1 . split() or explode()

I start within split() and explode() functions , my blog followers are agreed to my sentence that I’ve either briefly or fully explained these functions by source example before , so I add addition notes today .
If you’ll be in selection between functions mentioned , which one do you prefer ?
My recommendation is avoiding to use split() ,
As php.net say , split() function has been deprecated as of PHP 5.3.0 , and I liked it since split() is sensitive to regular expression which I’m not really comfortable with !
another reason to have the explode() is that you encounter a problem with the split() when splitting the large string .
for instance to better concept of large word :

1
2
3
4
5

<?php
$var = "One. Two.";
echo '<pre>' , var_dump( split (".", $var) );
echo '<br>' , var_dump( explode (".", $var) );
?>

I refer to see this link or this link for extra details .

2 . preg_replace() or ereg_replace()

The ereg_replace() has also been deprecated as of PHP 5.3.0 .
It has been a long since I started php programming , I’ve often preg_replace() function which is kind of PCRE functions .
ereg_replace() is not compatible with latest versions of php , change your way to preg_replace() instead of it .
a simple code example I’ve taken from google :

?>

1
2
3
4
5
6
7

<?php
  function sanitize_string($string) {
        $string = ereg_replace(' +', ' ', trim($string));
 
        return preg_replace("/[<>]/", '_', $string);
  }
?>

1
2
3
4
5
6
7

<?php
  function sanitize_string($string) {
        $string = preg_replace('{ +}', ' ', trim($string));
 
        return preg_replace("/[<>]/", '_', $string);
  }
?>

In next update I’ll write about bot-net php system I’ve written few months ago , I hope find it useful :]

It’s long time my blog hasn’t been updated so I’ve fairly expected decreasing my blog views , such a dead place , but still I have my visitors and their comments which I never imagined .

Because of few server problems , I changed my server yesterday and during this movement the site had been down , I feel to tell the reason of this unavailability . I restored the buck ups , but it comes natural if some links are inaccessible and I’m gonna fix them all in coming three days .

I leaned valuable techniques in web designing and and accepted two projects … also I designed my own personal website which is visible within link below :

http://y-shahinzadeh.ir

Here I would appreciate Mohsen for his fantasy photography which shines there , about designing , it took a day to be completely made . about my status , I’d been out of internet access in six months ago while now I’m trying to establish it in my home , and it helps me update here faster as I can

shahinzadeh [at] cert.sharif.edu

And I’ll have my own visit card as soon as possible .
It was for my status , and what’s new ? I’ve newly reached the important notes in php , as you know in a simple sentence , php doesn’t support multithreading however it can be just simulated within complicated ways and sort of codes . since the I’ve confidentiality signed the non-disclosure agreement paper , I can’t say the reason made me fall into this research ( it has definitely been linked to my job ) but like always the most useful function helped me , curl() .
I’m not sure but maybe I put few part of my results here . I’m keep trying to update here faster , till summer that I’ve a lot of free time !

1
2
3
4
5
6
7
8
9
10

<?php
$fp = fopen('passwd.txt','r');
$fr = fread( $fp , filesize( 'passwd.txt' ) );
preg_match_all('/(.+?):x:(.+?)/',$fr,$explode);
print_r($explode);
$fp2 = fopen('data.txt','w+');
$fw2 = fwrite($fp2,$content);
fclose($fp);
fclose($fp2);
?>

Which is exactly doing all what my damn 53 lined php code does by neither more extensively nor less so !
That time I didn’t identify preg_match_all() function as well as I do now , however it doesn’t matter at all !
If you had a new idea leave comment and if not … be safe !

