full-disclosure - Some SQL inj and including hints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 14 Jan 2010 16:39:37 +0300
From: Vladimir Vorontsov <vladimir.vorontsov@...ec.ru>
To: Full disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Some SQL inj and including hints

Hi all,

1. On Win systems use short directories names like that:
Progra~1 == "Program Files"
Docume~1 == "Documents and Settings"
if you want to create file in space contained folder using INTO
OUTFILE/INTO DUMPFILE injection/
Example:
http://localhost/inj.php?id='/**/INTO/**/OUTFILE/**/%22C:/PROGRA~1/APACHE/VAR/WWW/index.php%22

In other cases your can't write file using MySQL if their absoute path have
a spaces.

2. Use .phtml extension instead of .php to fraud WebApplicationFirewalls
and filters.
Default apache2 configuration file like this:

<IfModule mod_php5.c>
AddType application/x-httpd-php .php .phtml .php3
AddType application/x-httpd-php-source .phps
</IfModule>

Sorry for my bests English.

-- 
-----------------------------------------------------------------
Best regards!
Vladimir Vorontsov, security expert.
ONsec: turn on security

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/