You've Got LAMERZ!!!

[danielwang]

Boy, it sure is tempting to play with input parse flag injection escaping on these occasions... I wasn't even hacking around - just trying to fill out a form and BAM! On 2 or 3 seperate occasions today, I have had problems with using ' " and other symbols in forms... you've got lazy lamerz.

An error has occured while connecting to the datab1tch:

Syntax error (mising operator) in query expression '(involving the use of /)'."

sConnectionString=Provider=DatabaseSoftware.ABC.DEFGH.1.2.3;Data SOurce=c:/the/websites/database/store.db

Project Address.exe raised exception class EDBEngineError with
'Network initilization failed. Drive not ready. File:

REP-1291 CF... invalid reset group... booring!

Somedays I just feel like filling out a form with:
You_sucker/"'DELETE ALL users WHERE name.Fname BEGINS WITH a OR ''='' "

[danielwang]

I might just as well post the web directory information, host information, software versions, OS, and open ports, but you can figure it out yourself...

my gawd, someone's been lazy and forgot to include a
replace("'","''")
in their parsers. augh, damn unescaped escapes. if some lamer start hacking Hondacars.com or Newtype-usa.com, the first one deserved what they got. The second one almost does... hm, request a quote on a nice new Acura, and request superuser permissions as well. eww.


maybe i'll send a simple email to the sysadmins with the body containing only their server directories... wouldn't that be FUN?

[danielwang]

UPDATE!!!!

Syntax error in INSERT INTO statement...

same old Dabab1tch info....

I can't seem to reproduce the Honda sh1t though. Must've been a fluke.

Now, how do I do SQL Injection again? Yeah, escape the parser and do parameter poisoning, then loop back in!

[danielwang]

NEVERMIND THIS ARTICLE!

I emailed, they fixed. How responsive.

[El Banana]

I can't help but feel sad for the lonely, quadruple post.
Now at least it'll have company.