AKB Forums

Go Back   AKB Forums > Technical sections > Software Security
Home Register Blogs FAQ Members List Calendar Downloads Arcade Mark Forums Read

Software Security Discussing software security algorithms, tricks, vulnerabilities

Troubles when posting message? Click here! :: Проблемы с отправлением сообщения? Нажмите сюда!

Reply
 
LinkBack Thread Tools Display Modes
Old Jul 26, 2002, 21:52   #1
¡no pasaran!
 
dolphin's Avatar
 
Join Date: Mar 2002
Location: localhost
Posts: 538
Rep Power: 7
Reputation: 23
Send a message via ICQ to dolphin
Thumbs down / ( P L A G I A T ) /x

Itak, nash dorogouvajaemyj Eddi, kotoryj tak dolgo i strastno obvinjal menja v plagiate idei sozdanija svoego url-based proxy scripta sam stal avtorom samogo protivnogo plagiata, kotoryj mne prixodilos' videt'. Pri etom o suschestvovanii idei etogo scripta uje dva goda znal naprimer zombie.

Samoe interesnoe, eto sposob maskirovki: dobavlenie mnogochislennyx probelov (daje v regexpy) i izmenenie imen (dovol'no somnitel'noe) peremennyx na raznocase-nye (izvestno, chto v jazykax, s case sensitive sintaxisom izbegajut peremennyx tipa nMorePos, tipichnyx dlja ne case sensitive Pascala, t.k. v posledstvii legko sputat' ee naprimer s nMorepos. V C namnogo bolee rasprotranennyj vid peremennyx: n_more_pos).

Zamechu takje, chto Eddi otkazalsja predostavit' isxodniki svoego AKB browsera dlja obschego oznakomlenija. V glaza srazu brosilos' to, chto novyj script Eddi ispol'zoval apache handler -y, ideja ispol'zovanija kotoryx javno prinadlejala mne.

Dlja sravnenija privoju zdes' kusok koda a takje sootvetstvie imen peremennyx.

Eddi:
Code:
	if ( $isChunked == 1 )	{	// data is chunked, we should read the chunk lengthes and give un-chunked data to the browser
		if ( $nChunkSize == $nReadSize )	{
			$sChunk = preg_replace( '/^ ([^;]+) (.*) /isx', "\\1",
									fgets( $fpURL, $nBufSize ) );
			$sChunk = rtrim( $sChunk );
			if ( $sChunk == "" )	{
				continue;
			}

			$nChunkSize = hexdec( $sChunk );
			$nReadSize = 0;

			if ( $nChunkSize == 0 )	{
				break;
			}
		}

		if ( $nChunkSize - $nReadSize < $nBufSize )	{
			$nSize = $nChunkSize - $nReadSize;
		}
	}
	elseif ( $nContentLength != 0 )	{	// content-length is give - don't read more than needed
		if ( $nContentLength == $nReadSize )	{
			break;
		}

		if ( $nContentLength - $nReadSize < $nBufSize )	{
			$nSize = $nContentLength - $nReadSize;
		}
	}

	if ( $isHtml == 1 )	{
		$sTemp = fgets( $fpURL, $nSize );
	}
	else	{
		$sTemp = fread( $fpURL, $nSize );
	}
	$sBuffer .= $sTemp;
	$nReadSize += strlen( $sTemp );
DolphiN:
Code:
    if($clen) {

	if($downloaded >= $clen) break;
	    else if($clen - $downloaded > $buffsize) $size = $buffsize;
	        else $size = $clen - $downloaded;

        $buff = fread($fp, $size);
        $downloaded += strlen($buff);
    }
    elseif($chunked) {
	if($downloaded == $chunk) {
	    $chunk = hexdec(fgets($fp, 1024));
	    if(!$chunk) break;
	    $downloaded = 0;
	    $buff='';
	}
	else {
	    if($chunk - $downloaded > $buffsize) $size = $buffsize;
	        else $size = $chunk - $downloaded;

