[Th3PonyWizard]

[img]http://i1178.photobucket.com/albums/x362/JupiiterDesigns/try2-1.png[/img]

Team INTRA - Official HelpDesk Thread v2
Old one can be found here

Look who came back from the grave? It's been a while.
Welcome to our team's helpdesk.
This group's main ideal usually resolved around Web Applications and such.
Yet, we're not restricted to it, as we have people from a variety of subjects. Try us~

Rules:

• Use Google, avoid asking trivial questions and just about anything that can be fetched one searching engine click away.
  


• Respect thus be respected; We aren't here to show off nor mock others, it's a pleasant little gesture to share knowledge and support one each-other, so take it as such.
  


• You can 'try' helping even if you're not within group borders, but expect your reply to be taken a tad less seriously, hence amplify the quality and only post if you're really needed.
  


• Try to start arguments here over dead-end questions and backslash us and I'll bite your fucking head off. Thanks C:
  

There's a form for you guys to keep your questions in order, although it's not mandatory.

Question:
Optional details (Screenshot / Vulnerable link / etc):

We do:
Everything WebApp down to server security auditing.
Low-Level (Overflows, general software etc)
Networking+-, need a guy over here but I have a contact.
Current members:
Spoiler (Click to View)
Mx
HaxOr
Th3PonyWizard
Zixem
The Mr. X
Downloading
Beggfomercy
Ergo
cheatson
JoinSe7en

[hoer-]

INB4: Is this site vulnerable 🤐

[Th3PonyWizard]

INB4: Is this site vulnerable 🤐

I don't really mind doing scans once a while, it's annoying though

[Th3PonyWizard]

Heyyy guys i have a question..i have this upload system but it only accepts images i tried changing the extension like shell.php.jpg but aint working..

My question is what should i do x) in order to upload the shell as an image.
Thnx for u time.

A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox, upload your shell.img, directly change the POST value name to shell.php and see if it goes.
Also, try nullbyte. shell.php%00.jpg

[John Rogers]

A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox

Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)

Code

if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Literally do not want to ignore this, so sorry if I'm ruining this thread lol.
You inject your evil PHP code into a valid image, while using the NULL-BYTE method for uploading or whatever.

Okay, sorry. Bye. :)

[Th3PonyWizard]

Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)

I explicitly meant client sided, lots of sites do it. All these flashy AJAX eyecandy crap, hell even twitter had this vuln for a while.

[Dyme‎‎‎‎‎‎‎‎‎‎‎‎]

There's an even better chance it's using

Code

if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Check number 3:
http://hackers2devnull.blogspot.co.uk/20...d.html?m=1 (credits to cheatson)

Of course you'll need to bypass file extensions as well if applicable.

[marymae]

I am trying to gain access to a site by getting into another site on the same server then rooting
But, the site is protected by cloudflare so I can't see its real server ip so I can't look at the real sites on the server
I've dried many cloudflare resolvers, none of them are giving me it's ip
Any ideas?
all hypothetical of course

[marymae]

I'll try it out, hopefully it will work
thanks

[Ginster]

Man you guys are ancient now! Hope this all works out.

[Th3PonyWizard]

Yeah, stuff is working out slowly. Still trying to get our challenge website's up and running.

[sasha95]

does it seem a good job you hold me adjourned please??

[hoer-]

Well here is my problem, with direct download vulnerability i just dumped configuration file where was stored, mysql information (username/password/database), than i tried to access phpmyadmin but here is a problem, there are using cookie authentication if someone don't know about it ( http://wiki.phpmyadmin.net/pma/Auth_types ) Well my question is that, if someone know any way to bypass it.

http://s27.postimg.org/cvy7yriwz/phpmyadmin.png

p.s. of course, i tried google, used even all browser, but still the same.

If port 3306 you can connect via cli

Code

mysql --host=site.com  --password=pass

[Th3PonyWizard]

Ain't no bump bucking harder than mine.

[hoer-]

tried that but server does not accepting connection from my IP! even it's not accepting connection from same ip, just with another range.

Then it might only accept connections locally, can you 'into outfile' ? if you can and have some path disclosure you can shell it that way. 👹