iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (0)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Insecure Cookie Handling Mini Tut
  • Xin
    Posts: 3,251
    align=center]Session Handling Authentication Bypass[/align]
    [list]
    [*]This is a technique that can be used in a lot of attacks, its most well known for hacking PHPBB forums as most of the 2.. are vulnerable to some version of this. [/*:m][/list:u]
    [list]
    [*]Firstly We Will need Live HTTP Headers Download Here now go to the forum vulnerable to this and load up LiveHttpheaders.[/*:m][/list:u]
    [list]
    [*]Go to www.targetsite/forum/index.php and refresh the page, now look at LivehttpHeaders and you should get some data on the session, scroll down to cookie and press replacy it should say something like this

    "phpbb2mysql_data=a%3A0%3A%7B%7D; phpbb2mysql_sid=03b10d7157a0d0e435461782369655f6"


    this is the data for a visitor, replace the mysql_data with

    "phpbb2mysql_data a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"


    and set the
    my_sql sid to 2
    (the member number for admin) Press replay and you should be logged in as admin![/*:m][/list:u]
    [list]
    [*]To find vulnerable sites type in the dork "Powered by PHPBB 2.0.12" (or any other vulnerable version) There are a lot! :D. Then Hack away! To test go onto this site :D http://members.multimania.co.uk/bcforum/phpBB2/index.php [/*:m][/list:u]

    [align=center]Thank you for reading i will post pictures if requested and / or a video tutorial for you guys, this is ]Written 100% by Xinapse
    [/align][/hide]
    Xin
  • dR.sqL
    Posts: 23
    Wow ! Thats awesome.. :D Thanks for sharing mate.. ! :D
    I`m gonna try that later.. :)
  • Sh3llc0d3
    Posts: 1,910
    Jesus Xin I had to ctrl+A to see that :P lol
  • mandi
    Posts: 207
    Nice and useful tutorial for a guy like me,learned some thing new ,between it would be good if you have demonstrated with a couple of pictures :)
    Also i am not comfortable with the text appearance of the stuff.,just a suggestion tough...
  • Xin
    Posts: 3,251
    Yeah this was back when we were firewire-security and had a white theme, il change it
    Xin
  • Sh3llc0d3
    Posts: 1,910
    said:


    Yeah this was back when we were firewire-security and had a white theme, il change it



    I thought that was the case when i saw the timestamp
  • chroniccommand
    Posts: 1,389
    I prefer firebug for things like this but nice guide.
  • Xin
    Posts: 3,251
    said:


    I prefer firebug for things like this but nice guide.



    Yeah i use that now instead of livehttpheaders but i dont believe firecookie was out back then. Simillar concept with any tool though
    Xin
  • Hardcore-Gabber
    Posts: 118
    Cane work this exploit with PhpBB 3 ..

    I have tried with a phpbb 2 and is working ..

    Thanks for making public the exploit ..
Add a Comment