    	    $buff = fread($fp, $size);
    	    $downloaded += strlen($buff);
	    if($downloaded == $chunk) {
		fgets($fp, 128);
	    }
	}
    }
    else {
	$buff = fread($fp, 128);
    }

------------------------------------------------------
sootvetstvie peremennyx:
------------------------------------------------------
Eddi                                    Dolphin

$nChunkSize                        $chunk
$nSize                                 $size
$nContentLength                   $clen
$nReadSize                          $dowloaded
$nBufSize                             $buffsize

.....
Ljudjam, znakomym s php ili s ljubym jazykom programmirovanija budet neslojno najri "ochen' poxojie" bloki koda i peremennye klony.

BEZ KOMMENTARIAEV
__________________
[ que fors aus ne le sot riens nee ]
dolphin is offline   Reply With Quote Quote selected
Old Jul 26, 2002, 22:15   #2
Moderator
 
Gates's Avatar
 
Join Date: Feb 2002
Location: Armenia
Posts: 5,181
Rep Power: 8
Reputation: 237
Send a message via ICQ to Gates
Post

DolphiN, dorogoj zachem tak perejivaesh'?

Napisat' chto nibud' ne tak uj slojno, gorazdo slojnej pridumat' chto pisat' Pomoemu ti ranshe Eddi dodumalsya napisat' webproxy.
I krome togo sejchas nagruzka s tvoego proxy spadjot, i on normal'no zarabotaet.
__________________
Gates is offline   Reply With Quote Quote selected
Old Jul 26, 2002, 22:35   #3
killa-hilla
 
Join Date: Mar 2002
Location: Yaktown
Posts: 383
Rep Power: 7
Reputation: 10
Send a message via ICQ to Yaki
Thumbs down

Es general-i TOPIC um el em asel hima el em asum Gde Je <<Thank 2 Dolphin>> or smth else!!!!!
__________________
Live Free or die...
Yaki is offline   Reply With Quote Quote selected
Old Jul 26, 2002, 22:52   #4
Студент
 
Join Date: Jun 2002
Location: Yerevan
Posts: 258
Rep Power: 7
Reputation: 10
Post

A teper' poslushaj menya mal'chik. Ya dolgo terpel tvoe ...[edited by admin: deleted]!

Vo pervyx v plagiate sozdaniya proxy ya tebya ne obvinyal, a obvinyal v zloupotreblenii svoej "vlast'yu" i v plagiate idei dat' internet freenetu. Navernoe mnogouvagaemoj publike budet nebezinteresno uznat' kak ty po-xamski udalil site eddi.wizard.am na kotoryj ya postavil svoj staryj script i v tot ge den' opublikoval "svoyu" ideyu.

Vo vtoryx source kotoryj ty tol'ko chto ukral, za chto ya tebe esche golovu otorvu kogda priedu cherez paru dnej, napisan mnoyu s nul'ya. I tvoj idiotskij kod ya smotrel tol'ko chtoby videt' vse gluposti i oshibki kotorye ty tam sdelal i ne povtoryat' ix. Bud' ty xot' nemnogo bolee kompetentym programistom, kotoromu slezy glaza ne mutili by, ponyal by eto sam.

Ideya "handlerov apache" pod kotorymi ty neizvestno chto ponimaesh', no skoree vsego addressnuyu strochku vzyata s http://www.anonymizer.com -a i s odnogo iz proektov http://www.sourceforge.net -a, nadeyus' i eto toge ty ne delal. I regexp ty vidno ploxo ponimaesh', a pro syntax peremennyx vidno ni odnoj stat'i ne chital.

Tvoj site ge s ukradennym source-om ya pozabochus' chtoby zakryli, gal' v Armenii netu stat'i pro eto, a to ya by o tebe pozabotilsya by.

