Pages

Tuesday, 21 January 2014

Rejestracja istniejącego, lub jednoliterowego nicku [MyBB, phpBB]


Za namową Adama z Z3S postanowiłem opisać problem po polsku i przeprowadzić trochę więcej testów (dzięki za motywacje! :>).

Czym jest "zero width non jointer"
"zero width non jointer" jest znakiem o szerokości 0 pixeli, samodzielnie występuje jako niewidoczny znak. Więcej informacji: http://en.wikipedia.org/wiki/Zero-width_non-joiner

Znajdziemy go w tablicy znaków (Start > Wyszukaj "> "Tablica Znaków"),  zaznaczamy Widok zaawansowany i w wyszukiwanie wpisujemy "Zero Width Non-Joiner", naciskamy wybierz, a następnie kopiuj.




















Test popularnych for
Postanowiłem przetestować jak zadziała użycie go przy rejestracji na kilku popularnych forach.

  • Vbulletin&IpBoard 

Oba wydają się być bezpieczne,
‍‍‍Vbulletin przechodzi początkową walidacje, przy wpisywaniu, jednak po kliknięciu zarejestruj:








Podejście IpBoard bardziej mi się spododało, odrazu informuje, że można użyć tylko znaków a-zA-Z0-9





  • MyBB:

Potrzebujemy nicku 3 znakowego:






Teraz dodałem 2 znaki "zero width non jointer":






 Działa!









Ale rejestracja nicku jak 'a', może służyć jedynie zabawie, teraz spróbujmy zarejestrować istniejący nick, czemu by nie "admin" ?

Przed dodaniem znaku U+200c :




 

Po:












Zalogowano



Dodanie posta w temacie prawdziwego admina:
















Na następnym screenie, możemy zobaczyć 3 adminów i 2 użytkowników o nicku 'a':








Zgłosiłem już to do MyBB.

  • phpBB

Tym razem forum nie pozwala nam zarejestrować takiego samego, jednak nadal można nick jednoliterowy:







Zagrożenia:
Powiecie, że np. w MyBB "admin jest zielony i ma więcej gwiazdek", Prawda..., ale:
1. W prywatnej wiadomości, np z prośbą o nowe hasło, ludzie mogą tego nie zauważyć, szczególnie jeżeli użyjemy takiego samego avataru.
2. Możliwe jest stworzenie każdego nicku, więc atakujący może stworzyć konto o nicku zaufanego sprzedawcy, o takiej samej randze, a nabicie postów to nie problem.
3. Ludzie mogą popełnić błędy podczas wysyłania prywatnych wiadomości i wybrać nas, zamiast prawdziwego adresata.


Jak zaradzić:
Najlepszym sposobem, jest sposób zastowany przez IpBoard, czyli whitelist dla dozwolonych znaków, np. a-zA-Z0-9

Fix w MyBB stworzony przez Pawła Klebba:

Plik inc/datahandlers/user.php, linijka koło 73. Zamienić ją na:
$username = str_replace(array(unichr(160), unichr(173), unichr(0xCA), dec_to_utf8(8238), dec_to_utf8(8237), dec_to_utf8(8203), dec_to_utf8(8204) ), array(" ", "-", "", "", "", "", ""), $username);


30 comments:

  1. Habits die hard. So, if we are going to be slaves of our habits, lets at least have good habits. If we stretch this point, it is easy to see the case for money and financial education for school children.http://www.careerpanth.xyz/

    ReplyDelete
  2. The blog resembles a chocolate for me. I need to have it constantly.
    clash royale triche

    ReplyDelete
  3. How about you take a good look here for some good information about spyware application called mSpy

    ReplyDelete
  4. Im no expert, but I believe you just made an excellent point. You certainly fully understand what youre speaking about, and I can truly get behind that. Racing Simulator

    ReplyDelete
  5. The experts of this company always understand the students and their homework issues. So, they provide best primary homework help service in doing their assignment in numerous subjects. The service not only helps the students in resolving their issues of academic assignment, but also provides some time for meditation and relaxation. This company has become a renowned website in worldwide academic industry. It acts as the best homework help service provider, which provide solutions to the changing needs of the students around the world like USA, UK, Australia and Singapore many others. The experts of this company do not hide anything from you and always keep constant contact with you regarding your assignments. If experts face any issues during providing do my homework for me , it is immediately shared with you so that you can resolve the issues regarding your requirements.

    ReplyDelete
  6. My Assignment Services is your first and last destination for every query you have related to ‘help my assignment’ because we guarantee you the lowest possible price of Java Assignment Help Australia with the unmatched quality of assignments in Australia.

    ReplyDelete
  7. This post is not just informative but impressive also. The post is so convincing that it created an urge to choose Assignment Help services. You can email us at Info@Myassignmenthelpau.Com or Phone Number: +61-2-8005-8227

    ReplyDelete
  8. StudentsAssignmentHelp.com is working to give the professional Essay Help services for all the students studying in different colleges or universities in Ireland. We can cover any of the essay topic for you and assure that you will score the highest grades ever.

    ReplyDelete
  9. Allassignmenthelp has been the academic industry leader for last four years now. Online assignment helpin the field of a specialized product that benefit students.

    ReplyDelete
  10. Allassignmenthelp reviews31 January 2019 at 22:39

    Welcome to the Best writer Review, Here you can get the best Allassignmenthelp reviews
    sites. We strongly urge you to check our entire website once and we will assure you will find this review website very useful. Our hard work will be rewarded if students like you will appreciate our effort and spread the message about this site with your class-fellows and friends.

