Pages

Tuesday, 21 January 2014

Rejestracja istniejącego, lub jednoliterowego nicku [MyBB, phpBB]


Za namową Adama z Z3S postanowiłem opisać problem po polsku i przeprowadzić trochę więcej testów (dzięki za motywacje! :>).

Czym jest "zero width non jointer"
"zero width non jointer" jest znakiem o szerokości 0 pixeli, samodzielnie występuje jako niewidoczny znak. Więcej informacji: http://en.wikipedia.org/wiki/Zero-width_non-joiner

Znajdziemy go w tablicy znaków (Start > Wyszukaj "> "Tablica Znaków"),  zaznaczamy Widok zaawansowany i w wyszukiwanie wpisujemy "Zero Width Non-Joiner", naciskamy wybierz, a następnie kopiuj.




















Test popularnych for
Postanowiłem przetestować jak zadziała użycie go przy rejestracji na kilku popularnych forach.

  • Vbulletin&IpBoard 

Oba wydają się być bezpieczne,
‍‍‍Vbulletin przechodzi początkową walidacje, przy wpisywaniu, jednak po kliknięciu zarejestruj:








Podejście IpBoard bardziej mi się spododało, odrazu informuje, że można użyć tylko znaków a-zA-Z0-9





  • MyBB:

Potrzebujemy nicku 3 znakowego:






Teraz dodałem 2 znaki "zero width non jointer":






 Działa!









Ale rejestracja nicku jak 'a', może służyć jedynie zabawie, teraz spróbujmy zarejestrować istniejący nick, czemu by nie "admin" ?

Przed dodaniem znaku U+200c :




 

Po:












Zalogowano



Dodanie posta w temacie prawdziwego admina:
















Na następnym screenie, możemy zobaczyć 3 adminów i 2 użytkowników o nicku 'a':








Zgłosiłem już to do MyBB.

  • phpBB

Tym razem forum nie pozwala nam zarejestrować takiego samego, jednak nadal można nick jednoliterowy:







Zagrożenia:
Powiecie, że np. w MyBB "admin jest zielony i ma więcej gwiazdek", Prawda..., ale:
1. W prywatnej wiadomości, np z prośbą o nowe hasło, ludzie mogą tego nie zauważyć, szczególnie jeżeli użyjemy takiego samego avataru.
2. Możliwe jest stworzenie każdego nicku, więc atakujący może stworzyć konto o nicku zaufanego sprzedawcy, o takiej samej randze, a nabicie postów to nie problem.
3. Ludzie mogą popełnić błędy podczas wysyłania prywatnych wiadomości i wybrać nas, zamiast prawdziwego adresata.


Jak zaradzić:
Najlepszym sposobem, jest sposób zastowany przez IpBoard, czyli whitelist dla dozwolonych znaków, np. a-zA-Z0-9

Fix w MyBB stworzony przez Pawła Klebba:

Plik inc/datahandlers/user.php, linijka koło 73. Zamienić ją na:
$username = str_replace(array(unichr(160), unichr(173), unichr(0xCA), dec_to_utf8(8238), dec_to_utf8(8237), dec_to_utf8(8203), dec_to_utf8(8204) ), array(" ", "-", "", "", "", "", ""), $username);


18 comments:

  1. Habits die hard. So, if we are going to be slaves of our habits, lets at least have good habits. If we stretch this point, it is easy to see the case for money and financial education for school children.http://www.careerpanth.xyz/

    ReplyDelete
  2. The blog resembles a chocolate for me. I need to have it constantly.
    clash royale triche

    ReplyDelete
  3. How about you take a good look here for some good information about spyware application called mSpy

    ReplyDelete

  4. A high-level post with a piece of knowledgeable information.Thank you for sharing such information.
    if you need any academic level Assignment Help at reliable quality with better work.
    for more: WhatsApp or call +61 2 80113341

    ReplyDelete
  5. Need essay help? Look no further than Allessaywriter.com. With more than a dozen years of experience in providing university essay help for students, we are best suited to attend to your every need. Here’s why:
    Our team of more than 5000 essay writers guarantees that your essay will be 100% plagiarism-free.
    They hail from the finest universities in Australia, so you know you’re getting your money’s worth.
    Speaking of money, we offer the most affordable essay help service there is. It is suited to the student.
    Not only that, we offer a 100% money-back guarantee in case you’re unsatisfied with our services.
    We’ve all been students ourselves, dependent on pocket money or slaving away at part-time jobs. We know what it’s like. So we’ve made our rates impossible to beat.

    ReplyDelete
  6. Wondering why you should choose us for availing customised assignment help in Australia? We have been in the business for over a decade, and we know we are good at helping students, that’s why! Additionally, here are a few cool stats that make us the best when it comes to Australian assignment help.

    ReplyDelete
  7. Providing accurate Enron case study help, we can come to your rescue at all times – throughout the day and night. Keep things simple when you have trouble composing an Enron SWOT analysis – get in touch with the team of experts at MyAssignmenthelp.com, and avail the promptest Enron case study help today!

    ReplyDelete
  8. Ever woke up in the dead of night due to a nightmare about failing a grade? Well, buying an essay online from us means that you are buying a good night’s sleep!

    ReplyDelete
  9. Great Information sharing .. I am very happy to read this article .. thanks for giving us go through info.Fantastic nice. I appreciate this post.
    Apa Essay Format

    ReplyDelete
  10. Nursing Assignment help provided by fullhomeworkhelp.com takes care of these fundamentals and most of our tutors are efficient with every programming assignment.
    physics Assignment help

    ReplyDelete
  11. i-LEND is an online marketplace connecting borrowers and lenders for loans. Although i-LEND verifies credentials of registered users on the site, it does not guarantee any loan offers by lenders nor does it guarantee any repayments by borrowers. Users make offers/loan requests at their own discretion with the understanding of the risks involved in such transactions including loss of entire capital and/or no guarantee of recovery. Please read our Legal agreements to understand more. Read more- i-Lend is India’s Leading Online Personal Loan Market Place

    ReplyDelete
  12. If you are looking for the Software Engineering Help assignment then in this case you can opt for our Essay Writing.we provide the best Essay Writing Services.We also provide Nursing essay help for students across the globe. for more information contact us +16692714848.

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. Quite interesting post you made. It's good shared information and the article is pretty helpful. I like the write-up's structure and flow, as it kept me engaged all this time. Read more- finance assignment help

    ReplyDelete

  15. Register for FREE with us and begin your journey to play rummy online. PlayRummy is one of the best rummy sites online in India. Put your rummy skills to use in our world class Indian rummy portal and win real cash prizes. Whether you are sitting at your home or are on the move, you can play free rummy as well as rummy for cash and win huge cash prizes.Learn how to play rummy, also know about the different variants of the Game. Start winning real cash rewards in Online Rummy.

    ReplyDelete