Anti-armenia.ORG - Forumlar - [PHP] Who visits my website By SkarY



Istifadəçi
    2013-01-29 19:58 GMT                 

SkarY



VIP
Mesaj Sayı : 19
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   0  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək : SkarY
Yaş : 31
Mesaj :

Mövzunu Paylaş!


HI!

On this occasion I bring a small script "Count", to see if anyone's worth, most of all to practice a bit of knowledge.


counter.php




Kod:
<title> Who visits my website [By SkarY]</title>
<?php
/*
   Who visit my website By SkarY
                                                                                        */
class count{
       
    var $con;
    var $tabla;
       
    function add(){
        #---Replace your details---
       $host = 'localhost';
        $user = 'root';
        $pwd = 'root';
        $db = 'test';
        $this -> tabla = 'counter';
        #-----------------------------
       $this -> con = mysql_connect($host,$user,$pwd) or die ("Connection failed!");
        $select_db = mysql_select_db($db,$this->con);
        $ip = $_SERVER['REMOTE_ADDR'];
        $pag = __FILE__;
        $ins = "INSERT INTO $this->tabla(ip,page) VALUES('$ip','$pag')";
        mysql_query($ins,$this -> con);
    }
   
    function show(){
        $mos = mysql_query("SELECT * FROM $this->tabla",$this -> con);
        $amount = mysql_num_rows($mos);
        if($amount !=0){
            echo $amount;
        }else{
            echo "1";
        }
       
    }
   
}
$counter = new count;
$counter -> add();
echo 'views: '; $counter -> show();
?>





counter.sql

Kod:
USE test; -- Change the name of your bd
CREATE TABLE counter( -- Table Name Change
ip varchar(12),
page text
);



Link Versión English: http://pastebin.com/m0DDYuxg
Link Versión Spanish: http://pastebin.com/r7rMgB7j

Hope you like.

Greetings!

Welcome to my world
Anti-armenia.ORG
    

Istifadəçi
    2013-01-29 21:39 GMT                 

Ferid23



Admin
Mesaj Sayı : 1875
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   45  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Anti-armenia.ORG
Ölkə :
Məslək : Programmer & Defacer
Yaş : 12
Mesaj :

Mövzunu Paylaş!


Nice Thank you

AZ Domaini İhbar Hattı (Azərbaycan saytlarında olan boşluqları bizə bildirin): http://anti-armenia.org/forums.php?m=posts&q=572
Qaydalar (Saytın qayda-qanunlarını oxuyaraq əməl edin)
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:03 GMT                 

BlackMinD



Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


Never ever use such coding style:

Kod:
$ip = $_SERVER['REMOTE_ADDR'];
        $pag = __FILE__;
        $ins = "INSERT INTO $this->tabla(ip,page) VALUES('$ip','$pag')";
        mysql_query($ins,$this -> con);


Do you know what it means? It means it vulnerable to BLIND SQL injection vulnerability.
More over your are using it on INSERT statement.It is awesome vulnerability also to create Denial Of service.
In this case: $ip = $_SERVER['REMOTE_ADDR']; variable is client side.
You can say WTF MAN how you can use your ip address as SQL injection payload?
Believe me this is possible and it is server side dependable thing.
For testing purposes upload your script to bytehost (in ex) then by manipuating
X-FORWARDED-FOR header variable inject your payload.
Thats all you'll see effect))

Fix is very simpleRule) sanitize user input properly:
$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);

Also it is bad idea too connect your web application to database as mysql root user!
Instead of create unprivileged user then grant it on database then use it.

Ana VƏTƏN!
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:11 GMT                 

SkarY



VIP
Mesaj Sayı : 19
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   0  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək : SkarY
Yaş : 31
Mesaj :

Mövzunu Paylaş!


BlackMinD
Do you know what it means? It means it vulnerable to BLIND SQL injection vulnerability.
More over your are using it on INSERT statement.It is awesome vulnerability also to create Denial Of service.
In this case: $ip = $_SERVER['REMOTE_ADDR']; variable is client side.
You can say WTF MAN how you can use your ip address as SQL injection payload?
Believe me this is possible and it is server side dependable thing.
For testing purposes upload your script to bytehost (in ex) then by manipuating
X-FORWARDED-FOR header variable inject your payload.
Thats all you'll see effect))

Fix is very simpleRule) sanitize user input properly:
$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);

Also it is bad idea too connect your web application to database as mysql root user!
Instead of create unprivileged user then grant it on database then use it.


Thanks for your opinion and / or help but publish the script as I try not to put it on a website.

# Skary

Welcome to my world
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:20 GMT                 

BlackMinD



Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


NP dude and YOU are welcome.
it is also bad idea to use root mysql account on your PC.
This is possible (in fact it is done multiple times by me) into outfile real *shell* to victims computer then access it via apache and troyanize/ or "rmdir" remote computer/server.
Always try to avoid usage of root accounts.(Use it only for administrative task)

Ana VƏTƏN!
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:23 GMT                 

SkarY



VIP
Mesaj Sayı : 19
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   0  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək : SkarY
Yaş : 31
Mesaj :

Mövzunu Paylaş!


Thanks and good I doubt I can contact you !

Welcome to my world
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:27 GMT                 

BlackMinD



Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


You are welcome bro) We are here 366 day of the year) If you get any problem/question etc... don't hesitate just pm we'll try to do all our best for you with great pleasure

Ana VƏTƏN!
Anti-armenia.ORG
    

Istifadəçi
    2013-01-30 02:33 GMT                 

SkarY



VIP
Mesaj Sayı : 19
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   0  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək : SkarY
Yaş : 31
Mesaj :

Mövzunu Paylaş!


Thanks and also any questions that I can help with. Programming and is something ovbeo something about Hacking, Cracking: D

And every day I'm Online forum ^-^

Welcome to my world
Anti-armenia.ORG