lavalair script holes

[amylee]

shell is simply php script written to get into ur server..

no it isnt stupid, shell script just gives a gui presentation of the server same way as a ftp client in a way

[ranzit2]

i said use ur head making some simple codes but it doesn't relate that i said it but i don't know more about c99shell..everybody here don't know c99shell at first..and we can search for its meaning in the web..but making simple codes uses head and it is not searchable everytime, that's why i say sometimes "use ur head"..Lol..

shell is simply php script written to get into ur server..

[killfrenzy]

Lol shell and session hijacking is just 2 ways out of many to hack lava ;-)

yap..add sql inject and csrf..lol...

[killfrenzy]

And what happen if I fix the uploadable file size limit maximum to 15 or 20 kb?

useless.lol c99 shell script only less than 1kb cn manipulate ur site..lol..html virus les than 1kb can manipulate too.lol

[Richie24]

heres the shell script

[ozziemale31]

make a htaccess page with the following in side it

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>

<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>

<Files images>
deny from all
</Files>

<Files *.php>
deny from all
</Files>

<Files *.php.*>
deny from all
</Files>

<Files *.php.php.*>
deny from all
</Files>


then place it in your share folders this will stop the php pages executing in those folders on your server

[kiLLeR-eyEd_14]

after saying use ur head! Now your saying you dont know more about it. lol.. Are you joking mr genius killer-eyed_?

i said use ur head making some simple codes but it doesn't relate that i said it but i don't know more about c99shell..everybody here don't know c99shell at first..and we can search for its meaning in the web..but making simple codes uses head and it is not searchable everytime, that's why i say sometimes "use ur head"..Lol..

[xcoderx]

Lol shell and session hijacking is just 2 ways out of many to hack lava ;-)

[anderson]

And what happen if I fix the uploadable file size limit maximum to 15 or 20 kb?

[anderson]

i can still hack a site even with naming a shell script like somefilename.sis
as long as its an executable extension the apache server will treat it as such and parse the php code this mostly happens on server built around the default cpanel setup with the old apache and mysql4 etc etc aka ****ty shared hosting

What will happen if I lock my directory from being used by others?

[tres]

after saying use ur head! Now your saying you dont know more about it. lol.. Are you joking mr genius killer-eyed_?

[kiLLeR-eyEd_14]

i can still hack a site even with naming a shell script like somefilename.sis
as long as its an executable extension the apache server will treat it as such and parse the php code this mostly happens on server built around the default cpanel setup with the old apache and mysql4 etc etc aka ****ty shared hosting

i don't know more about c99shell..Can we try to disable functions like shell_exec, escapeshellarg..etc

[amylee]

the php word is still there..just do a pregmatch of the word..like if(preg_match("/php/i",basename($file))) then invalid extension..Can also use htaccess trick..Just use some head..

i can still hack a site even with naming a shell script like somefilename.sis
as long as its an executable extension the apache server will treat it as such and parse the php code this mostly happens on server built around the default cpanel setup with the old apache and mysql4 etc etc aka ****ty shared hosting

[killfrenzy]

a lot of holes in lava a lot of work to secured....to prevent restrict all the possible holes.how? learn 1st to hacked before to secured ur site if you don't know how to execute it then how to protect ur self?lol.

[something else]

gum put a nice mod rewrite rule for files (.*).php.(.*) but i cant remember it lol but its in forum somewhere lol