00:00:00 :| 00:00:18 Sorry 00:01:09 http://pastebin.com/ZY6BxkwJ 00:02:13 21 hours left... 00:02:15 aside from the terrible indentation 00:02:24 I am not sure what you are asking 00:02:30 * AnonyOps has flashbacks 00:03:04 i want to do the same thing 00:03:17 Table each collumn 00:03:23 But from Mysql 00:03:27 Not csv 00:03:35 so... this opens a file, and reads out the content of it? 00:04:02 That does yes 00:04:10 But with the size the database will be 00:04:13 once the server goes live 00:04:19 csv would be 00:04:20 well 00:04:22 I hope you fix this... 00:04:23 inapropreate 00:04:55 htmlspecialchars($data[$c]); 00:04:56 lol 00:04:56 trust me 00:05:25 <--- php noob still 00:05:28 then what 00:05:29 :) 00:05:35 cuz, if you echo out raw data from a file 00:05:45 I could just upload some text file that has html in it... 00:05:49 mmmm I <3 raw data 00:05:49 and do something like this 00:06:02 the csv doesnt have html in it :/ 00:06:12 so thats nothing to worry about 00:06:41 incoming injection 00:06:51

Haxed

00:07:02 boom 00:07:06 done 00:07:09 lol 00:07:14 How would you put that in the csv file tho... 00:07:28 the user has no access to the cvs file 00:07:31 uh... you echo out the contents of a file, no? 00:07:32 Plus 00:07:33 ahhh 00:07:39 https://github.com/DrWhatNoName/EvoMap/tree/Experment 00:07:39 Okay, none-the-less though, probably a good idea. 00:07:43 read the current code 00:07:47 to do it anywyas 00:07:52 think about this... 00:07:57 accualy no 00:07:59 What if someone got axx to that panel 00:08:03 https://github.com/DrWhatNoName/EvoMap/tree/file-based 00:08:13 there no panel 00:08:43 file-based is the offical release for csv format 00:08:52 for people who cant sql 00:09:15 ehh 00:09:15 https://github.com/DrWhatNoName/EvoMap/tree/File_based 00:09:17 thats it 00:09:55 Is this up anywhere yet? 00:10:06 You should have someone here penntest it before making it live. 00:10:19 Ive pentested it ;) 00:10:22 Dont worry 00:10:28 ah mk. 00:10:47 plus 00:10:49 You said you were a php noob o.O 00:10:54 ye 00:11:00 still 00:11:08 im on the border 00:11:17 I was once a php noob too. Want to know what happened? 00:11:25 well, still am now, just not as nooby lol 00:11:29 you can butt fuicked 00:11:42 got* 00:12:08 This happened http://www.zone-h.org/mirror/id/15802852 00:12:33 And this happened http://pastebin.com/SEnq2ruJ 00:14:10 Yup 00:14:16 But 00:14:18 ATM 00:14:34 the only vuln there could be in sqli 00:14:40 and that will lead to nothing 00:14:55 just logins to a public service 00:15:00 *** BLTGeno has quit (Ping timeout) 00:15:05 and aload of stuff they wont under stand 00:15:15 no admin panel 00:15:18 Nothing to upload 00:15:25 I still agree with anonyops on the pentest part 00:15:30 Hey at least you got this! $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']); 00:15:32 \(o_O)/ 00:15:35 a) how you gonna pentest your own code and call that pentesting 00:15:44 b) thats pretty muhc it 00:16:02 yeah... when I made my second project I had someone penntest it for me. (Not related to anonyops) 00:16:11 lol 00:16:21 Found nothing, but it was still not a waste of time. 00:16:24 They did it for free too. 00:16:33 If anything it can usually highlight deficiencies in your code 00:16:45 the only thing that could have a sqli is the login 00:16:53 i took care of the lfi 00:17:32 I'm looking at that now actually lol 00:17:33 + its not even in alpha stages or recomanded working condistion 00:17:45 what ou looking at? 00:17:51 the anti-lfi or the login 00:17:57 https://github.com/DrWhatNoName/EvoMap/blob/Experment/login.php 00:18:22 lol 00:19:10 $_GET['accesscheck'] 00:19:11 ? 00:19:15 Sound sketchy lol 00:19:19 *sounds 00:19:29 How are you access checking? 