this site is hackable

[Julzz]

man i was checking the source of this site and found millions of holes that will allow a hacker to hack this site.

man Matt if i were you Pm me for a Script whitch will allow people to stop viewing the  source 

P.S there's no need to redo this site

[Ollie]

well i never exspected this to come?!

[Julzz]

no just saying people with HTML SMF Programmers will Easy lol

so dw

[bambigoddess]

I'm not sure I really understand...what makes you so sure it's hackable, if you don't mind my asking?

[matt]

Јулиус Είμαι, can you explain how you were checking the source of this site? PHP is server side code, so all the functions etc are executed server side, then it's converted to HTML which is what you see client side. Unless you have FTP access to my server, I doubt you've seen the actual source.

Anybody can view the 'source' of this site but what they are actually seeing is the generated HTML code, not the real source.

Any site is 'hackable' if the person has enough talent and time, but we keep this site up to date with the latest security patches to minimise the risk. Plus there is no real gain for anyone to hack this site, so hopefully people wouldn't be cruel enough!

If you let me know what you think you've found, I'll be happy to take a look.

Don't worry, I have no plans to redo the site

[Julzz]

Yeah i know but you can still hack it


let me explain

a hacker will first attack the server this site is on by ping time-out this and then pingtimeout the domain then will have easy access and to attack the SQL server then log on the admin account and then change the forum index.php

plus theres 20 ways to hack this site

[Julzz]

(29-01-2009 04:39 AM)Bambikins link Wrote:I'm not sure I really understand...what makes you so sure it's hackable, if you don't mind my asking?

yeah

[matt]

By ping timeout, do you mean a DoS (Denial of Service) attack? That is potentially possible on any domain/IP and has nothing to do with the forum software itself. And a DoS attack does not give the attacker access to the SQL server or give them the ability to find out usernames or passwords. All it does is make the server so busy it falls over, which really doesn't achieve anything other than being an annoyance.

[Julzz]

(29-01-2009 10:37 AM)Matt link Wrote:By ping timeout, do you mean a DoS (Denial of Service) attack? That is potentially possible on any domain/IP and has nothing to do with the forum software itself. And a DoS attack does not give the attacker access to the SQL server or give them the ability to find out usernames or passwords. All it does is make the server so busy it falls over, which really doesn't achieve anything other than being an annoyance.

you dont understand. ping time outs as DoS Attack may cause your site to stop responding like i seen on a forum i use to own.

[matt]

Yes, the site would stop responding as the server would grind to a halt. But that would only be temporary. And this doesn't give the attacker access to anything to cause any more damage.