I have installed NukeSentinel(tm) 71-77 2.3.0 on one of my sites that is running PHP-Nuke 7.6.0.3.0b -
Only registered users can see links on this board! Get registered or login to the forums!
.
The problem is that I get a blank page and I need to recharge it in order to see it normally, maybe this is not an installation problem because I get this blank page at
Only registered users can see links on this board! Get registered or login to the forums!
too but I don't get it at
Only registered users can see links on this board! Get registered or login to the forums!
and
Only registered users can see links on this board! Get registered or login to the forums!
Joined: Mar 06, 2004 Posts: 1156 Location: Sanbornton, NH USA
Posted:
Mon Jun 20, 2005 10:21 am
This is an odd error.
The FIRST time you visit the sites commented about, the page does not display, but the source looks like it is there.
When you hit refresh, the page loads normally.
Now... If you revisit one of these sites AFTER this forced reload, everything loads normally, every time.
BUT, if you close the browser completely and then start it up again and visit these sites, the problem happens again.
Now, if you do this in another 'tab', (without closing the entire browser down)... the problem doesn't happen again. You actually have to CLOSE the Mozilla based browser down completely to replicate the problem.
If I didn't know better, it almost looks like some kind of cache or cookie problem, but not one that I have been able to identify.
I'm also not able to tell if this is a problem with "Patched" or NukeSentinel.
Last week I tested one Nuke Patched and the problem was there, without the Nukesentinel but now I have been testing the PHP-Nuke 7.6.0.3.0b and it doesn't give this problem until I installed the NukeSentinel.
Joined: Dec 19, 2004 Posts: 3143 Location: Germany:Moderator German NukeSentinel Support
Posted:
Mon Jun 20, 2005 1:24 pm
I visited nukescripts.net yesterday and got also only blank pages with Firefox for all 6 demo sites. Is this a new generation of sites or a new trend ? Very strange, isn´t it.
nooticias.com is also a blank page without refresh.
Joined: May 25, 2005 Posts: 26 Location: Atlanta, Georgia
Posted:
Tue Jun 21, 2005 11:40 am
Unsure if the moderators mind me posting this site, I use it as a tool to test vulnerabilities. However, I think the original intent was to hack sites:
*** Link Removed By Moderator 64BITGUY Please do not post hacker based links intended to attack Nuke domains. ***
If any links come up, you are vulnerable to attack, in theory.
Click on one of the links (if they show up). You should get blocked by your site. Make sure you are a protected user of course before you do this.
You should see the blocked page. if not.. something still may not be right. Ravens suggestion is more secure but it causes this error. The previous poster at this link will allow you to see the blocked page:
Only registered users can see links on this board! Get registered or login to the forums!
Joined: Dec 19, 2004 Posts: 3143 Location: Germany:Moderator German NukeSentinel Support
Posted:
Tue Jun 21, 2005 1:37 pm
Hi neodesc,
I asked today in my firefox forum two people about this problem and one of them wasn´t able to see your source code he got also a blank page.
But I quess it´s solved now.
Joined: Mar 06, 2004 Posts: 1156 Location: Sanbornton, NH USA
Posted:
Tue Jun 21, 2005 7:18 pm
infidelguy wrote:
If any links come up, you are vulnerable to attack, in theory.
Click on one of the links (if they show up). You should get blocked by your site. Make sure you are a protected user of course before you do this.
Actually, this informaiton is incorrect.
These "tests" merely display a list of 25 page destinations of known Nuke modules and provides a list of the known vulnerabilities of each of those modules.
This is the primary reason why NukeSentinel was invented.
Clicking any link that comes up on that list would then attempt to use that particular attack against those known vulnerabilities of baseline Nuke code. While these are mainly Union attacks there are a couple of other types of attacks as well.
As clicking any link will execute the attack in question, if you have NukeSentinel, the person originating any of those attacks would be instantly identified and thus banned.