00:20:00 https://github.com/DrWhatNoName/EvoMap/blob/File_based/include/Access.inc.php 00:20:07 00:21:06 index.php calls on access.inc.php 00:21:18 access.inc.php says yes user is loged in 00:21:19 or not 00:21:21 if not 00:21:27 access.inc.php sends user to login.php 00:21:58 login.php?accesscheck="page requested" 00:22:10 when user succesfuly logs in 00:22:20 login will send user to page previously denied 00:22:28 else index.php 00:22:35 what is the page that is allowed? 00:22:45 just register and login 00:22:46 ?accesscheck=*what* 00:22:55 accesscheck=file.php 00:23:02 you guys stay classy, see ya 00:23:08 later 00:23:10 *** zxcvbnm has quit (User quit: leaving) 00:23:13 Bai 00:24:21 *** joepie91 has quit (Ping timeout) 00:25:31 *** joepie91 (joepie91@cryto-A6766B2C.direct-adsl.nl) has joined #crytocc 00:25:58

Haxed

00:26:02 THATS COPYRIGHTED 00:26:02 :P 00:26:06 lel 00:26:10 also, the aborted-babies-background one is more fun 00:26:16 haha 00:26:25 I'm trying to break DrWhat's code 00:26:28 lol 00:26:53 :P 00:27:09 Bet you cant :) 00:27:20 its too basic to break 00:27:24 also, joepie91 what do you think of this? You have input the wrong username or password 00:27:51 whats wrong with it 00:28:07 You'll see when Joepie sees it... I got told the same thing by him :p 00:28:17 Oh 00:28:25 if he doesn't get it, I'll tell you lol 00:28:26 He already bitched at me for it being a popup 00:28:35 oh yeah that's nasty too 00:28:40 XD 00:28:43 Javascript popup? 00:28:44 also, joepie91 what do you think of this? You have input the wrong username or password 00:28:48 grrrrrrrrrrrrrrr 00:28:54 BAD BAD BAD 00:28:55 EVIl 00:28:55 BAD 00:28:58 LOL 00:28:59 TRASHCAN 00:28:59 Told you 00:29:00 hahaha 00:29:01 WHATS WRONF WITH IT 00:29:05 DrWhat: where to start 00:29:18 my chest if you want :) 00:29:19 00:30:09 really? really...? 00:30:12 yeah I fucked that up lol 00:30:20 lol 00:30:29 I just thought of it 00:30:51 You have input the wrong username or password 00:31:00 yes 00:31:06 lol 00:31:08 However, should use ID / class 00:31:09 Does it matter 00:31:14 It works 00:31:20 not style="" 00:31:28 just is better... 00:31:33 oh lawd 00:32:02 That's probably what Sony said too 00:32:05 Hurry up and break the code 00:32:06 XD 00:32:14 I'm not that good at it! 00:32:17 Does it matter 00:32:18 It works 00:32:20 I just know a little here and there 00:32:23 this is an absolutely terrible attitude 00:32:26 that you have to fix right away 00:32:31 or your code will forever suck 00:32:35 and break unpredictably 00:32:39 But its my attetude :( 00:32:42 And i like me :) 00:32:43 so, change it 00:32:46 If there was 2 of me 00:32:49 I would have sex with me 00:32:52 then there'd be twice as many breaking things 00:32:55 anyway 00:33:00 you should really fix that attitude 00:33:04 Im sure me would have sex with me too :) 00:33:04 DrWhat!! 00:33:07 you are one user, with one browser, on one OS 00:33:07 $loginFormAction = $_SERVER['PHP_SELF']; 00:33:07 if (isset($_GET['accesscheck'])) { 00:33:07 $_SESSION['PrevUrl'] = $_GET['accesscheck']; 00:33:07 } 00:33:12 AnonyOps 00:33:15 you're scrolling away my rant 00:33:15 lol 00:33:19 echo $loginFormAction; 00:33:19 you are one user, with one browser, on one OS 00:33:21 VULN 00:33:27 in one location 00:33:29 with one account 00:33:37 your experiences with how well your code work cannot possibly be representative 00:33:37 anonyops 00:33:38 for everyone 00:33:39 How is it vuln 00:33:44 DrWhat: reading what I am saying? 