For free time that I don’t have

Hello everybody , after a insufferable weak that I complain with , I’m here to post up the blog , I’ve recently been occupied by penetration test on some web applications , while these days I’ve frequently seen several bypasses for php and I just wondered , the vulnerabilities are advancing coming out faster than I thought they would Read more…

Bypassing, General, Hacking, PHP, Security Cpanel Bypass Safe mode [ extract tar.gz by Cpanel ], open_basedir, PHP 5.2.11/5.3.0 Multiple Vulnerabilities, PHP 5.2.12/5.3.1 symlink() open_basedir bypass, posix_mkfifo(), Safe mode bypass, symlink(), tempnam()

This publishing is around bonus stuff which I’ve considered ,MySQL injection , I had written a query :

/page.php?id=-1 union select table_name,2 from from information_schema.tables
where TABLE_SCHEMA='Sc0rpion'

As you see we used a single quote in query Read more…

Bypassing, General, Hacking, Mysql injection, PHP, Security bypass mysql_real_escape_string, Bypassing, escaping by mysql_real_escape_string(), Mysql injection, PHP, Securitybypass magic_quote

In the present paper there will be a speech about one of safety ways of the programming language PHP . in each web application you surely must care about any processing data obtained from the user and operating for their storage the database MySQL . Read more…

General, PHP, Programming, Security eregi, filtering the characters in php, get_magic_quotes_gpc(), mysql_real_escape_string, PHP security class, prevention of attacks in php, strip html tags in php, strip_tags(), validate the string in php

Today my words are linked to my previous publications around MySQL injection attack , I examine the structure of URL used to attack .  as known each database has exclusive language ( query ) and the developing coding language handling dynamic queries makes no difference … Read more…

Bypassing, Mysql injection, PHP, Security bypass magic_quote, bypass mysql_real_escape_string, escaping by mysql_real_escape_string(), information schema, information schema mysql, local database, magic_quote, Mysql injection, order by, TABLE_SCHEMA, union select, union select table_name, unsafe dynamic mysql query

As server has only http port opened ( 80 ) , anything useful can’t be returned by your most trusted vulnerability scanner , the most known method called Injection may be using Read more…

Hacking, Mysql injection, PHP, Security addslashes(), breaking quote, dynamic MySQL queries, mysql_injection, mysql_real_escape_string, scape from injection, single quote

Hey , I don’t have enough time for telling bullsh*t , then I’ll continue by summarizing . you may have been looking for a mutual algorithm to make a function forming encryption of password given but how much assurance you have got ? Read more…

PHP, Security Decryption, Encryption, Invertible function, Password hashing, Uncrackable

The 2th of Azar , Saturday , the meeting was held successfully . my excuse of traveling was the Elecomp exhibition but I went because of my friends , Shabgard’s users  and the other …. Read more…

General, Myself, Security Elecomp, Meeting, Shabgard meeting

Yes finally the Shabgard magazine was published Read more…

General, News, Security Magazine, Shabgard

Hi guys , let me complete the title : MySQL injection attack and comparison ways to protection PHP code against injection , each time somebody hears about Persian tutorial journal which is related to kind of Injection attacks such as MySQL , Mssql  and … Read more…

Hacking, Mysql injection, PHP, Security Blind SQL Injection, Injection, MySQL, Security, Vulnerable PHP code

Today I wanna speak about ” Remote File Inclusion” the most known hole ( maybe ) between hackers depending on configuration of php.ini , the ” Register_globals ” plays dangerous role here Read more…

Hacking, PHP, Programming, Security C99, Define, Include shell, patching RFI, register_globals, Remote file inclusion, RFI, webshell