# Fixed a safe_mode bypass in tempnam()
# Fixed a open_basedir bypass in posix_mkfifo()

By the way the php’s quote ,

All users of PHP 5.2 are encouraged to upgrade to this release

However the story didn’t end here , we would see a new bypass in latest version , PHP 5.2.12/5.3.1 symlink() open_basedir bypass !
Meanwhile , two days ago , new bug has been found in cPanel which allows somebody to bypass the safe mode or any impermissible file .
Allocated link due this security hole :

http://securityreason.com/exploitalert/7740

If you take a look , you realize that it’s such a cryptic text ( because of his bad English and explanation ( his speech ain’t specifically clear ) .
Considering to the article at securityreason.com at beginning these two commands have to be executed :

ln -s /etc/passwd t.xt
tar -zcf red.tar.gz t.txt

Note that it doesn’t make any difference that where has the command been executed , we need to that gz file containing the t.txt which linked to the file we aimed to read , at this case passwd file .
During this article the passwd file is supposed to be an inaccessible by any owner in shell script , so after creating the file mentioned above , we have to gain the cPanel password of the any user located on the server . I ain’t gonna throw this subject and assume that the access is granted !
All have to be done is just logging into cPanel by the valid credential you’ve gotten , uploading the red.tar.gz and extracting it by cPanel , when you open the t.txt you will see the passwd file loaded there !
I recorded tutorial clip for the better concept , loading here , I hope you find it useful , be safe !

/page.php?id=-1 union select table_name,2 from from information_schema.tables
where TABLE_SCHEMA='Sc0rpion'

As you see we used a single quote in query , in some cases , when either the magic_quote is on , or the programmer has secured the dynamic query by mysql_real_escape_string() function , you will see the prevention of executing your injection query .
I will preface two techniques that could be used in various queries of injection , they can’t be named security holes , just obfuscation ! ( for instance remember how the mod_security module is bypassed by variant tricks ) .

1 . ASCII equivalent to bypass

I accidentally faced a similar situation last night and it was main reason made me post up here , all has to be done is substituting the string by equivalent decimal ASCII value , for example in link above , the ‘Sc0rpion’ should exactly be converted , my online string converter :

http://sc0rpion.ir/converter.php

The hex values must be understood in an URL yielded , our new query would be like example below and there won’t any resistance from neither mysql_real_escape_string() function nor magic_quote ,

/page.php?id=-1 union select table_name,2 from from information_schema.tables
where TABLE_SCHEMA=char(83,99,48,114,112,105,111,110)

Query is executed without any disturbance , the tables lists will be appeared in front of your face . ( by using group_concat() function )

1 . HEX equivalent to bypass

There is another bypass method to load any file by load_file() function , if the magic_quote supposed to be enabled you will see the following query returns the fail of injection :

/page.php?id=-1 union select 1,load_file('etc/passwd')--

Since we used single quote , for conducting this attack to the success , the file which has specifically been chosen to be loaded , must be converted into hex format :

load_file(0xHEX);

As you see the is instruction which has to be observed ( 0x prefix before the hex code ) . for converting the string you can do it by script I accented already , http://sc0rpion.ir/converter.php , or easily by MySQL command line :

SELECT CONCAT(HEX('c:\\boot.ini'));

Our manufactured hex code is ready :

'etc/passwd' = 0x6574632f706173737764

So , we would change our query :

/page.php?id=-1 union select 1,load_file(0x6574632f706173737764)--

And the file will be loaded . I hope you enjoy this article , Yashar .

http://sc0rpion.ir/images/sh/1.jpg
http://sc0rpion.ir/images/sh/2.jpg
http://sc0rpion.ir/images/sh/3.jpg
http://sc0rpion.ir/images/sh/4.jpg

And few lines about myself , my life divided into two parts , internet life and studying life , I have access to the internet by me own computer nearly 2 days in week , although it is not gonna be continue in future I think I’ve to endure this situation around three months or lesser . the comfortability of my internet connection isn’t like before in another word I should pay a lot of money for a little online working in places such as coffee net and I wish if all things end here . this is another problem in my life and you will face of my miss activity in this blog , however , I’ll spend my time as well as I can , Yashar .

