Re: Which file "Included" me?
| From: | Dotan Cohen | Date: | Wed, 18 Feb 2009 22:01:19 +0000 |
| Subject: | Re: Which file "Included" me? | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-288575@lists.php.net to get a copy of this message | ||
> Did you actually try his example?
No, I could not understand it. Now I see why:
1) Where would the "experienced hacker" enter the attack? Now I see
that it is the URL of the attacked site. That was not clear, I though
that it was being entered into some form element that I did not see in
the code.
2) I thought that yoursite.com is the attacked site, and mysite.com is
the attacking site. Now I see that the author just messed up and they
both should have been yoursite.com.
Why not just use SCRIPT_NAME then? It doesn't contain the path variables.
--
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת
ا-ب-ت-ث-ج-ح-خ-د-ذ-ر-ز-س-ش-ص-ض-ط-ظ-ع-غ-ف-ق-ك-ل-م-ن-ه-و-ي
А-Б-В-Г-Д-Е-Ё-Ж-З-И-Й-К-Л-М-Н-О-П-Р-С-Т-У-Ф-Х-Ц-Ч-Ш-Щ-Ъ-Ы-Ь-Э-Ю-Я
а-б-в-г-д-е-ё-ж-з-и-й-к-л-м-н-о-п-р-с-т-у-ф-х-ц-ч-ш-щ-ъ-ы-ь-э-ю-я
ä-ö-ü-ß-Ä-Ö-Ü