Kauft das PHP-Sicherheitsbuch!

Dritte Auflage

Jetzt bestellen!

ISBN-13: 978-3898643696
€ 36,00

Links

XING
(Profil nur für Xing-Mitglieder sichtbar)
Rootserver, Colocation, Hosting
My amazon wishlist
VServer Hosting

Pages

Frontpage
About Christopher Kunz
Kontaktformular

Syndicate This Blog

Thursday, November 9. 2006

Amazing finds in HTML sourcecode


In the “information gathering” chapter of my book “PHP-Sicherheit” and my presentations on the same topic, I usually talk about how incredibly weird stuff can end up in the source code of rather big web sites. While checking a number of sites for a specific vulnerability, I ended up finding the following stuff. I modified it so there’s no real information leakage and am currently trying to reach the respective vendors.


<!--
<table class=“debug” width=“100%”><tr><td>
<a target=“_blank” href=“/sys/admin/”>- Zur Admin-Seite</a><br>
<a target=“_blank” href=“http://someothersite.de.de/gui/”>- Styleguide</a><br>
<a target=“_blank” href=“/sys/info.php”>- Phpinfo ()</a><br>
<br>
<a href=“http://validator.w3.org/check/referer”><img border=“0” src=“http://www.w3.org/Icons/valid-html401” alt=“Valid HTML 4.01!” title=“Valid HTML 4.01!” height=“31” width=“88”></a>
</td></tr></table>
-->


Another nice one:


<!--DB-Error in Zeile 1712: DB Error: syntax error: / Layouttyp3: - / SELECT layouttyp.datei,layouttyp.name FROM layouttyp INNER JOIN teaserplatz ON teaserplatz.layouttyp_id=layouttyp.id INNER JOIN teasertyp ON easerplatz.teasertyp_id=teasertyp.id INNER JOIN dokument ON teaserplatz.dokument_id=dokument.id WHERE teaserplatz.pos=5,’erbt_layout’ AND dokument.id=14528 AND teasertyp.name=’sonder’-->
<!--Fehler: Datei /export/www/CONTENT/soim-80/docs/cms/teasermanager/teasersnippets/ nicht gefunden<br>-->
And finally:
WARNING in file e:\Daten\enid\host\htdocs\media\layout\141.php on line 227: mysql_num_rows(): supplied argument is not a valid MySQL result resource
Although it might seem obvious, I cannot stress it enough: Remove debug code and possible PHP errors from your production sites!
Posted by Christopher Kunz at 09:52 | Comment (1) | Trackbacks (0)
Defined tags for this entry: , , , , , , ,
Related entries by tags:

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

One which I came across, and which I contacted the site owners about, was the display of SQL for a couple of seconds before the results of the query were displayed. Looked as if the page was forwarding to list the results. I cant verify that now as I think it’s been fixed and I didn’t have Firefox/LiveHttpHeaders at the time. While the second of your citations looks like forgetting to turn off the display of errors, this was more like an echo()... which suggests they weren’t unit testing!

It was a PHP site too!
#1 David Rodger on 2006-11-09 11:25 (Reply)

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA