+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Hacked a university [$_GET Question] (/showthread.php?tid=5243479)
Hacked a university [$_GET Question] - Sithlord - Apr 19, 2016
I like Java and when it comes to PHP and SQL I'm not exactly the greatest developer so I do apologize in advance if this seems somewhat silly.
I know the basics of PHP and SQL long story short I've hacked a university using a manual UNION injection on one of their $_GET lines of code ... why this this still an issue, why don't people just use $_POST? What developer is really that bad especially considering this place is a prestige and well known Australian university. It just seems insane that this security flaw would even exist.
* - Hooded Robin - Apr 19, 2016
$_POST wouldn't make it any safer, so securing this would potentially elude even you :p
You need to implement some type of sanitizing routine before using any user supplied data, and how you sanitize depends on how you're using said data (db, rendered view, commands, etc)...
* - Kyle1995 - Apr 21, 2016
This made me laugh lol
$_GET is just as insecure as $_POST, it isn't where the vulnerability comes in, it's the actual sql part. Keep it up though, it's good you're actually getting familiar with the code, even if it's new to you.
* - Viktory - Apr 22, 2016
(Apr 21, 2016 07:27 PM)Involution Wrote: $_GET is just as insecure as $_POSTneither are "insecure" per se, they're just methods to exchange data. It's the incorrect implementation of these is where vulnerabilities are introduced.