Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

Setting up a vulnerable Guestbook

ghost

0 0

16 years ago

okay so im not good with php at all and i have this open source script i got so i can practice javascript injections and XSS. so, can someone look at this and show me how to make this vulnerable sorry…im just not good with php here is the index file

&lt;!-- This  is  a free tool provided by hioxidia.com --&gt;
&lt;!-- Please get in touch with us for using          --&gt;
&lt;!-- this product in a commercial site.             --&gt;

&lt;html&gt;
&lt;head&gt;
&lt;/head&gt;
&lt;?php

$file = &quot;gb.php&quot;;
$open = fopen($file, &quot;r&quot;);
$size = filesize($file);
$count = fread($open, $size);

include &#39;col.php&#39;;

include &#39;header.php&#39;;
?&gt;

&lt;script language=javascript&gt;

function checkMailId(mailids)
{
var arr = new Array(&#39;.com&#39;,&#39;.net&#39;,&#39;.org&#39;,&#39;.biz&#39;,&#39;.coop&#39;,&#39;.info&#39;,&#39;.museum&#39;,&#39;.name&#39;,&#39;.pro&#39;
,&#39;.edu&#39;,&#39;.gov&#39;,&#39;.int&#39;,&#39;.mil&#39;,&#39;.ac&#39;,&#39;.ad&#39;,&#39;.ae&#39;,&#39;.af&#39;,&#39;.ag&#39;,&#39;.ai&#39;,&#39;.al&#39;,
&#39;.am&#39;,&#39;.an&#39;,&#39;.ao&#39;,&#39;.aq&#39;,&#39;.ar&#39;,&#39;.as&#39;,&#39;.at&#39;,&#39;.au&#39;,&#39;.aw&#39;,&#39;.az&#39;,&#39;.ba&#39;,&#39;.bb&#39;,
&#39;.bd&#39;,&#39;.be&#39;,&#39;.bf&#39;,&#39;.bg&#39;,&#39;.bh&#39;,&#39;.bi&#39;,&#39;.bj&#39;,&#39;.bm&#39;,&#39;.bn&#39;,&#39;.bo&#39;,&#39;.br&#39;,&#39;.bs&#39;,
&#39;.bt&#39;,&#39;.bv&#39;,&#39;.bw&#39;,&#39;.by&#39;,&#39;.bz&#39;,&#39;.ca&#39;,&#39;.cc&#39;,&#39;.cd&#39;,&#39;.cf&#39;,&#39;.cg&#39;,&#39;.ch&#39;,&#39;.ci&#39;,
&#39;.ck&#39;,&#39;.cl&#39;,&#39;.cm&#39;,&#39;.cn&#39;,&#39;.co&#39;,&#39;.cr&#39;,&#39;.cu&#39;,&#39;.cv&#39;,&#39;.cx&#39;,&#39;.cy&#39;,&#39;.cz&#39;,&#39;.de&#39;,
&#39;.dj&#39;,&#39;.dk&#39;,&#39;.dm&#39;,&#39;.do&#39;,&#39;.dz&#39;,&#39;.ec&#39;,&#39;.ee&#39;,&#39;.eg&#39;,&#39;.eh&#39;,&#39;.er&#39;,&#39;.es&#39;,&#39;.et&#39;,
&#39;.fi&#39;,&#39;.fj&#39;,&#39;.fk&#39;,&#39;.fm&#39;,&#39;.fo&#39;,&#39;.fr&#39;,&#39;.ga&#39;,&#39;.gd&#39;,&#39;.ge&#39;,&#39;.gf&#39;,&#39;.gg&#39;,&#39;.gh&#39;,
