1,856 reputation
2933
bio website
location
age
visits member for 2 years, 2 months
seen 10 hours ago

2d
asked DIsk imaging on virtual environment
2d
accepted What does Windows's built-in encryption do, if I can seemingly always read my encrypted files?
2d
awarded  Popular Question
Dec
10
comment Alternative ways to exploit this path traversal
It was pretty easy... The trick was in that .. wasn't allowed, but a single dot yes, so using a dot in folder and another dot in file, I could go to the other directory.
Dec
10
accepted Alternative ways to exploit this path traversal
Dec
10
comment Alternative ways to exploit this path traversal
well... we can say that it is beneficial but it doesn't solve the problem. I found the answer already, it doesn't depend on encoding, but I'm accepting this as it can benefit other people with directory traversal attacks.
Dec
9
revised Alternative ways to exploit this path traversal
added 75 characters in body
Dec
9
comment Alternative ways to exploit this path traversal
the application only accepts ascii and hex. It seems it doesn't properly handle 16-bit unicode, double URL encoding or UTF-8 unicode.
Dec
8
comment Alternative ways to exploit this path traversal
@mcgyver5 didn't think about that, but just tried and if I replace folder with anything else, there is a 302 to folder=public which is the default page.
Dec
8
comment Alternative ways to exploit this path traversal
@Rook it's a black box testing. The message it returns is just a string saying that "Error, using '..' is forbidden in folder and file name.
Dec
8
asked Alternative ways to exploit this path traversal
Dec
5
accepted If mysql schema is missing, where can I find credentials?
Dec
5
answered If mysql schema is missing, where can I find credentials?
Dec
4
comment If mysql schema is missing, where can I find credentials?
my question was about DB users. After speaking with my professor, his question was poorly worded and he meant to just say which user was doing the queries, which is as simple as using user(). Anyway, my question here remains open, although I think the only possible answer is to look for a privilege escalation exploit in the DB, because as DarkLighting said, there must be some hardening.
Dec
3
comment If mysql schema is missing, where can I find credentials?
@DarkLighting yes, I can gather everything from information_schema. I think that my current problem is a poor wording of the question by my professor, because what he's asking better suits the second problem where there is indeed a table with users and passwords xD
Dec
3
comment If mysql schema is missing, where can I find credentials?
@DavidHoude I understand that, but at least the schema "mysql" should show up in information_schema, shouldn't it?
Dec
3
asked If mysql schema is missing, where can I find credentials?
Dec
1
awarded  Popular Question
Nov
23
awarded  Popular Question
Nov
23
asked Where can I get name of the person who registered Windows and his organization?