Now, with all of that said, I have removed the link from your original post BECAUSE, the site in question IS a hacker site that is hosting files intended to purposely and maliciously attack PHP-Nuke domains or to otherwise expose weakness in baseline PHP-Nuke code.
While the people hosting this funciton may not consider it malicious, anyone that has been attacked would disagree with that. Further, as the information that is generated when you run that "test" is stored by hackers, if you did successfully penetrate a non-NukeSentinel protected domain, you would be essentially identifying an exposed site and handing over control of that domain to a hacker, which YES, is a bad thing.
I would suggest that not only do you NOT use this domain to "test" your own domain, but not anyone else's domain for these obvious reasons. It can only lead to someone getting hurt and nothing good can come from it.
Last edited by 64bitguy on Tue Jun 21, 2005 9:57 pm; edited 1 time in total
Joined: Oct 30, 2002 Posts: 1043 Location: RedNeck Land (known as Kentucky)
Posted:
Tue Jun 21, 2005 9:22 pm
The NSN Demo sites, I won't list them here cause there are too many of them , are running 7.6 Patched 3.0 not the 3.0b . Therefore I will do some testing and see were the conflict is happening. I can do this on my local so I can disable the Error Supression and hopefully will see what the true error is.
/************************************************************************/
/* PHP-NUKE: Advanced Content Management System */
/* ============================================ */
/* */
/* Copyright (c) 2002 by Francisco Burzi */
/* http://phpnuke.org */
/* */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License. */
/************************************************************************/
/* Additional security checking code 2003 by chatserv */
/* http://www.nukefixes.com -- http://www.nukeresources.com */
/************************************************************************/
//define('NUKE_FILE', true);
if (file_exists("includes/custom_files/custom_mainfile.php")) {
include_once("includes/custom_files/custom_mainfile.php");
}
//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER["QUERY_STRING"]), $matches)) {
die();
}
$queryString = strtolower($_SERVER['QUERY_STRING']);
if (stripos_clone($queryString,'%20union%20') OR stripos_clone($queryString,'/*') OR stripos_clone($queryString,'*/union/*') OR stripos_clone($queryString,'c2nyaxb0')) {
header("Location: index.php");
die();
}
$phpver = phpversion();
if ($phpver < '4.1.0') {
$_GET = $HTTP_GET_VARS;
$_POST = $HTTP_POST_VARS;
$_SERVER = $HTTP_SERVER_VARS;
}
if ($phpver >= '4.0.4pl1' && strstr($_SERVER["HTTP_USER_AGENT"],'compatible')) {
if (extension_loaded('zlib')) {
ob_end_clean();
ob_start('ob_gzhandler');
}
} else if ($phpver > '4.0') {
if (strstr($HTTP_SERVER_VARS['HTTP_ACCEPT_ENCODING'], 'gzip')) {
if (extension_loaded('zlib')) {
$do_gzip_compress = TRUE;
ob_start(array('ob_gzhandler',5));
ob_implicit_flush(0);
header('Content-Encoding: gzip');
}
}
}
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
}
foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
}
if (stristr($_SERVER['PHP_SELF'], "mainfile.php")) {
Header("Location: index.php");
die();
}
/* FOLLOWING LINES ARE DEPRECATED BUT ARE HERE FOR OLD MODULES COMPATIBILITY */
/* PLEASE START USING THE NEW SQL ABSTRACTION LAYER. SEE MODULES DOC FOR DETAILS */
if (defined('FORUM_ADMIN')) {
@require_once("../../../includes/sql_layer.php");
$dbi = sql_connect($dbhost, $dbuname, $dbpass, $dbname);
} elseif (defined('INSIDE_MOD')) {
@require_once("../../includes/sql_layer.php");
$dbi = sql_connect($dbhost, $dbuname, $dbpass, $dbname);
} else {
@require_once("includes/sql_layer.php");
$dbi = sql_connect($dbhost, $dbuname, $dbpass, $dbname);
}
function delQuotes($string){
/* no recursive function to add quote to an HTML tag if needed */
/* and delete duplicate spaces between attribs. */
$tmp=""; # string buffer
$result=""; # result string
$i=0;
$attrib=-1; # Are us in an HTML attrib ? -1: no attrib 0: name of the attrib 1: value of the atrib
$quote=0; # Is a string quote delimited opened ? 0=no, 1=yes
$len = strlen($string);
while ($i<$len) {
switch($string[$i]) { # What car is it in the buffer ?