&#39;.gi&#39;,&#39;.gl&#39;,&#39;.gm&#39;,&#39;.gn&#39;,&#39;.gp&#39;,&#39;.gq&#39;,&#39;.gr&#39;,&#39;.gs&#39;,&#39;.gt&#39;,&#39;.gu&#39;,&#39;.gv&#39;,&#39;.gy&#39;,
&#39;.hk&#39;,&#39;.hm&#39;,&#39;.hn&#39;,&#39;.hr&#39;,&#39;.ht&#39;,&#39;.hu&#39;,&#39;.id&#39;,&#39;.ie&#39;,&#39;.il&#39;,&#39;.im&#39;,&#39;.in&#39;,&#39;.io&#39;,
&#39;.iq&#39;,&#39;.ir&#39;,&#39;.is&#39;,&#39;.it&#39;,&#39;.je&#39;,&#39;.jm&#39;,&#39;.jo&#39;,&#39;.jp&#39;,&#39;.ke&#39;,&#39;.kg&#39;,&#39;.kh&#39;,&#39;.ki&#39;,
&#39;.km&#39;,&#39;.kn&#39;,&#39;.kp&#39;,&#39;.kr&#39;,&#39;.kw&#39;,&#39;.ky&#39;,&#39;.kz&#39;,&#39;.la&#39;,&#39;.lb&#39;,&#39;.lc&#39;,&#39;.li&#39;,&#39;.lk&#39;,
&#39;.lr&#39;,&#39;.ls&#39;,&#39;.lt&#39;,&#39;.lu&#39;,&#39;.lv&#39;,&#39;.ly&#39;,&#39;.ma&#39;,&#39;.mc&#39;,&#39;.md&#39;,&#39;.mg&#39;,&#39;.mh&#39;,&#39;.mk&#39;,
&#39;.ml&#39;,&#39;.mm&#39;,&#39;.mn&#39;,&#39;.mo&#39;,&#39;.mp&#39;,&#39;.mq&#39;,&#39;.mr&#39;,&#39;.ms&#39;,&#39;.mt&#39;,&#39;.mu&#39;,&#39;.mv&#39;,&#39;.mw&#39;,
&#39;.mx&#39;,&#39;.my&#39;,&#39;.mz&#39;,&#39;.na&#39;,&#39;.nc&#39;,&#39;.ne&#39;,&#39;.nf&#39;,&#39;.ng&#39;,&#39;.ni&#39;,&#39;.nl&#39;,&#39;.no&#39;,&#39;.np&#39;,
&#39;.nr&#39;,&#39;.nu&#39;,&#39;.nz&#39;,&#39;.om&#39;,&#39;.pa&#39;,&#39;.pe&#39;,&#39;.pf&#39;,&#39;.pg&#39;,&#39;.ph&#39;,&#39;.pk&#39;,&#39;.pl&#39;,&#39;.pm&#39;,
&#39;.pn&#39;,&#39;.pr&#39;,&#39;.ps&#39;,&#39;.pt&#39;,&#39;.pw&#39;,&#39;.py&#39;,&#39;.qa&#39;,&#39;.re&#39;,&#39;.ro&#39;,&#39;.rw&#39;,&#39;.ru&#39;,&#39;.sa&#39;,
&#39;.sb&#39;,&#39;.sc&#39;,&#39;.sd&#39;,&#39;.se&#39;,&#39;.sg&#39;,&#39;.sh&#39;,&#39;.si&#39;,&#39;.sj&#39;,&#39;.sk&#39;,&#39;.sl&#39;,&#39;.sm&#39;,&#39;.sn&#39;,
&#39;.so&#39;,&#39;.sr&#39;,&#39;.st&#39;,&#39;.sv&#39;,&#39;.sy&#39;,&#39;.sz&#39;,&#39;.tc&#39;,&#39;.td&#39;,&#39;.tf&#39;,&#39;.tg&#39;,&#39;.th&#39;,&#39;.tj&#39;,
&#39;.tk&#39;,&#39;.tm&#39;,&#39;.tn&#39;,&#39;.to&#39;,&#39;.tp&#39;,&#39;.tr&#39;,&#39;.tt&#39;,&#39;.tv&#39;,&#39;.tw&#39;,&#39;.tz&#39;,&#39;.ua&#39;,&#39;.ug&#39;,
&#39;.uk&#39;,&#39;.um&#39;,&#39;.us&#39;,&#39;.uy&#39;,&#39;.uz&#39;,&#39;.va&#39;,&#39;.vc&#39;,&#39;.ve&#39;,&#39;.vg&#39;,&#39;.vi&#39;,&#39;.vn&#39;,&#39;.vu&#39;,
&#39;.ws&#39;,&#39;.wf&#39;,&#39;.ye&#39;,&#39;.yt&#39;,&#39;.yu&#39;,&#39;.za&#39;,&#39;.zm&#39;,&#39;.zw&#39;);
var mai = mailids;
var val = true;

