Skip navigation.

Raphael's Blog

A look into a programmer's life

Posts tagged with "security"

PHPIDS bypass of the day

,

What to do when bored and reading the latest blog posts from The Spanner?
Once again I read about a PHPIDS bypass so I tried to find a way to bypass it too, so here it is:


you=this
,the=('a\
ler\
t'),you=you[the]
you('hello world \
by Raphael Geissert \
based on example by\
Gareth Heyes\
')
,/abc abc\
abc abc abc\
abc\
/,/abc abc\
abc abc abc\
abc\
/

two OpenXSS advisories on their way to the public knowledge

, ,

It is just a matter of time for the first two advisories to appear either at CVE's database or at BugTraq. I know I promised at least three of them, but I haven't found enough time to write the third one. There might be some others, it just depends on how much more time I want to spend/waste (depends on the POV) trying to understand wordpress' code, wiki-related code, and other similar code.

Read more...

"OpenID" (a.k.a. OpenXSS) implementations...

, , ,

I have just took a quick look at yet another OpenID-related php script which is, just like the others I've seen, open to XSS attacks.

Read more...

opendns: using Debian (bonus: old php5 package being used)

, , ,

After taking a look at some links I found out that OpenDNS is using Debian.

Read more...

VHCS2 SQL Injection vulnerability

,

Just found a SQL Injection vulnerability in VHCS2 2.4.7.1:

Read more...