mixxoys Posted November 2, 2006 Share Posted November 2, 2006 Is there any way that you can view the raw php on a site, is there a download manager that i can download it, is there a browser/firefox plugin that views it just as text? Quote Link to comment Share on other sites More sharing options...
Sparda Posted November 2, 2006 Share Posted November 2, 2006 No, the server will never send you the raw php unless, for some reason, the php module fails to load and, some how, the server continues to run. Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 2, 2006 Author Share Posted November 2, 2006 No way to packet sniff or anything? Quote Link to comment Share on other sites More sharing options...
Sparda Posted November 2, 2006 Share Posted November 2, 2006 Packet sniffing dose nothing if the server never sends it... Quote Link to comment Share on other sites More sharing options...
Guest Posted November 2, 2006 Share Posted November 2, 2006 mixxoys it sounds like you are a little confused as to what php is, PHP is a scripting langauge that is executed on the server side. This means that the php code never needs to be sent to you. So that means that you could do all the packet sniffing in the world and you still wont get the php code as it is never leaving the server that is executing it. Quote Link to comment Share on other sites More sharing options...
SomeoneE1se Posted November 2, 2006 Share Posted November 2, 2006 how about ~# wget index.php Quote Link to comment Share on other sites More sharing options...
Guest Posted November 2, 2006 Share Posted November 2, 2006 what part of server side dont you understand? Quote Link to comment Share on other sites More sharing options...
operat0r_001 Posted November 2, 2006 Share Posted November 2, 2006 how about ~# wget index.php try looking for .... '.old', '.bak', '~', '.orig', '.backup', '.bad' speaking of enumeration I just ripped some webinspect enum and ported it to nikto http://rmccurdy.com/scripts/ nikto_extra_scans.db Quote Link to comment Share on other sites More sharing options...
jool Posted November 2, 2006 Share Posted November 2, 2006 You might try thefilename.php~ as well since that is the name of the backup emacs does automatically if not told otherwise. But unless someone has been sloppy and left a guessable file that isn't interpreted it is impossible. Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 2, 2006 Author Share Posted November 2, 2006 It is sloppy, and guessable. Quote Link to comment Share on other sites More sharing options...
psychoaliendog Posted November 2, 2006 Share Posted November 2, 2006 You could ftp into the site! :pirate: Maybe scp, or sftp. Once in you could create a page like this one http://www.php.net/source.php?url=/source.php. Then you can have access to the source of any page instantly. Quote Link to comment Share on other sites More sharing options...
cooper Posted November 2, 2006 Share Posted November 2, 2006 Don't forget .<originalname>.swp for the vi backup. No, if you want to have a try at this, try using Google Code Search. Seems people have been making a (bad) habit of zipping up a backup of their site... on their site. :? There was search link someone posted to either Digg or Slashdot shortly after GCS launched that would search for the database passwords in these files. After that, all you need is some overworked, underpaid admin who forgot to firewall off the database server port... Quote Link to comment Share on other sites More sharing options...
Guest Posted November 2, 2006 Share Posted November 2, 2006 You could ftp into the site! :pirate: Now you are assuming that the site is setup so you can brows there ftp server. Maybe scp, or sftp. Once in you could create a page like this one http://www.php.net/source.php?url=/source.php. Then you can have access to the source of any page instantly. On e again you are assuming the sites have very bad security. Like any site is going to let you upload anything to them from there ftp server. More over you should of at least said what is inside source.php :/ you cant just name a file that and it magically works. So i would assume the file you are uploading is going to have this code in it <?php if(isset($_GET['url'])) { header('Content-Type: text/plain'); $page = $_GET['url']; $info = file_get_contents($page); header('Content-Type: text/html'); echo $info; } Now this brings you to the other question, if you can ftp into the server why upload something why not just download the pages you want? Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 2, 2006 Author Share Posted November 2, 2006 www.blackgoal.com Thats the site. Quote Link to comment Share on other sites More sharing options...
cooper Posted November 2, 2006 Share Posted November 2, 2006 BZZZZZZZZZRT! You took a left when you should've taken a right. Such a shame. What should be said has been said. And this is not a cracking forum. Update Just looked over it and it's one of those puzzle sites. At least the first one was _DEAD_ easy. Just try harder. - Unlocked - Quote Link to comment Share on other sites More sharing options...
moonlit Posted November 2, 2006 Share Posted November 2, 2006 "Closing time, you don't have to go home but you can't stay here..." Also unlocked... :S Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 2, 2006 Author Share Posted November 2, 2006 No haha, ive got it all, me and my friends are kinda competing on finding the last code, no hints, we just gotta crack the php. Quote Link to comment Share on other sites More sharing options...
n3xg3n Posted November 5, 2006 Share Posted November 5, 2006 if you can inject code somewhere on the server, inject: show_source('/loc/of/file.php'); Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 5, 2006 Author Share Posted November 5, 2006 Anyway to be able to view the files on the server? Quote Link to comment Share on other sites More sharing options...
softdel Posted November 5, 2006 Share Posted November 5, 2006 Ask the bloody server admin for a Root (or reseller) user name and password... And if it has not already been done, ask him to install an FTP server. Quote Link to comment Share on other sites More sharing options...
mixxoys Posted November 5, 2006 Author Share Posted November 5, 2006 Thats not the point. Quote Link to comment Share on other sites More sharing options...
operat0r_001 Posted November 6, 2006 Share Posted November 6, 2006 You might try thefilename.php~ as well since that is the name of the backup emacs does automatically if not told otherwise. But unless someone has been sloppy and left a guessable file that isn't interpreted it is impossible. you can't read I posted '~' ;0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.