[Th3PonyWizard]

[img]http://i1178.photobucket.com/albums/x362/JupiiterDesigns/try2-1.png[/img]

Team INTRA - Official HelpDesk Thread v2
Old one can be found here

Look who came back from the grave? It's been a while.
Welcome to our team's helpdesk.
This group's main ideal usually resolved around Web Applications and such.
Yet, we're not restricted to it, as we have people from a variety of subjects. Try us~

Rules:

• Use Google, avoid asking trivial questions and just about anything that can be fetched one searching engine click away.
  


• Respect thus be respected; We aren't here to show off nor mock others, it's a pleasant little gesture to share knowledge and support one each-other, so take it as such.
  


• You can 'try' helping even if you're not within group borders, but expect your reply to be taken a tad less seriously, hence amplify the quality and only post if you're really needed.
  


• Try to start arguments here over dead-end questions and backslash us and I'll bite your fucking head off. Thanks C:
  

There's a form for you guys to keep your questions in order, although it's not mandatory.

Question:
Optional details (Screenshot / Vulnerable link / etc):

We do:
Everything WebApp down to server security auditing.
Low-Level (Overflows, general software etc)
Networking+-, need a guy over here but I have a contact.
Current members:
Spoiler (Click to View)
Mx
HaxOr
Th3PonyWizard
Zixem
The Mr. X
Downloading
Beggfomercy
Ergo
cheatson
JoinSe7en

[hoer-]

INB4: Is this site vulnerable 🤐

[Th3PonyWizard]

INB4: Is this site vulnerable 🤐

I don't really mind doing scans once a while, it's annoying though

[VipVince]

Sounds promising, good luck in your ventures.

[BeggFoMercy]

Willing to stay up-tuned on this thread as much as possible.

[pwntoken]

Question: https://hackforums.net/showthread.php?tid=3929724
I thought to post this since nobody responded. I think re-inventing the wheel would be so bad.

[Im gone brah]

Can personally vouch for my pony. :^^

[Zixem]

Question: https://hackforums.net/showthread.php?tid=3929724
I thought to post this since nobody responded. I think re-inventing the wheel would be so bad.

https://hackforums.net/showthread.php?ti...id37011753

Can personally vouch for my pony. :^^

he's mine. g'rr.

[Naww]

Heyyy guys i have a question..i have this upload system but it only accepts images i tried changing the extension like shell.php.jpg but aint working..

My question is what should i do x) in order to upload the shell as an image.
Thnx for u time.

[v3xr]

Glad to see the group is still up and running. Best of luck lads!

[Th3PonyWizard]

Heyyy guys i have a question..i have this upload system but it only accepts images i tried changing the extension like shell.php.jpg but aint working..

My question is what should i do x) in order to upload the shell as an image.
Thnx for u time.

A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox, upload your shell.img, directly change the POST value name to shell.php and see if it goes.
Also, try nullbyte. shell.php%00.jpg

[Cathal]

A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox, upload your shell.img, directly change the POST value name to shell.php and see if it goes.
Also, try nullbyte. shell.php%00.jpg

There's an even better chance it's using

Code

if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Also if anyone has any spare time, I'd appreciate some help over here (not hecking) https://hackforums.net/showthread.php?tid=3932443

[John Rogers]

A good chance is that the extension check is being done client-sided, so you can capture http packet upload with Live HTTP packets tool for firefox

Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)

Code

if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Literally do not want to ignore this, so sorry if I'm ruining this thread lol.
You inject your evil PHP code into a valid image, while using the NULL-BYTE method for uploading or whatever.

Okay, sorry. Bye. :)

[Th3PonyWizard]

Not sure if I'm being dumb with my English or not, but client-side validation would be using JavaScript (which is, in general, really dumb as the attack has control over that) or whatever (you can check this via your browser's console feature and probably ruin the validation - Chrome and FF have these). If I'm right, you probably meant server-side validation.

Although if I'm wrong, ignore me. ;)

I explicitly meant client sided, lots of sites do it. All these flashy AJAX eyecandy crap, hell even twitter had this vuln for a while.

[Dyme‎‎‎‎‎‎‎‎‎‎‎‎]

There's an even better chance it's using

Code

if(!getimagesize($file))
    // not image

Speaking of which, do you know if it's possible to bypass that?

Check number 3:
http://hackers2devnull.blogspot.co.uk/20...d.html?m=1 (credits to cheatson)

Of course you'll need to bypass file extensions as well if applicable.