Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. Other Discussions
  3. The Weird and The Wonderful
  4. why o' why?

why o' why?

Scheduled Pinned Locked Moved The Weird and The Wonderful
question
25 Posts 16 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C Chris Maunder

    How? It's server side code being rendered to the client so there's no attack vector there.

    cheers, Chris Maunder

    CodeProject.com : C++ MVP

    P Offline
    P Offline
    Pete OHanlon
    wrote on last edited by
    #11

    Chris Maunder wrote:

    How? It's server side code being rendered to the client so there's no attack vector there.

    True - but you've now seen the name of tables, and it's obvious that Stored Procs aren't being used. As soon as you find an input form, the attack surface has been opened up.

    Deja View - the feeling that you've seen this post before.

    My blog | My articles

    S 1 Reply Last reply
    0
    • N ne0h

      Open this below link in Firefox and look at the top of the page! click[^]


      "hi, I am explorer.exe. sometimes when you are doing anything at all, I will just freeze for ten minutes. All of my brother and sister windows will also freeze, because they are sad for me. Maybe we will come back, maybe not, it will be a surprise!"

      M Offline
      M Offline
      merrykid
      wrote on last edited by
      #12

      yeah,Opera could see it but,why IE not?? :-D

      1 Reply Last reply
      0
      • N ne0h

        Open this below link in Firefox and look at the top of the page! click[^]


        "hi, I am explorer.exe. sometimes when you are doing anything at all, I will just freeze for ten minutes. All of my brother and sister windows will also freeze, because they are sad for me. Maybe we will come back, maybe not, it will be a surprise!"

        S Offline
        S Offline
        Simon Capewell
        wrote on last edited by
        #13

        Rather odd. Go to index.asp and it renders correctly. Someone hasn't set the default pages up correctly in IIS up properly.

        1 Reply Last reply
        0
        • P Pete OHanlon

          Chris Maunder wrote:

          How? It's server side code being rendered to the client so there's no attack vector there.

          True - but you've now seen the name of tables, and it's obvious that Stored Procs aren't being used. As soon as you find an input form, the attack surface has been opened up.

          Deja View - the feeling that you've seen this post before.

          My blog | My articles

          S Offline
          S Offline
          Simon Capewell
          wrote on last edited by
          #14

          Not as bad as one I discovered recently: Database connection strings stored in a publicly accessible txt file coupled with request strings being completely unvalidated before being appended to various SQL queries. Had a call from the client one day asking if it was us that created the 'slartibartfast' table. It turned out to be some bloke on the other side of the world having a bit of fun. Reminds me of my favourite XKCD[^].

          J 1 Reply Last reply
          0
          • S Simon Capewell

            Not as bad as one I discovered recently: Database connection strings stored in a publicly accessible txt file coupled with request strings being completely unvalidated before being appended to various SQL queries. Had a call from the client one day asking if it was us that created the 'slartibartfast' table. It turned out to be some bloke on the other side of the world having a bit of fun. Reminds me of my favourite XKCD[^].

            J Offline
            J Offline
            Jason Lepack LeppyR64
            wrote on last edited by
            #15

            The question is, did they know who Slartibartfast was?

            1 Reply Last reply
            0
            • P Pete OHanlon

              Sweet. SQL Injection attack anyone? :rolleyes:

              Deja View - the feeling that you've seen this post before.

              My blog | My articles

              V Offline
              V Offline
              Vasudevan Deepak Kumar
              wrote on last edited by
              #16

              Can people be so dumb? I would not be surprised if they put the FTP credentials of the website as a comment in the index.html under the pretext of ease of maintenance.

              Vasudevan Deepak Kumar Personal Homepage
              Tech Gossips
              A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson

              1 Reply Last reply
              0
              • N ne0h

                Open this below link in Firefox and look at the top of the page! click[^]


                "hi, I am explorer.exe. sometimes when you are doing anything at all, I will just freeze for ten minutes. All of my brother and sister windows will also freeze, because they are sad for me. Maybe we will come back, maybe not, it will be a surprise!"

                P Offline
                P Offline
                Paul Conrad
                wrote on last edited by
                #17

                Bad code behind, I guess...

