aint working..

My question is what should i do x) in order to upload the shell as an image.
Thnx for u time.
A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox, upload your shell.img, directly change the POST value name to shell.php and see if it goes.
Also, try nullbyte. shell.php%00.jpg

* - Cathal - Dec 16, 2013

(Dec 16, 2013 02:31 PM)Th3PonyWizard Wrote:  A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox, upload your shell.img, directly change the POST value name to shell.php and see if it goes.
Also, try nullbyte. shell.php%00.jpg

There's an even better chance it's using
Code
if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Also if anyone has any spare time, I'd appreciate some help over here (not hecking) https://hackforums.net/showthread.php?tid=3932443

* - John Rogers - Dec 16, 2013

(Dec 16, 2013 02:31 PM)Th3PonyWizard Wrote:  A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox

Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)

(Dec 16, 2013 02:52 PM)MrCathal09 Wrote:  
Code
if(!getimagesize($file))
    // not image
Speaking of which, do you know if it's possible to bypass that?

Literally do not want to ignore this, so sorry if I'm ruining this thread lol.
You inject your evil PHP code into a valid image, while using the NULL-BYTE method for uploading or whatever.

Okay, sorry. Bye. :)

* - Th3PonyWizard - Dec 16, 2013

(Dec 16, 2013 02:56 PM)John Rogers Wrote:  Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)
I explicitly meant client sided, lots of sites do it. All these flashy AJAX eyecandy crap, hell even twitter had this vuln for a while.

* - Dyme‎‎‎‎‎‎‎‎‎‎‎‎ - Dec 16, 2013

(Dec 16, 2013 02:52 PM)MrCathal09 Wrote:  There's an even better chance it's using
Code
if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Check number 3:
http://hackers2devnull.blogspot.co.uk/2013/05/how-to-shell-server-via-image-upload.html?m=1 (credits to cheatson)

Of course you'll need to bypass file extensions as well if applicable.