Comment On Admin=False

Dude, you need to blur more of the address. All you have to do is Google the visible part of the URL to get the rest.

Fixed. Thanks Barry/

Actually its quite easy to change hidden form fields if you have something like Document Examiner for IE which lets you change any page property on the fly. ( http://www.hairy-spider.com/blog/permalink.aspx?guid=9a1054a1-1db1-4ed6-8cca-b218832bb4a2 )

Or Firefox's Web Developer toolbar which converts POSTs to GETs

Jim - that's the point. ("WHOOSH")

I don't get it, did he change display=events to display=passwords%20and%20credit%20card%20numbers?

I ran across something similar on a magazine's web site. The subscription link ended in "/sub/dv?wp=wppaid". You'll never guess how I got a free subscription...

"While I doubt you fellows would be able to hack that,..."

Nice way to insult your readership :rolleyes:

Nice way to miss sarcasm.

File->Save As, Open Saved File, Change Variables, Post

:lol:
great example

it could be eg:

www.umaine.edu/call/calendar/calendar.pl

www.umwestern.edu/calendar/ calendar.pl?config=calendar.cfg

google

Funny = true;

<< "While I doubt you fellows would be able to hack that,..."

Nice way to insult your readership :rolleyes:>>

Well, this is a site predominantly for Microsoft / VB / C# programmers, so....

search for inurl:admin=false, and you'll find this is not an unpopular construct.

Good job obfuscating the image r_AdminEqFalse2.gif. Hey, if there's a
two, maybe there's another image with a one? Or possibly no number?
Wow, what do you know! The real WTF here, though, is this post editor. What a piece of crap!



PS. You can try PNG. It won't bite.

Speaking of obfustication, just change the form variable to nqzva, and
look for values of either snyfr or gehr. There, problem solved.



--ls

"The system was quickly secured by making “admin“ a hidden form variable."

... Except it's still open to the same abuse. :p

There is a Greasemonkey script to convert all hidden form fields into text fields... so you must assume that ANY HIDDEN FORM FIELD CAN BE CHANGED AT WILL.  The end lesson of this is to never use form fields.

The same applies to cookies... they can be changed.  Do not use them for data the user is not supposed to see or change.

If you must use either, use a value that can not be easily changed to anything else meaningful (like a session id value).

Anonymous:

"The system was quickly secured by making “admin“ a hidden form variable."

... Except it's still open to the same abuse. :p

Really? Are you serious?

Read the rest of the original post genius. Everyone knows that the "solution" was no solution at all.

sincerely,
Richard Nixon

Anonymous:

There is a Greasemonkey script to convert all hidden form fields into text fields... so you must assume that ANY HIDDEN FORM FIELD CAN BE CHANGED AT WILL.  The end lesson of this is to never use form fields.

The same applies to cookies... they can be changed.  Do not use them for data the user is not supposed to see or change.

Wrong. Forms are fine. They work great. The moral of the story is to NEVER trust input sent from the browser. Period.

Anonymous:

If you must use either, use a value that can not be easily changed to anything else meaningful (like a session id value).

That alone will not suffice. See phpsec.org for details.

Alex Papadimoulis:

My email seems to be down for now, so today's “good practice“ example comes from yours truly. A software tester I work with was pretty excited that he was able to hack a web-based calendar application built for a college. The system was in production for a while, and he was supposed to test a minor tweak made to it. Now, I'm not going to tell you how he gained administrator privileges, but I will present the URL of the system and see if you can figure it out:

The system was quickly secured by making “admin“ a hidden form variable. While I doubt you fellows would be able to hack that, I blurred out the university name just in case. We wouldn't want “Panty Raid at Heinsmans!!!” listed under “Alumni Council Meeting” now would we?

-- Don't forget to send in your Daily WTF!

Thats the point, changing it to hidden does nothing its still a GET

 

Gotta whip out those <sarcasm> tags more often gentlemen/ladies ;)

Anyone remember Shadowbane? The game where "Play to Crush" became "Pay to Crash"? They had their CSR privilege toggle client-side.

If I recall correctly, someone in a guild called Rolling 30's found out about this. They flipped the switch. Initially they just used it to give themselves whatever they wanted, gold, gear, city improvements, whatever, and after a while they got bored and quit Shadowbane ... but before they did, they went wild. They did stuff like moving player cities (with their inhabitants) to the bottom of the ocean, that kind of thing. They destroyed what was left of the economy, they cost thousands of users their stuff (not least because the developers had neglected to write any effective admin tools to log or fix things), and made a royal mess.

The company had to do a 3-day rollback to fix the resulting unholy mess. Or they tried; being Wolfpack, they did a half-assed job and botched the whole thing, but what do you expect from a company that puts the godmode switch in the client?

Incidentally, there are people to this day who think that was the most interesting thing that ever happened in Shadowbane. They may have a point.