P.S. Nauchis' uvageniyu mal'chik.
__________________
http://www.d-brane.com
Eddi is offline   Reply With Quote Quote selected
Old Jul 26, 2002, 23:13   #5
killa-hilla
 
Join Date: Mar 2002
Location: Yaktown
Posts: 383
Rep Power: 7
Reputation: 10
Send a message via ICQ to Yaki
Angry

Easy,Easy MAN!!!!!!!!
Don't transform Discussion to the WAR!!!
__________________
Live Free or die...
Yaki is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 04:38   #6
¡no pasaran!
 
dolphin's Avatar
 
Join Date: Mar 2002
Location: localhost
Posts: 538
Rep Power: 7
Reputation: 23
Send a message via ICQ to dolphin
Thumbs down

"Ideya "handlerov apache" pod kotorymi ty neizvestno chto ponimaesh', no skoree vsego addressnuyu strochku "

mne bol'she nechego dobavit'. Esli chelovek ne znaet chto takoe direktivy Action i SetHandler v konfiguracii apache, blagodarja kotorym mojno obrabatyvat' zaprosy v ljuboj "nestandatrtnoj" forme, i nazyvaet eto addresnoj strochkoj, ne mog napisat' etot script samostojatel'no.
Kak raz v anonimizere handlery ne ispol'zujutsja.

Ljudi, kotorye razbirajutsja vo vsem etom menja pojmut.
__________________
[ que fors aus ne le sot riens nee ]
dolphin is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 04:55   #7
Студент
 
Join Date: Jun 2002
Location: Yerevan
Posts: 258
Rep Power: 7
Reputation: 10
Post

Solnyshko, nikakie takie direktivy ne ispol'zovalis'
I ty vidno ploxo razbiraesh'sya chto takoe programmist i system administrator.
Dlya info - ispol'zovalas' direktiva AliasMatch, i ni malejshego slova o znamenityx "handlerax apache-a" slova ne bylo.

Tak chto otvali.
__________________
http://www.d-brane.com
Eddi is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 05:21   #8
¡no pasaran!
 
dolphin's Avatar
 
Join Date: Mar 2002
Location: localhost
Posts: 538
Rep Power: 7
Reputation: 23
Send a message via ICQ to dolphin
Thumbs down

loool

pravil'no!! a v <AliasMatch> chto sidit?

chem ty svjazyvaesh' obrabotku etogo samogo dolbannnogo aliasa s scriptom?

vse, na etom dialog ischerpan! Vse i tak jasno...
__________________
[ que fors aus ne le sot riens nee ]
dolphin is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 05:28   #9
Студент
 
Join Date: Jun 2002
Location: Yerevan
Posts: 258
Rep Power: 7
Reputation: 10
Post

Dlya osobo odarennyx esche raz..
AliasMatch browserurl/(.*) whateverplace/xxxxx.php

Ya rad chto tebe vse yasno solnyshko No sheyu ya tebe vse ravno svernu za vorovstvo

Have fun
__________________
http://www.d-brane.com
Eddi is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 05:36   #10
¡no pasaran!
 
dolphin's Avatar
 
Join Date: Mar 2002
Location: localhost
Posts: 538
Rep Power: 7
Reputation: 23
Send a message via ICQ to dolphin
Post

loool

ax vot ty o chem?!! ha-ha! a na / takoj alias ty kak postavish, a? ))

nu-nu.. valjaj. ne melkovat-li ty?

da, i snachala razberis', kto u kogo i chto ukral\.+
__________________
[ que fors aus ne le sot riens nee ]
dolphin is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 05:45   #11
Студент
 
Join Date: Jun 2002
Location: Yerevan
Posts: 258
Rep Power: 7
Reputation: 10
Post

I opyat' dlya nashix osobo odarennyx.
Dlya / est' takoj file nazyvaetsya .htaccess, slyshal da pro nego, "krutoj" sysadmin.

