+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: IPB Forum hacking (/showthread.php?tid=5094767)
IPB Forum hacking - izaakl13 - Dec 14, 2015
Okay so i managed to get the conf_global.php (includes the SQL database name, user and pass). What can i do with this to basically make life shitty for the forum owner? Not asking for mentoring just a few friendly pointers.
* - HaxOr❤ - Dec 14, 2015
Depends if you can login into the MySQL database remotely. Try downloading HeidiSQL and try to connect. If you get lucky you can change the password of the admin (Or you can create a new admin user). From there you can shell the website and delete all the files or w/e you imagined doing.
* - izaakl13 - Dec 14, 2015
Just had a go and it seems remote sql is whitelisted ips only, i know they run a game server that connects to sql so must be on the allowed remote sql ip list, if i can get the ip is there anyway to spoof my own ip?
* - HaxOr❤ - Dec 14, 2015
Uh i actually never tried spoofing an IP address. But there is always Google :)
* - cybersilenc3 - Dec 15, 2015
(Dec 14, 2015 07:17 PM)izaakl13 Wrote: Okay so i managed to get the conf_global.php (includes the SQL database name, user and pass). What can i do with this to basically make life shitty for the forum owner? Not asking for mentoring just a few friendly pointers.I think there are plenty of spoofing ip tutorials on hack forum just use the search button i also have never tried nor spoofed ip it sounds interesting tho. 🤝
* - Horton - Dec 17, 2015
Or check to see if they've got PHPMyAdmin installed for that matter and login from /phpmyadmin. If not, try other web clients.
If the Admin is dumb, try logging in through other areas as well, SSH or his Cpanel for example using the password, as there is a slim chance he might have used the same one.
Once your in the DB, try options such as loading code onto the server with INTO OUTFILE or for a safer bet, grab the admin hashed password, bruteforce it, go into the admin panel and edit the skins to allow file uploading, as they allow PHP, then edit them back to how they were.