00:33:48 oh wait just kidding 00:33:49 Cant 00:33:53 anonyops wont shutup 00:33:56 :P 00:33:58 okay 00:33:58 let me start over 00:33:58 He shouting 00:34:00 VULN! 00:34:01 AnonyOps, quiet for a sec 00:34:03 mk 00:34:15 DrWhat: you are one user with one browser on one OS on one machine in one country with one account 00:34:25 how things work for you != representative for every possible combination of that 00:34:39 the point of following standards (or accepted practice) is that a lot of people have tested them before 00:34:44 and you can be reasonably sure that they work for most people 00:35:02 by using standards or commonly accepted practices, you effectively outsource part of your testing to the rest of the world 00:35:05 and get a better result 00:35:10 that is why you should be using CSS 00:35:13 and not font or center 00:35:28 people before you have run across problems with the things you are doing 00:35:31 they have learned from it 00:35:37 and changed their methods to reflect that 00:35:42 so why not learn from them and use those methods too? 00:35:57 instead of figuring out in 2 years that you're having the same problems that you could've avoided from the start by following advice straight away 00:36:51 your code is more reliably, you have less of a headache, more people get to enjoy what you use in a properly working fashion 00:36:55 and it saves you time 00:37:00 reliable * 00:37:09 yes 00:37:24 thats why i want to get it running off mysql as soon as 00:37:27 Beciase 00:37:37 [18-Feb-2013 23:21:13 UTC] PHP Fatal error: Maximum execution time of 30 seconds exceeded in C:\xampp\htdocs\map\index.php on line 117 00:37:40 That happned 00:37:41 XD 00:37:44 sure 00:37:48 but this includes using CSS 00:37:51 instead of and 00:38:01 I think [18-Feb-2013 23:21:13 UTC] PHP Fatal error: Maximum execution time of 30 seconds exceeded in C:\xampp\htdocs\map\index.php on line 117 is more serious 00:38:06 now I can explain to you in-depth why these tags are bad, but honestly that shouldn't be necessary 00:38:09 this information is easy to find 00:38:13 confirmed by many people to be the case 00:38:23 and it saves us both time if you follow the advice 00:38:31 Also, Drwhat, appears your code is pretty secure actually. I can't seem to find anything here, but It will be easier when it's actually live and I can mess with the input boxes, register, etc. 00:38:46 Thank you anonyops :) 00:38:59 it is live on my home server 00:39:05 But im not prepered to give out my ip 00:39:08 I checked all your echo's, and it looks good. 00:39:15 Heh, I understand :p 00:39:19 :) 00:39:24 Joepie has my home IP for that reason haha 00:39:33 So does mine 00:39:38 lol 00:41:50 http://services.runescape.com/m=news/congratulations-old-school-servers-will-be-back-asap 00:41:55 !!!!!! 00:41:57 W00t 00:43:11 you play runescape 00:43:14 ... 00:43:14 .... 00:43:15 ..... 00:43:17 ,..... 00:43:19 ....... 00:43:23 DrWhat: you play evony 00:43:29 be careful what you complain about 00:43:31 :P 00:43:32 Accualy i dont :( 00:43:35 :) 00:43:41 of course not 00:43:44 Nope 00:44:12 Damn 00:44:16 webs is still down 00:44:18 Actually, no I don't 00:44:20 Whos ddos them 00:44:21 >webs lol 00:44:24 Also, 00:44:35 I will play though, when the old school servers come back :) 00:44:37 haha 00:44:42 I hate RS how it is now. They ruined it. 00:45:17 Also, for your information, joepie and I are friends on runescape lol 00:46:44 dafuq O_O 00:47:03 i broke my code by putting a function in a diffrent file and including it 00:47:11 Parse error: syntax error, unexpected 'else' (T_ELSE) in C:\xampp\htdocs\mapsql\include\search.inc.php on line 31 00:47:17 How da fuck did that happen 00:48:41 Omg 00:48:48 my code is broken 00:48:56 on a part i never touched 00:49:45 lel 00:50:31 Now for some real talk 00:50:38 Please complete "Apply Your Knowledge" #2 (Precision Tools) on pg 237. Just complete steps 1 and 2 (the Context and diagram 0 DFDs). Be sure they are balanced! 