    ReplyDelete
  11. A lot of valuable information can be derived from the post. Certainly, this compelling post will encourage readers to choose Assignment Help Australia services. You can email us at info@firstassignmenthelp.com.

    ReplyDelete
  12. Thanks have been given the opportunity to comment. Hopefully what you provided is useful for all those who need them. Visit my website if you want to know more about www.12naga.com

    judi online terpercaya
    taruhanbola
    Poker Online
    togel online
    casino online
    sabung ayam online
    tangkas online terpercaya
    slot online

    ReplyDelete
  13. Students Assignment Help have the dedicated and expert team of professional writers who can provide the how to write an essay services correctly. Our writing experts have complete knowledge of all academic assignments to assist students. Our expert writers are the degree holder from the top universities.

    ReplyDelete
  14. Very nice blog and articles. I am really very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. My Assignment help

    ReplyDelete
  15. AllAssignmenthelp reviews is best reviews site. We at Top Quality Assignment believe that there is no shortcut to success and to attain success, hard work, dedication, and commitment must be present.
    AllAssignmenthelp reviews
    All Assignment help reviews


    ReplyDelete
  16. Being an academic writer from past 5 years providing assignment help to college and university students also associated with Myassignmenthelp platform. I am dedicated in providing best online academic writing services to the college students at the affordable rates.

    ReplyDelete
  17. To get the best coursework writing help UK service hire our assignment help experts at StudentsAssignmentHelp.com at a reasonable price. Our assignment help experts are available to assist the students.

    ReplyDelete
  18. R u looking for Do my assignment services in dublin? So don't worry about your assignment. Our experts helper they will writes your assignment at a cheap cost.

    ReplyDelete
  19. Students are demanding to finish your homework quickly they you can easily get our best service of homework help given by the students assignment help experts. Our experts are ready to offer you help and keeps working for the students to give best service every day. At studentsassignmenthelp.com students can easily get best service 24X7.

    ReplyDelete
  20. My Assignment Services is one such Online Assignment Help provider which provides a helping hand to all your academic related queries. They have a lot of professional experts who are skilful in giving you guidance and providing you with cheap assignment help services. You are free to contact their experts by visiting their website and get your pending presentations completed on the time. Given below are some of the steps that they follow while drafting your assignments. Many students see that Assignment Help UK experts are proficient in writing your assignments but no one wonders the reason behind it. However, students pursuing IT need to understand the concepts of Java because it holds down the concept of object oriented programming. The programming concepts are complex to understand and brings a havoc to students, that is why, My Assignment Services bring you our online assignment help services. Taking out some time to consider and contrast about what options that you have that you can include by writing them on a piece of paper. You can also contact some real time Deakin Referencing Generator experts to assist you with the following topics.

    ReplyDelete
  21. 'Write my essay' we provide service. Students don’t worry about writing. We provide write your essay with the help of our experts. Experts have much knowledge of writing. Hire our experts at Australiaassignmenthelp.com

    ReplyDelete
  22. Pure natural keto is designed for dieters who are just beginning a Ketogenic diet sometimes find that using supplements to achieve ketosis is easier than doing it through nutrition alone. Exogenous ketones supplements are also great if they temporarily ‘fall off the wagon.’ That is what is making Pure natural keto such a popular product these days. It makes being on a Keto diet much easier, and it can help you stay on course.

    Pure Natural Keto Review - Must Watch This Before Buying

    ReplyDelete
  23. If you are searching the cheapest help with assignment writing services nearby your location then you can check out Students assignment help.com, a best assignment service that provides the 100% plagiarism free services. We provide assignment writer at a very low price.

    ReplyDelete
  24. Engineers who wish to migrate to Australia must submit a Competency Demonstration Report and the Engineers Australia must approve it. Thus, engineering students look forward to getting Cdr Australia which assists them to get a flawless CDR. This reduces the chances of rejection by the EA.
    Most students and experienced civil engineers are today looking forward to migrating to Australia as the job scope is better and bigger with a high pay scale. Therefore, getting CDR help is the only scope to gain entry into the country.
    The Cdr Engineers Australia must be impressive and abide by the ANZSCO code and guidelines. It should also showcase the skills of the applicants as a suitable civil engineer to work according to the Australian rules and regulations.
    The service providers who assist the students with CDR have experienced CDR report writers. These writers know the requirements of a CDR and do it accordingly.

    ReplyDelete
  25. Don't wait for cheap assignment services in New Zealand. Just hire students assignment help.com writers for taking the best NZ assignment help in a very affordable price compare to other companies.

    ReplyDelete
  26. Thank you for this useful content, It’s a very useful content that helps me to complete my assignment at right time. I would like to write about my experience of assignment help Australia. I am an academic expert here who provides reference assignment including Accounting, Management, Finance, IT, Economics, Computer Science, Nursing, Marketing; all Academic subjects to University Students across Australia or even globe. We are a big online assignment help providers who help students to get HD grades according to assessment guidelines and instructions.

    Those who are searching for assignment help in Melbourne, Perth, Brisbane, Adelaide etc. They can get an Online Assignment Expert - the No.1 Assignment provider. Any student who is ready to buy an assignment at affordable price, they can visit our marked website & can enjoy the benefits of our amazing and informative services. You can avail of our convenient online assignment help and samples available on our website for free. You can also download it from our website. If you want to get more marks in your university assessment. We assign the best writer according to the subject for your academic problems and help in assignment writing services. Our Customer Care Executives are available 24*7 hours to assist you in the best possible manner. Phone calls and emails are the best methods used by assignment provider.

    ReplyDelete