Эм... только не материтесь сильно, если будет задан тупой вопрос =)
Я пытался взломать мыло... пробовал брут, Си не получилось, так как пользователя давно не было в сети.
Но в google нашел инфу, что юзер посещает портал litsovet.ru . И я решил попробовать этаки так сказать... взломать его. =) Вот...
САЙТ ДЫРЯВЫЙ... это видно сразу! Но я в этих дырах не особо разбираюсь. Плюс ко всему я запустил сканер (от Acunetix). Вот что он нашел(дырки повышеной опастности):
1
Vulnerability description
This script is possibly vulnerable to CRLF injection attacks.

HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly escaping/removing CRLF characters it is possible to alter the HTTP headers structure.
This vulnerability affects /index.php/login.
The impact of this vulnerability
Is it possible for a remote attacker to inject custom HTTP headers. For example, an attacker can inject session cookies or HTML code. This may conduct to vulnerabilities like XSS (cross-site scripting) or session fixation.

Attack details
The POST variable _backurl has been set to %0d%0aSomeCustomInjectedHeader%3Ainjected_by_wvs.


2
Apache version older than 1.3.34
Vulnerability description
This alert has been generated using only banner information. It may be a false positive.

Two potential security issues have been fixed in Apache version 1.3.34:

If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks.
Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method.
Affected Apache versions (up to 1.3.33).

This vulnerability affects Web Server.
The impact of this vulnerability
Multiple. Check references for details about every vulnerability.

Attack details
Current version is Apache/1.3.33


3
Cross Site Scripting(аж 17 штук)


4
Cookie manipulation
Vulnerability description
This script is vulnerable to Cookie manipulation attacks.

By injecting a custom HTTP header or by injecting a META tag is possible to alter the cookies stored in the browser. Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site.
This vulnerability affects /index.php/login.
The impact of this vulnerability
By exploiting this vulnerability, an attacker may conduct a session fixation attack. In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server, thereby eliminating the need to obtain the user's session ID afterwards.

Attack details
The POST variable _backurl has been set to %0d%0aSet-Cookie%3A%20cookiename%3Dcookievalue.
Я через оперу посмотрел свои куки(я зарегился на сайте), там ничего не шифруется, только строчка
sessID(и для нахождения на сайте используется толька она!)... ВОПРОС- можно ли как нибудь подделать эту строчку под другой логин?


И если не сложно, опишите по подробнее, как можно использовать выше перечисленные уязвимости?
Или если кто то найдет другую уязвимость то... =)

Заранее огромное спасибо =)

Так как сканер еще работает, вот что он еще нашел-

Directory traversal (Unix)
Vulnerability description
This script is possibly vulnerable to directory traversal attacks.

Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.
This vulnerability affects /index.php/comment.news.action.
The impact of this vulnerability
By exploiting directory traversal vulnerabilities, attackers step out of the root directory and access files in other directories. As a result, attackers might view restricted files or execute commands, leading to a full compromise of the Web server.

Attack details
The POST variable _classname has been set to ../../../../../../../../etc/passwd%00.

Таких уязвимостей 8 штук