Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions

Reply
 
Thread Tools Display Modes
  #1  
Old 10-21-2003, 11:42 PM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default How are sites like xanga.com able to enable HTML and flash?

...without having their site hacked?
Reply With Quote
  #2  
Old 10-21-2003, 11:49 PM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

they filter out all potentially harmful HTML and flash via intricate filtering. These sort of filters are usually custommade by some company or so for them, and cost a good penny.
Reply With Quote
  #3  
Old 10-22-2003, 12:01 AM
Steve Machol's Avatar
Steve Machol Steve Machol is offline
 
Join Date: Nov 2001
Posts: 1,896
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Tae-Hwan
...without having their site hacked?
And just because you have not seen them hacked doesn't mean they haven't been - or won't be in the future.
Reply With Quote
  #4  
Old 10-24-2003, 11:28 AM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

ok, i know xanga has been hacked but i was just wondering how safe velocd's custompage hack is. i'm ok with disabling javascript, but how exactly can you hack a site through flash? does anyone know of any resources i can read on this?

thanks!

it would also be nice to read some stuff on how javascript can hack a vbulletin (if html is enabled) but i'm not too optimistic about the possibility of leaving that on, hehe. it would just be nice to know, for curiosity's sake.

btw i'm ok at php/mysql so you can use programmer-geek language to explain it to me
Reply With Quote
  #5  
Old 10-24-2003, 12:03 PM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

See, I don't think it's really good for anyone to tell you how to hack a vBulletin. Such information can easily be abused, perhaps not by you but by others. Moreover, we have no way of making sure you won't abuse that knowledge yourself.

Same with hacking through Flash.
Reply With Quote
  #6  
Old 10-24-2003, 11:22 PM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

ok, i assure you, all i want to do.. is install velocd's custompage hack while maintaining the peace of mind that no one's going to destroy my site through it. in its current form, it does allow you to embed flash into the html code of a member's page, which is exactly why i want to know how much i can limit this to keep my server secure. deterrence through obscurity never works, which is why open-source products are more secure than microsoft products. i think it would be beneficial to the entire vbulletin.org community, if we knew the vulnerabilites in our software,.. so if anyone would be kind enough to tell me exactly how flash can be used to hack the server, i'd really appreciate it.
Reply With Quote
  #7  
Old 10-24-2003, 11:40 PM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

trust me, allowing users to embed flash on your site from whatever given source is a major security leak. There is no way you can make it safe, the only safe way is to not allow flash, simple as that. Or to let them choose from a few examples that you both store and have made, all by yourself. But that's probably not what you want...
Reply With Quote
  #8  
Old 10-25-2003, 02:10 AM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

yes, i trust you in that it is a security leak, but as a programmer, i have a proclivity to understand why things work the way they do.

some forums use the following method to embed flash:

Quote:
Originally Posted by scsa20
$hit (sorry for my language), this is easy to do, just go to your admin cp and go to:
Custom vB Codes>Add

and put in the following:

vB Code tag: flash
vB Code replacement: < embed src={param } type=application/x-shockwave-flash>< /embed>
vB Code example: [flash ]Your URL to your flash movie just for an ex.[ /flash]
vB Code explanation: Your own explanation
Use {option } ?: No

remember, to remove spaces from [ and flash] and [ and /flash] and anything that's < and > and also anything between { and }

good luck
are you telling me that all these forums (assuming that they are publicly accessible) are insecure as well?

with all due respect, i find your unwillingness to relinquish any information on this matter rather unnerving.. i have never, and will never, hack someone else's vbulletin. i just have a desire to know why it's possible, to better my understanding of the security threats to my website, and to better my understanding of website security in general. i was under the impression that this is a trait common to all programmers, is it not?

from the way you're talking, it seems like you're pretty knowledgeable about this stuff, so i'm sorry if we misunderstood each other along the way, but i'd really appreciate it if you would help me out here, or at least guide me towards some information on the nature of malevolent flash scripts.
Reply With Quote
  #9  
Old 10-25-2003, 02:24 AM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

well, I'm just hesitant in sharing information about security leaks / loopholes etc.
other people read this site, too. they might have real bad intentions....


Basically, embedding any flash file from a source that is not your own server, poses a direct thread. There is no way of telling what the flash file will do upon execution, and flash files are capable of a lot more than people think.... So yes, the vB Code above is a risk, a security problem...
Reply With Quote
  #10  
Old 10-25-2003, 02:26 AM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

ah i see, so the only thing i need to do is filter it so that the flash file must come from my own server? so i can have them upload the .swf file to my server, and link to it in the embed tag?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 05:03 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04329 seconds
  • Memory Usage 2,242KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (2)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (10)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete