Hacking PHP Mail

This shows in detail how hackers inject PHP mailer scripts

Category:

Howto & Style

Tags:

• Hack
• Hacking
• PHP
• Hacks

[thirtysixway]

Just because it was some mail example doesn't mean people are actually using or advertising that they're using it. Fucking moron.

[djshaunp]

You sir are a uber dip shit deluxe. Plenty of people use or used this script, that's why it had a large rating on hotscripts[dot]com. Next time, save yourself from looking like a total retard, and do your research before you open your man hole.

[djshaunp]

Are you all retarded? The script that was exploited by your's truly is an Open Source mail form script. You can download the source code anywhere. Google PHP formmail, ugh. Instead of hating, do you research and stfu.

[djshaunp]

I guess none of you have heard of site leechers that will download the entire site and all of it's files and folders? mmkay. Not all of your average everyday "skiddie" leechers will work. You have to trick the webserver into making your download the script.

[djshaunp]

Perhaps by using a browser object that doesn't have options for viewing php, flooding the web server's php "GET or POST" thus tricking php into just offering the script for download to your machine, instead of in the browser server side. There are many types of ways this can be done, You just have to know WTF you are doing, which apparently is not the case with some of you who say it's "Impossible"

[Ezlivin]

Exactly. This is like a car thief saying "It's easy to steal a car. First find an unlocked car with the keys in the ignition."

It'd be easy to "hack" a PHP script if you could simply download it from the server. Yet nowhere in this video is the method to accomplish this shown.

[phpin24]

ok trying to figure it out... is this a joke? I assume you don't see this video as valid anymore... at least since PHP5. But what I would like to know is how do you get a php file off a server??? Honestly I do not believe this is possible.

[wild1928]

i watched it all god damn. i've lost 22mins from my life

[xtdz32]

can u post a video on step by step method of making and using a php mailer

[Gulraiz10]

its totally wrong

[Gulraiz10]

fu ck ooof

[alexwirtz68]

Suspect this is predicated on some really lame system setting (STILL extant on many shared servers!) like register_globals set to 'on'. Anyone who could switched that off about 10 years ago but incredibly it's not extinct yet!

[sweetboyUs]

thank you i dowloaded inbox mass mailer from w w w . i n b o x p h p m a i l e r . 9 h z . c o m butt where to upload pls tell me

[furcino]

mostly when u write scripts u use certain names of variables... like $header, $body, $email... It's like with SQL injection. U try to misuse people writing scripts in an intuitive way. Also, you can try to watch the behaviour of the form while changing variables, but I think it's just a waste of time...

U won't manage anything especially with what he did.

[furcino]

:D that is just notmal GET injection.

1. most servers have php set to block get variables that aren't requested in the script

2. u should consider this when writing a script

3. I write scripts with IP blocking (you can send stuff to max 15 people daily, max 3 messages [1 msg goes to 5 people max] )

4. use vars from POST!!! (get is really vunlnerable)

5. My messages have a predefined format that cannot be altered so u can't change headers, to, from or anything just the text inside(html excluded)

[eltoni123321]

can you mail me that script in a plaint text file?

[t0mmy9]

maybe i misunderstood this, i skipped the occasional bit but php uses $_POST to get values from a form and $_GET to get values from a URL, so this might not work on most email forms...