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

/*
| -------------------------------------------------------------------
| Ward Class , Consists Of Four Functions
| Coded by Sc0rpion <> http://www.sc0rpion.ir
| |
| |
| + -> filtering() 
| + -> valid_str()
| + -> clear_str()
| + -> scape()
| -------------------------------------------------------------------
*/
 
class ward
{
        var $input;
        function filtering ( $str )
        {
        $this -> input = $str;
        if (
        strstr ( strtolower ( $this -> input ) , ';' ) != ''
        or strstr ( strtolower ( $this -> input ) , "'" ) != ''
        or strstr ( strtolower ($this -> input ) , "*" ) != ''
        or strstr ( strtolower ( $this -> input ) , "/" ) != ''
        or strstr ( strtolower ( $this -> input ) , "*" ) != ''
        or strstr ( strtolower ( $this -> input ) , "union" ) != ''
        or strstr ( strtolower ( $this -> input ) , "order" ) != ''
        or strstr ( strtolower ( $this -> input ) , "+" ) != ''
        or strstr ( strtolower ( $this -> input ) , "http" ) != ''
        or strstr ( strtolower ( $this -> input ) , "ftp" ) != ''
        or strstr ( strtolower ( $this -> input ) , "`" ) != ''
        or strstr ( strtolower ( $this -> input ) , "-" ) != ''
        or strstr ( strtolower ( $this -> input ) , ")" ) != ''
        or strstr ( strtolower ( $this -> input ) , "(" ) != ''
        or strstr ( strtolower ( $this -> input ) , ".." ) != ''
        or strstr ( strtolower ( $this -> input ) , "concat" ) != ''
        )
                {
                        return TRUE;
                }
        }
 
/*
| -------------------------------------------------------------------
| Checking The Validation Of String ( URL )
| -------------------------------------------------------------------
*/
 
        function valid_str ( $this -> input )
        {
        $this -> input = $str;
        if ( eregi ( "^[0-9a-zA-Z_-]*$" , $this -> input ) ) return TRUE; else return FALSE;
        }
/*
| -------------------------------------------------------------------
| Clean Special Chars And Code Tags From The String
| -------------------------------------------------------------------
*/
 
        function clear_str ( $str )
        {
        $this -> input = $str;
        $str = strip_tags( $this -> input ); // Cleaning HTML
        $str = eregi_replace( "[<>/\?&`~@#\$%\^*;']" , "" , $this -> input ); // Cleaning
        if( !get_magic_quotes_gpc() ) $str = mysql_real_escape_string( $this -> input );
        return $str;
        }
 
/*
| -------------------------------------------------------------------
| Scaping Special Characters
| -------------------------------------------------------------------
*/
 
        function scape( $str )
        {
        $this -> input = $str;
        if( !get_magic_quotes_gpc() ) $this -> input = mysql_real_escape_string( $this -> input );
        return $this -> input;
        }
 
}
 
/*
| -------------------------------------------------------------------
| End Of Ward Class
| -------------------------------------------------------------------
*/

I point out to each function quickly and brief explanation to each of them .
filtering() function : eliminates the sensitive expressions that I defined , they can simply be added , deleted or modified and the structure is very simple :

1

 or strstr ( strtolower ( $this -> input ) , " your char " ) != ''

As determining the specific character defined in function it returns true . simple example of usage :

1
2

$ward = new ward();
if ( $ward -> filtering( $input ) ) die(' you are a good hacker ');

valid_str() function : it checks whether if the input string has an unnecessary characters or not , returns true as if it is :

1
2
3
4

$ward = new ward();
if ( $ward -> valid_str( $input ) ) {
die(' your username must only be chosen between letters or numbers ');
}

clear_str() function : this function has a little difference from two previous functions , and it belongs to amount returning from this function . it returns the input string but not completely just washes all the dangerous characters such as HTML tags , some defined keywords and special characters in a string for use in a SQL statement , in the simple word it mostly provide the safe string and it can be trusted . just try it to get better concept of that :

1
2
3

$ward = new ward();
$input = "<br> hu I'm a string ' ' ' <a href='bb'>link</a>";
echo $ward -> clear_str( $input );

scape() function : I think I can leave it without any extra comment .

Here was my ward class which I wrote before , you can edit and use it on your road . another future of using this class is saving your maintainability and little performance but a major safety . I hope find it useful , Yashar .