5 ms·

I found a legit repo for this code https://github.com/andresriancho/w3af-moth https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used t

I found a legit repo for this code https://github.com/andresriancho/w3af-moth https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."

elwell 12y ago
Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
- utunga 12y ago
  Yes. No.
- xai 12y ago
  What if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
  - vz0 12y ago
    What about phpMyAdmin and others alike webapps? Are they inherently insecure?
    - deleted 12y ago
      [deleted]
    - coldtea 12y ago
      Those are different, as they only do what they are meant to do (give access to the databases). They don't give untintended full access to the web server. That said, they are a little insecure.
      - blueskin_ 12y ago
        >They don't give unintended full access to the web server. https://en.wikipedia.org/wiki/Webmin https://en.wikipedia.org/wiki/Webmin Maybe not unintended, but definitely full access, and the world is almost certainly full of outdated/non whitelist access/weakly passworded panels. Also, on a a sufficiently misconfigured server, you could always use \! (mysql's shell_exec, etc.) with phpmyadmin etc. to open a remote shell somewhere, then work from there.
      - deleted 12y ago
        [deleted]
- robbles 12y ago
  It would still be vulnerable to a CSRF attack. The attacker can just get a logged-in user to launch their exploit, through a vulnerable site they frequent or even a link or image in an email.
  - blueskin_ 12y ago
    Theoretically, building CSRF protection in isn't mutually exclusive with passing unsanitised variables to a shell. Although sure, most people who do the latter won't do the former.

elwell 12y ago

Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.

utunga 12y ago
Yes. No.
xai 12y ago
What if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
- vz0 12y ago
  What about phpMyAdmin and others alike webapps? Are they inherently insecure?
  - deleted 12y ago
    [deleted]
  - coldtea 12y ago
    Those are different, as they only do what they are meant to do (give access to the databases). They don't give untintended full access to the web server. That said, they are a little insecure.
    - blueskin_ 12y ago
      >They don't give unintended full access to the web server. https://en.wikipedia.org/wiki/Webmin https://en.wikipedia.org/wiki/Webmin Maybe not unintended, but definitely full access, and the world is almost certainly full of outdated/non whitelist access/weakly passworded panels. Also, on a a sufficiently misconfigured server, you could always use \! (mysql's shell_exec, etc.) with phpmyadmin etc. to open a remote shell somewhere, then work from there.
    - deleted 12y ago
      [deleted]
robbles 12y ago
It would still be vulnerable to a CSRF attack. The attacker can just get a logged-in user to launch their exploit, through a vulnerable site they frequent or even a link or image in an email.
- blueskin_ 12y ago
  Theoretically, building CSRF protection in isn't mutually exclusive with passing unsanitised variables to a shell. Although sure, most people who do the latter won't do the former.