var dot = mai.lastIndexOf(&quot;.&quot;);
var ext = mai.substring(dot,mai.length);
var at = mai.indexOf(&quot;@&quot;);

if(dot &gt; 5 && at &gt;1){
for(var i=0; i&lt;arr.length; i++){
if(ext == arr[i]){val = true;break;}else{val = false;}}if(val == false){
alert(&quot;Your maild &quot;+mai+&quot; is not corrrrect&quot;);
return false;}}else{alert(&quot;Your maild &quot;+mai+&quot; is not correct&quot;);
return false;}return true;}

function check()
{
var tex = document.ssa.comment.value;
var len = tex.length;
var rem = 300-len;

if(len &gt;= 300)
{
	tex = tex.substring(0,300);
	document.ssa.comment.value =tex;
	return false;
}

if(rem&lt;0)
rem=0;

document.ssa.rem.value =rem;
}

&lt;/script&gt;

    &lt;table cellpadding=4 cellspacing=0 border=0 align=center&gt;
    &lt;tr&gt;&lt;td&gt;&lt;br&gt;Name *:&lt;/td&gt;&lt;td&gt;&lt;br&gt;
    &lt;form name=ssa action=&quot;added.php&quot; METHOD=&quot;POST&quot; onSubmit=&quot;return checkMailId(ssa.from.value)&quot;&gt;
    &lt;input type=&quot;text&quot; name=&quot;name&quot; size=20 maxlength=&quot;20&quot;&gt; [20]&lt;/td&gt;&lt;/tr&gt;
    &lt;tr&gt;&lt;td&gt;Email *:&lt;/td&gt;&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;from&quot; size=27 maxlength=&quot;50&quot;&gt; [50]&lt;/td&gt;&lt;/tr&gt;
    &lt;tr&gt;&lt;td&gt;WebSite:&lt;/td&gt;&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;webs&quot; size=27 maxlength=&quot;50&quot;&gt; [50]&lt;/td&gt;&lt;/tr&gt;
     &lt;tr&gt;&lt;td colspan=2&gt;&lt;br&gt;Please add your comments/suggestions *: [300]&lt;br&gt;
        &lt;textarea name=&quot;comment&quot; rows=11 cols=55 wrap=physical onkeyup=&quot;check()&quot;&gt;&lt;/textarea&gt;&lt;br&gt;
	  Words left - &lt;input type=&quot;text&quot; name=&quot;rem&quot; size=3 readonly value=300&gt; 
  &lt;/td&gt;&lt;/tr&gt;
    &lt;tr&gt;&lt;td colspan=2 align=right&gt;&lt;input type=&quot;submit&quot; value=&quot;   Add   &quot;&gt;&lt;/td&gt;&lt;/tr&gt;
    &lt;/form&gt;
  &lt;/table&gt;

&lt;br&gt;
&lt;/td&gt;
&lt;/tr&gt;

&lt;tr height=15% align=center&gt;&lt;td align=center background=&quot;images/bg2.gif&quot; style=&quot;font-size: 13px;&quot;&gt;
&lt;br&gt;
&lt;b&gt;&lt;a href=&quot;lookgb.php&quot;&gt;&lt;font color=blue&gt;Look in to My Guest Book&lt;/font&gt;&lt;/a&gt;&lt;/b&gt; || 
&lt;a href=&quot;admin.php&quot;&gt;&lt;font color=red&gt;Admin Login&lt;/font&gt;&lt;/a&gt;&lt;br&gt;
&lt;br&gt;
&lt;br&gt;
&lt;div align=right&gt;&lt;font style=&quot;font-size: 12px;&quot; &gt; © copyright 
&lt;a href=&quot;http://www.hscripts.com&quot; style=&quot;text-decoration: none; color: #dadada;&quot;&gt;hscripts.com&lt;/a&gt;&lt;/font&gt;&lt;/div&gt;

