- Apocalipsa dupa Nemessis
- Cand dorinta de afirmare depaseste granitele bunului simt – PaxNwo un leecher ordinar
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac?
- Experiment social II – andimoisescu.ro
- Pentru posteritate
- In curand…
- “Hot” de id-uri messenger
- Chiar ca sunteti retardati
- Ce nu se invata la scoala – Vendetta (6)
- Apocalipsa dupa Nemessis in (82 Visits)
- Ce servicii de mail folositi? in (28 Visits)
- This is the end in (23 Visits)
- Hackersblog.org is now blog.rstcenter.com in (17 Visits)
- Short news in (16 Visits)
- La multi ani România, la multi ani românilor in (16 Visits)
- Inca o pierdere de timp in (11 Visits)
- Azi este ziua userilor hackersblog.org in (11 Visits)
- Raportare vulnerabilitati in (9 Visits)
- Contact si vulns report in (7 Visits)
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac? in (229 Visits)
- Hi5.com coders read this in (28 Visits)
- SMS scam (1) in (21 Visits)
- Phishing Bancpost in (8 Visits)
- Dezinformare sau proasta informare? in (7 Visits)
- Phishing Raiffeisen cu atasament html in (5 Visits)
- Si tentativele de phishing pot fi amuzante in (5 Visits)
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta in (76 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (42 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (31 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (30 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (25 Visits)
- Virusi in clipuri video [how to] in (23 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (22 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (18 Visits)
- Yahoo! redirects - a big issue (with video) in (10 Visits)
- Ca musca in... in (9 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (124 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (74 Visits)
- Yahoo! epic fail - permanent xss unleashed in (71 Visits)
- Telegraph.co.uk hacked, sql injection in (53 Visits)
- RedTube.com ... The Free Sex Video Community in (43 Visits)
- Kaspersky Thailand hacked by TinKode in (38 Visits)
- Conquiztador Hacked Again in (33 Visits)
- Telegraph.co.uk hacked - when will they learn? in (31 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (28 Visits)
- In atentia BitDefender.com, SQL Injection in (26 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (26 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (22 Visits)
- Digital Photocopiers Loaded With Secrets in (15 Visits)
- Hacker Uses XSS and Google Street View Data to Determine Physical Location in (12 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (8 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (7 Visits)
- OWASP Phishing demo in (7 Visits)
- Owasp5005 Part1 - New zero-day browser exploits - ClickJacking in (6 Visits)
- Christopher "moot" Poole: The case for anonymity online in (6 Visits)
- Email Security - Why You Should Encrypt Your Email - Part One in (5 Visits)
- Se poate sparge parola de Yahoo? in (259 Visits)
- phpBB.ro hacked in (82 Visits)
- Cand dorinta de afirmare depaseste granitele bunului simt - PaxNwo un leecher ordinar in (47 Visits)
- Experiment social in (46 Visits)
- Oare cum e pana la urma? in (40 Visits)
- "Hot" de id-uri messenger in (39 Visits)
- Experiment social II - andimoisescu.ro in (37 Visits)
- Ce nu se invata la scoala – Vendetta (6) in (37 Visits)
- Concurs fara premii in (36 Visits)
- Forumul Andreei Balan spart in (33 Visits)
Posted on February 6th, 2009
Cu cateva zile in urma, cineva se intreba retoric intr-un comment, oare magazinele online din romania cum stau cu securitatea. Hai sa vedem. Voi incepe cu pcfun.ro. Nu e cel mai mare, dar e destul de maricel. In plus, cel putin dupa parerea mea personala, magazinele care vand IT ar trebui sa fie si mai securizate, mai perfecte la capitolul securitate decat cele care sa zicem vand floricele, sau carti postale. Mai ales cand, in si asa saracul online romanesc, e asa mare goana, batalia pe fiecare client.
Din primul print screen se vede ca functia load_file este activa, nici macar magic quotes nu este setat on. Cu usurinta se poate uploada shell.
Parolele adminilor sunt criptate
In schimb parolele userilor, cumparatorilor sunt lasate in text clar. Intentionat n-am concatanat in sintaxa cnp-ul sau adresa utilizatorilor. Din addons-ul firefox, HackBar se vede numarul celor inregistrati, aproape 50.000
Vom continua cu alte magazine online.
February 6th, 2009 at 10:56 am
Foloseai alt proxy sau de ce iti scrie “Tor Disabled”
February 6th, 2009 at 12:07 pm
ai uitat sa stergi si in title bar
February 6th, 2009 at 2:52 pm
Se pare ca magic quotes a fost scos din PHP6, cu motive bune si nu prea e recomandat in general. Pe pagina de doc de la php.net(http://www.php.net/magic_quotes) e un comment care da si solutia.
February 6th, 2009 at 6:05 pm
Sa ai magic_quotes on, din punctul meu de vedere, e o idee foarte proasta. Pe toate serverele pe care le administrez magic_quotes e dezactivat si escape-uiesc “manual” fiecare user-input care ar putea cauza probleme de securitate
February 6th, 2009 at 6:47 pm
Ce extensie de FF e aia ?
February 6th, 2009 at 7:00 pm
https://addons.mozilla.org/en-US/firefox/addon/3899
June 12th, 2009 at 5:34 pm
[...] PCfun la HackersBlog: [...]