                "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                D 1 Reply Last reply
                0
                • L leppie

                  its in the HTML. Someone should really learn how to comment HTML correctly.

                  xacc.ide - now with IronScheme support
                  IronScheme - 1.0 alpha 2 out now

                  P Offline
                  P Offline
                  Paul Conrad
                  wrote on last edited by
                  #18

                  leppie wrote:

                  Someone should really learn how to comment HTML correctly.

                  Yeah, it is not that hard :rolleyes:

                  "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                  1 Reply Last reply
                  0
                  • P Pete OHanlon

                    Sweet. SQL Injection attack anyone? :rolleyes:

                    Deja View - the feeling that you've seen this post before.

                    My blog | My articles

                    P Offline
                    P Offline
                    Paul Conrad
                    wrote on last edited by
                    #19

                    Pete O'Hanlon wrote:

                    SQL Injection attack anyone?

                    Totally. Think of any good ones? :rolleyes:

                    "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                    P 1 Reply Last reply
                    0
                    • B Brady Kelly

                      The real WTF is ADODB!

                      Pits fall into Chuck Norris.

                      P Offline
                      P Offline
                      Paul Conrad
                      wrote on last edited by
                      #20

                      Brady Kelly wrote:

                      real WTF is ADODB

                      Yep.

                      "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                      1 Reply Last reply
                      0
                      • C Chris Maunder

                        All you've got are table names (and for the movie table only) - you can't actually get access. It's dumb and stupid but not a humungous breach

                        cheers, Chris Maunder

                        CodeProject.com : C++ MVP

                        D Offline
                        D Offline
                        Draugnar
                        wrote on last edited by
                        #21

                        As has already been pointed out... We now know that they use inline SQL, so the first input page you come too makes it ripe to do the injection attack with a 'drop tables' in it.

                        1 Reply Last reply
                        0
                        • P Paul Conrad

                          Bad code behind, I guess...

                          "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                          D Offline
                          D Offline
                          Draugnar
                          wrote on last edited by
                          #22

                          It's inline server tags, not code behind. And, in fact, their other pages are in classic ASP, not ASP.NET (extension is .asp, not .aspx)

                          1 Reply Last reply
                          0
                          • P Pete OHanlon

                            Sweet. SQL Injection attack anyone? :rolleyes:

                            Deja View - the feeling that you've seen this post before.

                            My blog | My articles

                            D Offline
                            D Offline
                            Draugnar
                            wrote on last edited by
                            #23

                            Here's a URL for an intrepid deconstructionist to hack out. http://www.shringar.co.in/pressroom/newsdetails.asp?press_id={B5079EAA-06FA-4D6A-8E82-688BAE7E665E}[^]

                            1 Reply Last reply
                            0
                            • P Paul Conrad

                              Pete O'Hanlon wrote:

                              SQL Injection attack anyone?

                              Totally. Think of any good ones? :rolleyes:

                              "The clue train passed his station without stopping." - John Simmons / outlaw programmer

                              P Offline
                              P Offline
                              Pete OHanlon
                              wrote on last edited by
                              #24

                              Paul Conrad wrote:

                              Totally. Think of any good ones?

                              :laugh: It does sound a bit "Capture the flag"

                              Deja View - the feeling that you've seen this post before.

                              My blog | My articles

                              1 Reply Last reply
                              0
                              • N ne0h

                                Open this below link in Firefox and look at the top of the page! click[^]


                                "hi, I am explorer.exe. sometimes when you are doing anything at all, I will just freeze for ten minutes. All of my brother and sister windows will also freeze, because they are sad for me. Maybe we will come back, maybe not, it will be a surprise!"

                                M Offline
                                M Offline
                                Mabre of the Tadadas
                                wrote on last edited by
                                #25

                                This points out another coding horror/problem (whatever). It gets past IE 7. Sad but yes IE 7 lets it past while Opera and Firefox don't. The most we can hope is that IE 7 was made to ignore the problem. I seen a page where the title is in the body instead of the header so it is shown on the actual page.

                                1 Reply Last reply
                                0
                                Reply
                                • Reply as topic
                                Log in to reply
                                • Oldest to Newest
                                • Newest to Oldest
                                • Most Votes


                                • Login

                                • Don't have an account? Register

                                • Login or register to search.
                                • First post
                                  Last post
                                0
                                • Categories
                                • Recent
                                • Tags
                                • Popular
                                • World
                                • Users
                                • Groups