Interesno zachem ya nashim osobo odarennym vseznajkam eto obyasnyayu?
Sledi za svoim leksikonom solnyshko, ya s toboj v igry igrat' ne budu.
__________________
http://www.d-brane.com
Eddi is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 05:55   #12
Консервативный Демагог
 
VX's Avatar
 
Join Date: Jan 2002
Location: Кавказская Албания
Posts: 889
Rep Power: 7
Reputation: 10
Post

Eddi ne torj sysadminov
Tak kak ti nikaomu sysadminu v podmetki ne godishya molchi, ne zabivay sto dlya sysadminov ti obicniy "stabskiy" programmer
tak cto

Da i interesno kak ti Dolphinu budesh golowu snosit' eto toje interesno.

I NAKONEC ESLI ETOT GNUSNIY BAZAR NE PREKRATISTYA MNE PRIDETSYA PRINYAT' BOLEE RE****TEL'NIE MERY PO EGU PREKRSAHENIU
__________________
Праздник к нам приходит...

|^^^^^^^^^'''^\| ||\__
| ВОДКА-ВОДКА | ||','''|'''''''\_____,_
| _..... _ | ||_ _|'__|_____||.........| |
'(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)*
VX is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 06:59   #13
Младенец
 
Join Date: Apr 2002
Location: Recycle Bin
Posts: 30
Rep Power: 0
Reputation: 10
Send a message via ICQ to TankisT
Talking

WELLWELLWELL
Eddi... gde to ya tvoy nick uzhe videl..ne ti li sluchayno na paru s IGOR-em delal saytik a lya freenet.am/~igor
vistavlyaya tam raznie openpassi vpromezhutkami s dead linkami ?
VX dal praveln'iy sovet.... ne lez'..ubyot
mozhet ne v IRL no v virtuale tochno i ya emu pomogu znaesh pochemu ?
potomu chto sdelal plagiat sidi i molchi v tryapochku i ne ripaysya
pomnish kak v tom fil'me... ?
zima..vorobushek skakal skakal...zamyorz... svalilsya na zemlju...
mimo shla korova..nasrala ( pardon)
tot v der'me sogrelsya... pochuvstvoval chto uzhe otogrelsya i zachirikal... mimo shla koshka uslishala..podoshla razgrebla der'mo i syela vorobushka...
moral'
1. ne tot debe vrag kto na tebya nasral
2. ne tot tebe drug kto tebya iz der'ma bitashil
3. kogda otogrelsya bud' dobr NE CHIRIKAY!
__________________
Здесь надо написать очень умную мыслю.
TankisT is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 07:05   #14
Консервативный Демагог
 
VX's Avatar
 
Join Date: Jan 2002
Location: Кавказская Албания
Posts: 889
Rep Power: 7
Reputation: 10
Post

Brawo Tankist!!!
__________________
Праздник к нам приходит...

|^^^^^^^^^'''^\| ||\__
| ВОДКА-ВОДКА | ||','''|'''''''\_____,_
| _..... _ | ||_ _|'__|_____||.........| |
'(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)*
VX is offline   Reply With Quote Quote selected
Old Jul 27, 2002, 07:45   #15
Студент
 
Join Date: Mar 2002
Location: [ Surrealistical World ]
Posts: 312
Rep Power: 7
Reputation: 10
Post

Everything I'd write is written already.

VX, Tank and Dolphin... I'm with ya. [stranniy team poluchaetsya... Mne nravitsya.]
I hate those who read sources of others... DAMN. Those aren't programmers. <-- Watch your brain man, instead of watching sources...
Shame on you.

EDDI: Aren't you the guy who doesn't know that Matrix is the 2D array??
Code is DEFINITELY stolen. [People jan, ya zhe govoril, OPENSOURCE SUX!! j/k]

Regards,
Silver::
__________________
::Against the crowd.
Rust is offline   Reply With Quote Quote selected
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 00:27.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
This board was founded on September 29, 2001
Powered by Viper Internet

Affordable Web Hosting | ParevNet

Buy text link