&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;

&lt;/body&gt;
&lt;/html&gt;```

many thanks

ghost

0 0

16 years ago

give the source of ALL the files, all the php files, etc.

ghost

0 0

16 years ago

col.pho


$bxcolor = &quot;#f5f7f6&quot;;
$bdcolor = &quot;0648c&quot;;
$fontcol = &quot;04400&quot;;
$oddmess = &quot;#f8f9fb&quot;;
$evenmess = &quot;#f8f9fc&quot;;
$html_enable = &quot;true&quot;;

?&gt;

&lt;!-- (c) copyright 2004, HIOX INDIA                 --&gt;
&lt;!-- This  is  a free tool provided by hioxidia.com --&gt;
&lt;!-- Please get in touch with us for using          --&gt;
&lt;!-- this product in a commercial site.             --&gt;```

ghost

0 0

16 years ago

header.php

&lt;!-- This  is  a free tool provided by hioxidia.com --&gt;
&lt;!-- Please get in touch with us for using          --&gt;
&lt;!-- this product in a commercial site.             --&gt;

&lt;body style=&quot;font-family: Arial,Verdana,san-serif;  margin: 0px;&quot; bgcolor=&quot;&lt;?php echo($bdcolor);?&gt;&quot;&gt;
&lt;table align=center width=80% height=100% cellpadding=0 cellspacing=0 border=1 bgcolor=&quot;&lt;?php echo($bxcolor);?&gt;&quot;&gt;
&lt;tr height=10% align=center&gt;
&lt;td height=80 align=center background=&quot;images/bg2.gif&quot;&gt;
&lt;br&gt;
&lt;font color=#223356&gt;&lt;b&gt;Welcome Guest&lt;/b&gt;&lt;/font&gt;&lt;br&gt;
&lt;br&gt;
&lt;/td&gt;
&lt;/tr&gt;

&lt;tr  height=70% align=center&gt;
&lt;td align=left valign=top style=&quot;font-size: 14px; border: dashed 0px;&quot;&gt;
&lt;br&gt;

&lt;style&gt;
a#tl{color: blue; text-decoration: none; font-size: 13px;}
a#tl:hover{color: aaaaff;}
&lt;/style&gt;

&lt;?php
if($block === false){
?&gt;
&lt;div align=center&gt;
&lt;a id=tl href=&quot;./admin.php&quot;&gt;Admin HOME&lt;/a&gt; ||
&lt;a id=tl href=&quot;filter.php&quot;&gt;Spam Filter&lt;/a&gt; ||
&lt;a id=tl href=&quot;ipblock.php&quot;&gt;IP Blocker&lt;/a&gt; ||
&lt;a id=tl href=&quot;url.php&quot;&gt;Properties&lt;/a&gt;     
&lt;a id=t1 href=&quot;logout.php&quot;&gt;Logout&lt;/a&gt;

&lt;/div&gt;
&lt;?php
}
?&gt;```

ghost

0 0

16 years ago

url.php

include &quot;authheader.php&quot;;

if($block == false){

include &#39;col.php&#39;;
include &#39;header.php&#39;;
echo &quot;&lt;br&gt;&lt;br&gt;&lt;br&gt;&quot;;
?&gt;

&lt;?php
  $iswrite = $_POST[&#39;what&#39;];

  if($iswrite == &quot;write&quot;)
  {
    $bx = $_POST[&#39;Box&#39;];
       