case "\"": #" # a quote.
if ($quote==0) {
$quote=1;
} else {
$quote=0;
if (($attrib>0) && ($tmp != "")) { $result .= "=\"$tmp\""; }
$tmp="";
$attrib=-1;
}
break;
case "=": # an equal - attrib delimiter
if ($quote==0) { # Is it found in a string ?
$attrib=1;
if ($tmp!="") $result.=" $tmp";
$tmp="";
} else $tmp .= '=';
break;
case " ": # a blank ?
if ($attrib>0) { # add it to the string, if one opened.
$tmp .= $string[$i];
}
break;
default: # Other
if ($attrib<0) # If we weren't in an attrib, set attrib to 0
$attrib=0;
$tmp .= $string[$i];
break;
}
$i++;
}
if (($quote!=0) && ($tmp != "")) {
if ($attrib==1) $result .= "=";
/* If it is the value of an atrib, add the '=' */
$result .= "\"$tmp\""; /* Add quote if needed (the reason of the function ;-) */
}
return $result;
}
function check_html ($str, $strip="") {
/* The core of this code has been lifted from phpslash */
/* which is licenced under the GPL. */
if ($strip == "nohtml")
global $AllowableHTML;
if (!is_array($AllowableHTML)) $AllowableHTML =array('');
$str = stripslashes($str);
$str = eregi_replace("<[[:space:]]*([^>]*)[[:space:]]*>",'<\\1>', $str);
// Delete all spaces from html tags .
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?[[:space:]]*([^\" >]*)[[:space:]]*\"?[^>]*>",'<a href="\\1">', $str);
// Delete all attribs from Anchor, except an href, double quoted.
$str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", '', $str);
// Delete all img tags
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?javascript[[:punct:]]*\"?[^>]*>", '', $str);
// Delete javascript code from a href tags -- Zhen-Xjell @ http://nukecops.com
$tmp = "";
while (ereg("<(/?[[:alpha:]]*)[[:space:]]*([^>]*)>",$str,$reg)) {
$i = strpos($str,$reg[0]);
$l = strlen($reg[0]);
if ($reg[1][0] == "/") $tag = strtolower(substr($reg[1],1));
else $tag = strtolower($reg[1]);
if ($a = $AllowableHTML[$tag])
if ($reg[1][0] == "/") $tag = "</$tag>";
elseif (($a == 1) || ($reg[2] == "")) $tag = "<$tag>";
else {
# Place here the double quote fix function.
$attrb_list=delQuotes($reg[2]);
// A VER
$attrb_list = ereg_replace("&","&",$attrb_list);
$tag = "<$tag" . $attrb_list . ">";
} # Attribs in tag allowed
else $tag = "";
$tmp .= substr($str,0,$i) . $tag;
$str = substr($str,$i+$l);
}
$str = $tmp . $str;
return $str;
exit;
/* Squash PHP tags unconditionally */
$str = ereg_replace("<\?","",$str);
return $str;
}
function filter_text($Message, $strip="") {
global $EditedMessage;
check_words($Message);
$EditedMessage=check_html($EditedMessage, $strip);
return ($EditedMessage);
}
function removecrlf($str) {
// Function for Security Fix by Ulf Harnhammar, VSU Security 2002
// Looks like I don't have so bad track record of security reports as Ulf believes
// He decided to not contact me, bu
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
