- Apocalipsa dupa Nemessis
- Cand dorinta de afirmare depaseste granitele bunului simt – PaxNwo un leecher ordinar
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac?
- Experiment social II – andimoisescu.ro
- Pentru posteritate
- In curand…
- “Hot” de id-uri messenger
- Chiar ca sunteti retardati
- Ce nu se invata la scoala – Vendetta (6)
- Apocalipsa dupa Nemessis in (166 Visits)
- Ce servicii de mail folositi? in (87 Visits)
- This is the end in (85 Visits)
- Hackersblog.org is now blog.rstcenter.com in (58 Visits)
- Raportare vulnerabilitati in (58 Visits)
- News in (55 Visits)
- La multi ani România, la multi ani românilor in (55 Visits)
- Un nou membru in (54 Visits)
- De reţinut in (54 Visits)
- So... lol in (51 Visits)
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac? in (781 Visits)
- SMS scam (1) in (97 Visits)
- Hi5.com coders read this in (94 Visits)
- Dezinformare sau proasta informare? in (78 Visits)
- Si tentativele de phishing pot fi amuzante in (76 Visits)
- Phishing Bancpost in (74 Visits)
- Phishing Raiffeisen cu atasament html in (71 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (228 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (188 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (164 Visits)
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta in (162 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (154 Visits)
- Virusi in clipuri video [how to] in (148 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (130 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (127 Visits)
- Ca musca in... in (87 Visits)
- Internet vs. privacy (1) in (60 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (738 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (544 Visits)
- RedTube.com ... The Free Sex Video Community in (186 Visits)
- Yahoo! epic fail - permanent xss unleashed in (155 Visits)
- In atentia BitDefender.com, SQL Injection in (149 Visits)
- Telegraph.co.uk hacked, sql injection in (138 Visits)
- No comment - o2.co.uk (forum) in (136 Visits)
- Facebook hacked - sql injection in (131 Visits)
- eJobs.ro si peste 1.300.000 de conturi cu date personale in (130 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (124 Visits)
- Hacker Uses XSS and Google Street View Data to Determine Physical Location in (97 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (94 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (71 Visits)
- Digital Photocopiers Loaded With Secrets in (63 Visits)
- [Video] The History Of Hacking in (47 Visits)
- Christopher "moot" Poole: The case for anonymity online in (45 Visits)
- OWASP Phishing demo in (34 Visits)
- Owasp5005 Part1 - New zero-day browser exploits - ClickJacking in (33 Visits)
- Email Security - Why You Should Encrypt Your Email - Part One in (32 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (31 Visits)
- Se poate sparge parola de Yahoo? in (755 Visits)
- Forumul Andreei Balan spart in (309 Visits)
- phpBB.ro hacked in (291 Visits)
- Camera de supraveghere a universitatii Alexandru Ioan Cuza din Iasi in (153 Visits)
- Experiment social in (145 Visits)
- Experiment social II - andimoisescu.ro in (136 Visits)
- Doua cu Netbridge si una cu Hi5 in (115 Visits)
- Site-ul Inspectoratului General al Politiei Romane (igpr.ro) a fost spart in (110 Visits)
- Cand dorinta de afirmare depaseste granitele bunului simt - PaxNwo un leecher ordinar in (110 Visits)
- Ce nu se invata la scoala – Vendetta (6) in (107 Visits)
Posted on February 23rd, 2009
Lottery is the most popular game in the world.
It involves millions of players and money.
Of course this is one of the reasons that in UK, the national lottery webpage, www.national-lottery.co.uk, is one of the highest ranked.
An unsecured parameter allows access to the database.
Here are the available tables:
Who do you think is the first registered user in the users table? The almighty admin himself!
What can an admin account allow to do on a website? I give you the opportunity to answer this question.
RO Version:
Loteria este un joc popular peste tot in lume. Loteria atrage multi bani si multi jucatori. De aceea si in UK site-ul national-lottery.co.uk ocupa un loc de frunte in top trafic. Un parametru prost sanitizat permite acces la baza de date. Sa vedem tabelele disponibile:
Cine credeti ca este primul inregistrat in tabelul user ?. Insusi adminul !
Ce inseamna un cont de admin pentru un site? Raspundeti voi la aceasta intrebare !
February 23rd, 2009 at 4:12 pm
Vezi ca in Screenshotul 2 se vede query-ul sub address bar images/….
February 23rd, 2009 at 4:41 pm
Ce informatii gasesti in tabelele respective? Usr and pwd, sau ai gasit si ceva date mai confidentiale (CC, SSN – britt equivalent, adresa, phone# etc.)?
February 23rd, 2009 at 4:59 pm
vezi ca e “insusi” adminul
February 23rd, 2009 at 4:59 pm
Am o mica intrebare. In cam toate screenshot-urile voastre vad “tor disabled”. De ce nu-l folositi? E vreun motiv anume? Ce mijloace alternative folositi? Banuiesc ca folositi ceva proxy…..
February 23rd, 2009 at 5:05 pm
Tor la fel ca si AOL este folosit in cazul in care nu exista riscul de a se interesa cineva “capabil” de tine.
Deci da, folosim altceva.
February 23rd, 2009 at 5:12 pm
merci honey
February 23rd, 2009 at 6:07 pm
interesanta faza cu 4 injection– .gif… nu stiam ca pot fi si asa
February 23rd, 2009 at 6:18 pm
@2fingers: atata timp cat tii javascript, java si flash dezactivate nu prea are cum sa te gaseasca prin tor. Doar primul server din cele 3-4 stie cine esti, dar ala nu stie la cine te conectezi sau ce faci. Nu prea are cum sa te prinda
February 23rd, 2009 at 10:36 pm
Da Tudor dar preferam chestiile personale facute cu mana noastra. Plus ca se misca si mai rapid decat prin tor.
February 23rd, 2009 at 10:51 pm
In cazul asta asteptam pe viitor un articol despre cele mai bune moduri de a face ‘surfing’ anonim
) Si da….asta a fost un apropo 
ma intereseaza subiectul 
February 23rd, 2009 at 11:07 pm
Si pe mine ma intereseaza subiectul ‘anonymous surfing’. Ar fi foarte interesant sa publicati ceva despre asta.
February 24th, 2009 at 3:25 pm
tudor si pe sox te poate afla? chiar ar prinde bine un articol.
February 24th, 2009 at 8:29 pm
Un articol despre anononimitate ar fi foarte interesant. Poate chiar niste recomandari de VNC la preturi acceptabile care nu pastreaza loguri
February 24th, 2009 at 11:13 pm
@Asterixel: iti zic eu unul dar pretul nu e tocmai mic. Mai de mult foloseam Findnot. Are servere prin tot felul de tari ‘exotice’ din punct de vedere al legii, gen Panama…etc. Stiu din surse sigure ca e ok si niciodata nu s-a intamplat vreun incident. Doar ca si pretul e pe masura.
February 25th, 2009 at 4:27 pm
[...] La página de la lotería inglesa vulnerable a inyección SQL [Eng]www.hackersblog.org/2009/02/23/national-lotterycouk-sql-inje… por Rafa2 hace pocos segundos [...]
February 26th, 2009 at 11:53 am
[...] en National-lottery.co.uk sql injection, by [...]
February 27th, 2009 at 7:54 pm
They are denying this
http://news.softpedia.com/news/UK-National-Lottery-039-s-Operator-Denies-SQL-Injection-105457.shtml
February 28th, 2009 at 12:37 am
Lol. This is funny.