Hack me please

Discussion in 'PHP' started by HuggyCT2, Aug 3, 2007.

0
  1. #1
    I am developing my latest project and I have just finsihed the ACP login system, now this is pretty tight and I want some of the pro's here to have ago at by passing it to enter the actual control panel.

    Didnt make a link as I dont want spiders indexing it.

    clan-cms.co.uk/demo/admin/index.php

    If you do find a way in I will pay you $10, as long as you show me a screen shot of the actual ACP.

    Good luck :)
     
    HuggyCT2, Aug 3, 2007 IP
  2. stefanlyl

    stefanlyl Well-Known Member

    Messages:
    2,291
    Likes Received:
    50
    Best Answers:
    0
    Trophy Points:
    145
    #2
    this is very secure :)
     
    stefanlyl, Aug 3, 2007 IP
  3. HuggyCT2

    HuggyCT2 Guest

    Messages:
    222
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I would believe you Stefan but there are some reason I dont,

    1. You dont know even what PHP means.
    2. You dont know what XSS, or a SQL injection is
    3. Do you understand PHP sessions?
    4. Screenshot? And there is a secret message in there

    This is not me being rude btw everyone, its stefan being a arse lol.

    PS I do know stefan outside of these forums.

    Glen
     
    HuggyCT2, Aug 3, 2007 IP
  4. blueparukia

    blueparukia Well-Known Member

    Messages:
    1,564
    Likes Received:
    71
    Best Answers:
    7
    Trophy Points:
    160
    #4
    Well, it ried some basic SQL injection, and it didn't work.

    But that's all I know, so I can't go any further
     
    blueparukia, Aug 3, 2007 IP
  5. uniqueasitis

    uniqueasitis Peon

    Messages:
    661
    Likes Received:
    29
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Looks like you have taken care of everything including buffer overflow attacks. Why not limit the login attempts to three instead of five.
     
    uniqueasitis, Aug 3, 2007 IP
  6. BRUm

    BRUm Well-Known Member

    Messages:
    3,086
    Likes Received:
    61
    Best Answers:
    1
    Trophy Points:
    100
    #6
    Huggy, you may want to limit your cookies to your domain only. At the moment, a Type-Two XSS attack may be possible, either using the session_id cookie or other cookies granted upon successful login.

    This part:

    Additionally, you may want to take advantage of the $httponly parameter to prevent JS manipulation.

    All professional websites use this, such as DP ;)

    Also, what's your method of encryption?
     
    BRUm, Aug 3, 2007 IP
  7. HuggyCT2

    HuggyCT2 Guest

    Messages:
    222
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Thanks Brum,

    I will look into that, also I am md5 hashing the passwords.
     
    HuggyCT2, Aug 4, 2007 IP
  8. matty005

    matty005 Member

    Messages:
    37
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    43
    #8
    I also tried basic sql injections, but nothing worked.
     
    matty005, Aug 4, 2007 IP