dev blog (archives)

You blew it!

Or should I say, "u fUxD Up!". I'm talking to all you so-called "hackerz" (aka. h4x0rZ) out there. Note I don't say "hackers", a group one should feel a swell of pride to be among. No, I mean those script-kiddies who trawl around the internet; teen vandals, looking for some place to dump their meaningless, pre-made web-hacks. You suck, the lot of you. And you still haven't managed to "hack" the org!

When I was a kid, I mean your age, thirteen or so, we didn't have supercomputers and php, or any of that. We had, at best, an Apple ][, or maybe a BBC Micro, BASIC and assembler, and access to the school's (oh man! soo slow) modems. If you wanted to peek inside restricted stuff, you had to know your shit, which you simply don't.

Do you remember waaaay back, oh, over a year ago, I did a blog about how I was shoring up a couple of security "holes" in the site, and how there was one more hole that I knew about, but was gonna leave as-is, for now. Of course, I didn't say exactly what it was, which spoils all the fun. Oh, you don't read the devblog. Serves you right, then! Research, Boy!

The M.O. of these script-kiddies is to scan for available "common known vulnerabilities", or else just hit them all in the hope one might exist. These kinds of vulnerabilities are highly unlikely to occur here at corz.org, because I wrote the back-end myself, and it's anything but common.

However, most of the source is available for download, and even for pretty syntax-highlighted viewing online. I've made it as easy as possible for any reasonably intelligent person to find and exploit potential vulnerabilities; my logic being that this is the best way to get your code secure - users will complain, you see; send security notices. Only one so far, but still, that's the value of releasing your code - peer testing. But I'm straying..

Usually, it's semi-automated hits, looking for Microsoft IIs or Front Page security flaws. Considering I don't run Front Page (*eew*), and this is a Linux server, these individuals are clearly fools of the lowest order. vti what? However, occasionally, a script-kiddie rises, just slightly, above the pack, and arrives here via some google search for a "potentially insecure web app", a much more logical approach. The usual target is, of course, upload.php.

Now, me being a clever bastard, I'm not going to have the most sought after possibly-vulnerable script as my gaping security hole, am I ?!?

Yup. And for years, too. Okay, the upload area contains nothing but other uploads, but judging by the thousands of attempts to hack into there, I KNOW you wanted to see those files, but couldn't. I really thought someone might figure it out. Nope.

Hiding things in plain sight often works well, because most people don't actually look. Even though the highlighted source for upload.php is right there for viewing and downloading, still you missed it. You uploaded hundreds of index.php, quite a few index.html*, and all the rest if it, even though it's clear by glancing at the code of upload.php, that these things get a .txt extension added to them, and no way are they gonna parse as php!

I have a massive collection of interesting php $hell scripts, too, many in highly fascinating Eastern European languages. All converted to something.php.txt, and also never parsed by the server. Even if your scripts hadn't been neutered by the .txt extension, you couldn't get access to the private/ folder to run them. I remember failed hacks of my youth, and I feel for you.

Today, I realized that I need the upload script for something more important than improving my php shell scripts collection, and decided to finally fix the security hole; I've basically given up waiting for one of you h4x0rZ to get a working brain.

So, now you're fucked. You had you chance, and you blew it. And once you've wiped all that cum off your sleeve, you can kick yourself while I tell you what you had to do to "hack the site", at least get to all my golden uploads, was..

upload an .htaccess file

Easy when you know how!

;o)
(or