    $bd = $_POST[&#39;Body&#39;];
    $fc = $_POST[&#39;Font&#39;];
    $omc = $_POST[&#39;Odd&#39;];
    $emc = $_POST[&#39;Even&#39;];
    $htmle = $_POST[&#39;var&#39;];
    $file = fopen(&#39;col.php&#39;,w);
    
    fwrite($file,&quot;&lt;?php&#92;n&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;bxcolor = &#92;&quot;$bx&#92;&quot;;&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;bdcolor = &#92;&quot;$bd&#92;&quot;;&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;fontcol = &#92;&quot;$fc&#92;&quot;;&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;oddmess = &#92;&quot;$omc&#92;&quot;;&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;evenmess = &#92;&quot;$emc&#92;&quot;;&#92;n&quot;);
    fwrite($file,&quot;$&quot;.&quot;html_enable = &#92;&quot;$htmle&#92;&quot;;&#92;n&#92;n&quot;);
    fwrite($file,&quot;?&gt;&#92;n&#92;n&quot;);
    fwrite($file, &quot;&lt;!-- (c) copyright 2004, HIOX INDIA                 --&gt;&#92;n&quot;);
    fwrite($file, &quot;&lt;!-- This  is  a free tool provided by hioxidia.com --&gt;&#92;n&quot;);
    fwrite($file, &quot;&lt;!-- Please get in touch with us for using          --&gt;&#92;n&quot;);
    fwrite($file, &quot;&lt;!-- this product in a commercial site.             --&gt;&#92;n&quot;);

    fclose($file);
}

include &#39;col.php&#39;;
?&gt;


&lt;table bgcolor=dfdff0 align=center style=&quot;padding: 10px; border:2px red groove;
        font-family: arial, verdana, san-serif; font-size: 14px;&quot;&gt;

&lt;form name = col method = post action = &quot;url.php&quot;&gt;
&lt;tr&gt;&lt;td&gt;Box Color: &lt;/td&gt;&lt;td&gt; &lt;input type=&quot;text&quot;  name=&quot;Box&quot; value = &quot;&lt;?php echo&quot;$bxcolor&quot;; ?&gt;&quot; /&gt;&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td&gt;Body Color: &lt;/td&gt;&lt;td&gt; &lt;input type=&quot;text&quot; name=&quot;Body&quot; value = &quot;&lt;?php echo&quot;$bdcolor&quot;;?&gt;&quot;/&gt;&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td&gt;Font Color: &lt;/td&gt;&lt;td&gt; &lt;input type=&quot;text&quot;  name=&quot;Font&quot; value = &quot;&lt;?php echo&quot;$fontcol&quot;; ?&gt;&quot; /&gt;&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td&gt;Odd Msg Color: &lt;/td&gt;&lt;td&gt; &lt;input type=&quot;text&quot; name=&quot;Odd&quot; value = &quot;&lt;?php echo&quot;$oddmess&quot;; ?&gt;&quot; /&gt;&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td&gt;Even Msg Color: &lt;/td&gt;&lt;td&gt; &lt;input type=&quot;text&quot; name=&quot;Even&quot; value = &quot;&lt;?php echo&quot;$evenmess&quot;;  ?&gt;&quot;/&gt;&lt;/td&gt;&lt;/tr&gt;

&lt;tr&gt;&lt;td&gt;HTML Tags: &lt;/td&gt;&lt;td&gt; 
&lt;select name=&quot;var&quot;&gt;
&lt;option&gt;Please select&lt;/option&gt;
&lt;?php
 if ($html_enable == &quot;true&quot;)
 {
    echo &quot;&lt;option value=true selected&gt;Enable&lt;/option&gt;
    &lt;option value=false&gt;Disable&lt;/option&gt;&quot;;
 }else {
    echo &quot;&lt;option value=true&gt;Enable&lt;/option&gt;
    &lt;option value=false selected&gt;Disable&lt;/option&gt;&quot;;
 }
?&gt;
&lt;/select&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;tr&gt;&lt;td colspan=2 align=right&gt;
&lt;input type=hidden value=&quot;write&quot; name=what&gt;
&lt;input type=&#39;submit&#39; value=&quot;change&quot;&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;td colspan=2&gt;Note:Change may cause  effect in proprerties&lt;/td&gt;
&lt;/form&gt;
&lt;/table&gt;


&lt;/body&gt;
&lt;/html&gt;

&lt;?php
}
?&gt;

