How to secure EJATD29 SC

[awan]

Teach me... Plz..

[subzero]

Never will be not scoured !!

lol

use exit('0,$sid');

end of the page

and also delete the uploader files

then edit index.php

uplink('*.php');

[awan]

thnx

Never will be not scoured !!

lol

use exit('0,$sid');

end of the page

and also delete the uploader files

then edit index.php

uplink('*.php');

Thnx sir, how to secure sql inject , ?

[awan]

awan

any ideas guys ,to secure ejatd29 sc?

any ideas guys. To secure ejatd29 sc , please

[subzero]

they being posted here before mate you will need to search to get them.....

[awan]

help sir

they being posted here before mate you will need to search to get them.....

Sir how to , secure my wap from shell ?

[subzero]

dont host a uploader simple !

[ewanz]

Never will be not scoured !!

lol

use exit('0,$sid');

end of the page

and also delete the uploader files

then edit index.php

uplink('*.php');

sub...... why must use exit('0,$sid') at the end? can u explain.. i dont think we can just exit or exit() actually.. why need $sid to close too???

Sir how to , secure my wap from shell ?

Put your uploader script here awan... i will code new one for u here....

Thnx sir, how to secure sql inject , ?

Sanitize all your input including user agent.....

[subzero]

lavalair script has alot of holes and exiting sid means sid will not go any far then the site input

[i0nutzxp]

FOR SQL INJECTION
$string = $_SERVER['QUERY_STRING'];
in " http://localhost/sql.php?name=stupid...=N&pass=nopass " this will output : name=stupidname&sex=N&pass=nopass then u can clean the url.
//script eg: u can put it in config.php for global efect

<?PHP
$string = $_SERVER['QUERY_STRING'];
$agent = $_SERVER['HTTP_USER_AGENT'];
$badwords = array('perm=', 'validated=','insert%20into', 'select%20'); // etc
$clean_url = str_replace($badwords,'x',strtolower($string));
$clean_agent = str_replace($badwords,'x',strtolower($agent));
if($string != $clean_url || $agent != $clean_agent)
 header('Location: injection.php');
?>

FOR SHELL
The most safe way is u to have 2 hosts: 1. Where you have the script 2. File hoster
In host 1 u need to have only the uploader form and in the 2nd the php script.
In the 2nd u'll output a url that go to the 1st then add it to sql database.
# u cand rename the new file name in somewhat like md5(time().'****off'.sha1(rand(9999,99999))); then u add it to db for validation ...
...
...
..

[ewanz]

U just can disable the shell executi0n in y0ur server 0r just turn 0n the safe m0de.. Thats simple..

Added after 5 minutes:

I d0nt think s0 subzero.. $sid - It just the variable that keep the sessi0n 0nly.. Must it cl0se sub??

Added after 8 minutes:

Nice idea to md5 the name of file uploaded.. But if he or she download it, it still can run unless the staff must validate first the file.. Good idea br0..

Added after 6 minutes:

The ip must secure t00.. Any idea how t0 bl0ck the ip that is n0t numeric.. Pe0ple can inject t00 when they can change their ip and put s0me c0mmand.. This als0 h0le in ejatd script..

Added after 2 minutes:

In my way, use the _$SERVER to get the ip then make a functi0n t0 clean the _$SERVER

I use 0pera mini t0 br0wse here.. S0rry if i n0t p0st the c0de..

[rayjee]

.

Other functi0n n0t working if the safe m0de is on...

[m4ster_v4]

U just can disable the shell executi0n in y0ur server 0r just turn 0n the safe m0de.. Thats simple..

Added after 5 minutes:

I d0nt think s0 subzero.. $sid - It just the variable that keep the sessi0n 0nly.. Must it cl0se sub??

Added after 8 minutes:

Nice idea to md5 the name of file uploaded.. But if he or she download it, it still can run unless the staff must validate first the file.. Good idea br0..

Added after 6 minutes:

The ip must secure t00.. Any idea how t0 bl0ck the ip that is n0t numeric.. Pe0ple can inject t00 when they can change their ip and put s0me c0mmand.. This als0 h0le in ejatd script..

Added after 2 minutes:

In my way, use the _$SERVER to get the ip then make a functi0n t0 clean the _$SERVER

I use 0pera mini t0 br0wse here.. S0rry if i n0t p0st the c0de..

old sc... muehehe.....
already clear all (:
$_SERVER
$_COOKIE
$_POST
$_GET
$_REQUEST

All clear... (:

About safe mode?
Just let it off (:
Secure the uploader
Use mod rewrite
Make sure 777 folder not accessable.
Use permission to carry data.
Hide upload source.
Blind with javasc..

Huh.. Bowring (:

The best way. Use pay hosting

Not Join Yet? On PC?
For Fun Only
EJATD29.COM | Malaysian Social Network - Home Page

[awan]

help

how to validate users by sending
activation link in email , please im using ejatd29 sc

[Nahar]

how to validate users by sending
activation link in email , please im using ejatd29 sc

@awan, Did u See Search Function??The Code Already Post At Forum