00:50:43 lolwut 00:51:08 Oh also!!! 00:51:09 ... 00:51:13 @joepie 00:51:26 So, I found something good about taking classess on Web Dev 00:51:42 The amount of things you learn with HTML 5. 00:51:53 Parse error: syntax error, unexpected '1' (T_LNUMBER), expecting '(' in C:\xampp\htdocs\mapsql\include\search.inc.php on line 23 00:51:55 O_O 00:51:55 I never really use it, so I finally have a reason to learn it... 00:52:07 The form validation in HTML 5 is fucking epic 00:52:21 lol lol Drwhat 00:52:25 show me the file 00:52:27 I might be able to help 00:52:40 Looks like you missed a ( 00:52:48 Its ok i know whats wrong 00:53:07 to preper it to accept MySQL 00:53:09 probably something like... if(isset)); where it should be if(isset()); 00:53:14 i removed to file request 00:53:21 No 00:53:25 its just if 00:53:27 LOL 00:53:35 what? lol 00:53:43 You only had an if with no (? 00:53:56 well i removed all that part 00:54:04 lel 00:54:19 so i put 00:54:22 if 1=1 { 00:54:27 But then i got that error 00:54:41 so im going to do if isnumeric(1) 00:54:47 { 00:54:48 ooooh 00:54:50 I know whyh 00:54:53 if 1==1 00:54:58 Ahhh 00:55:00 Ofc 00:55:03 always use == inside an if 00:55:04 duhhh 00:55:11 although, why aren't you using if() 00:55:32 or are you doing shorthand? 00:55:33 yeah 00:55:37 I see 00:55:41 I never use that.. 00:55:49 *** smithsonian has quit (nexus.cryto.net arvel.cryto.net) 00:55:51 Also, you should do your ifs like this 00:56:02 Works now 00:56:04 if 1==1 00:56:05 { 00:56:06 } 00:56:11 not if 1==1 { 00:56:12 } 00:56:18 drives me nuts when people do that lol 00:56:24 I prefer if (1==1) { 00:56:29 } 00:56:30 D: why 00:56:38 looks nicer O_O 00:56:40 So much easier to read if you do 00:56:41 { 00:56:42 } 00:56:50 not for me 00:56:54 then it looks long 00:57:00 i read it like 00:57:01 lua 00:57:07 if 1 == 1 then 00:57:14 blah blah blah 00:57:43 or if 1 == 2 then 00:57:45 blah blah blah 00:58:04 *** smithsonian (vi.veri@veniversum.vivus.vici) has joined #crytocc 00:59:30 daisy has gone all queit on me now :( 01:00:19 I know why 01:00:21 LOL 01:00:25 so much neater https://pastee.org/jzu3k 01:00:32 You can also have that function if you want lol 01:00:33 the bitch has gona and built her own basic evomap 01:00:33 http://173.195.5.19/evomap.php?p=af87erw80fyq0th30bg 01:00:34 XD 01:01:40 Know what it does? 01:02:09 Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in Z:\xampp\htdocs\evomap.php on line 357 01:02:09 Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in Z:\xampp\htdocs\evomap.php on line 366 01:02:09 Click table headers to sort by column 01:02:12 LOLOLOLOLOLOLOLOL 01:02:25 Now hers is vuln 01:02:31 :P 01:02:31 nah 01:02:33 just a normal error 01:02:33 Yup 01:02:37 ehhh 01:02:45 Probably not vuln 01:02:47 So, I found something good about taking classess on Web Dev 01:02:47 The amount of things you learn with HTML 5. 01:02:48 ? 01:03:03 I don't ever use HTML 5, cuz it's not done... 01:03:15 This class forces me to use it, and I actually have learned a bit from it. 01:03:32 Like the form validations in HTML 5, they're epic. 01:03:57 Of course, you probably can't rely on those, and will still have to do it server-side too, but none-the-less, I like it! 01:05:14 *** smithsonian has quit (nexus.cryto.net arvel.cryto.net) 01:07:12 *** smithsonian (vi.veri@veniversum.vivus.vici) has joined #crytocc 01:14:09 AnonyOps: you could of course also have read on something like htmldoctor 01:14:09 :P 01:14:10 er 01:14:13 html5doctor 01:14:16 also, I'm surprised they teach html5 in a class.. 01:14:49 me too!! 01:14:55