&lt;!-- (c) copyright 2004, HIOX INDIA 		    --&gt;
&lt;!-- This  is  a free tool provided by hscripts.com --&gt;
&lt;!-- Please get in touch with us for using          --&gt;
&lt;!-- this product in a commercial site.             --&gt;```

ghost

0 0

16 years ago

filter.php

include &quot;authheader.php&quot;;

if($block == false){

include &#39;col.php&#39;;
include &#39;header.php&#39;;

echo &quot;&lt;br&gt;&lt;br&gt;&lt;br&gt;&quot;;

$iswrite = $_POST[&#39;what&#39;];
if($iswrite == &quot;write&quot;)
{
    echo &quot;&lt;div align=center style=&#39;color: green;&#39;&gt;&lt;b&gt;filters have been updated&lt;/div&gt;&quot;;    
    $str = $_POST[&#39;filters&#39;];
    $file = fopen(&#39;fil.php&#39;,w);
    $ara = explode(&quot;&#92;n&quot;,$str);
    fwrite($file, &quot;&lt;?php &#92;n&#92;n&quot;);
    for($yy=0; $yy&lt;count($ara);$yy++)
    {
	$xxa = $ara[$yy];
	$xxa = trim($xxa);
           if($xxa != &quot;&quot;)
	    fwrite($file, &quot;$&quot;.&quot;asi[$yy] = &#92;&quot;$xxa&#92;&quot;;&quot;);
    }
    
    fwrite($file, $ara[$yy]);
    fwrite($file, &quot;&#92;n?&gt;&quot;);
    fclose($file);
}

include &quot;fil.php&quot;;
?&gt;

&lt;table bgcolor=dfdff0 align=center style=&quot;padding: 10px; border:2px red groove;
        font-family: arial, verdana, san-serif; font-size: 14px;&quot;&gt;
&lt;form name=fil method=post action=&quot;&lt;?php echo &quot;$PHP_SELF&quot;; ?&gt;&quot;&gt;
&lt;tr&gt;&lt;td&gt;&lt;/td&gt;&lt;td&gt;Add/Edit Filters .....&lt;br&gt;
 &lt;textarea name=filters rows=15 cols=50&gt;&lt;?php
  for($xx=0; $xx&lt;count($asi); $xx++)
  {
    $word = $asi[$xx];
    echo &quot;$word &#92;n&quot;; 
  }
 ?&gt;
 &lt;/textarea&gt;
&lt;/td&gt;&lt;/tr&gt;

&lt;tr&gt;&lt;td colspan=2 align=right&gt;
&lt;input type=hidden value=write name=what&gt;
&lt;input type=&#39;submit&#39; value=&quot;create&quot;&gt; &lt;/td&gt;&lt;/tr&gt;
&lt;td colspan=2&gt;Note: You wont get the messages Containig these Words &lt;/td&gt;
&lt;/form&gt;
&lt;/table&gt;
&lt;/body&gt;
&lt;/html&gt;

&lt;?php
}
?&gt;

&lt;!-- (c) copyright 2004, HIOX INDIA 		    --&gt;
&lt;!-- This  is  a free tool provided by hscripts.com --&gt;
&lt;!-- Please get in touch with us for using          --&gt;
&lt;!-- this product in a commercial site.             --&gt;```

ghost

0 0

16 years ago

I dont see any type of filtering there, although i only looked over it once. And that is by far 10x more complicated that you need, if all you want to do is a little xss practice.

ill code you a basic php guestbook if you want. will only take me a few minutes.

ghost

0 0

16 years ago

Instead of taking a prepared PHP guestbook, the best way to make a vulnerable guestbook is to write one yourself. Just make a simple form and have it echo the fields to the original page. It may not be pretty, but it will work for what you want. Continue to build / expand it as you learn more about PHP. Just as with any language, the best way to learn it is to start from the ground up.

ghost

0 0

16 years ago

cool….digitalfire if you wanna make it you can if not i will try my hand at it. but thanks for the replays

Setting up a vulnerable Guestbook

Uh oh. Looks like your using an ad blocker.