From: Sir Mordred (email@example.com)
Date: Mon, 05 May 2003 15:58:59 +0000
Subject: [Full-Disclosure] @(#)Mordred Security Notice - exporing the hacking websites
// @(#)Mordred Labs security notice - exploring the hacking websites
Release date: May 5, 2003
Author: Sir Mordred (firstname.lastname@example.org)
It is a first security notice about the real state of web app security
with the real world examples. In this issue we will be focusing on websites
related to hacking.
Security companies and news portals will be discussed later.
For now, it would be nice to see the reaction of the community on this
Looking at this notice, one can clearly see, that the combination of
ASP/PHP and relational database
is a very dangerous, even the "security experts" make mistakes :-).
Surely, not all of the vulnerabilities have been found/disclosed.
For example, there was no testing for CSS vulnerabilities at all.
Note that the vulnerabilities are presented here in the following format:
* ISSUE - description of the vulnerability
blank line the url to demonstrate this vulnerability
blank line the error message (if exists)
One last word to tripz: thanks for the help.
2) --------------------- www.hackinthebox.org --------------------------
Hack In The Box is designed to facilitate discussions on security related
topics, create security awareness, and to try and provide a comprehensive
database of security knowledge and resources to the public
Rather interesting website, the nice thing about it is that HITB opened
source code of certain parts of the website, i did not bother to look at their
* ISSUE 1 - SQL injection in /memberlist.php page
1064: You have an error in your SQL syntax.
Check the manual that corresponds to your MySQL server version for the
right syntax to use near ' LIKE '%' ORDER BY uname,' at line 1