advanced guest book 2.2
Alright, I am familiar with the sql injection that goes with advanced guest book. my question is, what if it has already been hacked/defaced by another? like say the administrator's page has been messed up so there is no logon there. could you go into the url and add something like:
admin.php?username=(sql injection) to make it work and be able to remove everything that was messed up?
how do those people manage to get rid of the log on and everything in admin.php?
sorry if these are really dumb questions, just trying to learn about it.
hungryhobo14 wrote: Alright, I am familiar with the sql injection that goes with advanced guest book. my question is, what if it has already been hacked/defaced by another? like say the administrator's page has been messed up so there is no logon there. could you go into the url and add something like:
admin.php?username=(sql injection) to make it work and be able to remove everything that was messed up?
Well, if that thing isn't working username=(sql), maybe the headers arent called 'username' and also, your questions are kinda dumb because I don't know what you are actually asking.
How the hell that site got messed and have you try the sql injection. And why do you want to remove what is messed up (maybe you want to hack it again). why why why…
sorry i didnt mean to be confusing.
The guestbook was hacked. and I want to try and undo what the other hacker did. but, if the hacker disabled or messed up the admin logon page, I was curious as how to get back to it. would doing an sql inject in the URL work like that?
Also, 2nd part.
How does a hacker actually go and cause that much damage to the guest book?
mr noob wrote: view the source to get the username and passwords "name" values, then make your own form using html and enter
' OR 1=1/*as the username without the `s, no password. and someone could completely mess with the guestbook by editing a comment and putting html in them :)
hope that helps
nah. I saw the site. Those bitches deleted everything.