To those using Nuke sites that have been hacked....

I know it's kinda late but you guys should really be using NukeSentinel.

PHPNuke is notorious for having a problem with SQL Injection. Basically, anyone with SQL knowledge can type a SQL statement into a form field, hit submit, and have the command excuted. What type of commands? Well, as some of you have found out they can change login names, passwords, etc.

NukeSentinel monitors and validates SQL requests made through the mainfile.php of PHPNuke. Anyone attempting to SQL inject will automatially have their IP banned and logged in PHPNuke. You also have the option to have the IP banned in the .htaccess file which prevents that IP from accessing any part of you site, not just PHPNuke.

There's also a block that will scroll a list of IP's your Sentinel has banned.

NukeSentinel

well sizupppp psi
__________________________________________

psi

Damn Psi, long time no see. Wassup?


Course, you guys could also just switch to ASP.NET too.

--------------------------------------------
Clowns to the left of me, Jokers to the right, here I am stuck in the middle with you.

Weird, I was actually wondering this morning whether Psi was still alive.

Originally posted by: [RIP]Hydra
Damn Psi, long time no see. Wassup?


Course, you guys could also just switch to ASP.NET too.

OMG Micro$oft whore!

Good Lookout. Thanks!

Originally posted by: [RIP]Hydra
Course, you guys could also just switch to ASP.NET too.

Up to 1.1 sp1 it had some issues too. But, yeah, its ALOT more secure than PHP. Hell, ASP 3.0 is more secure than PHP.

Hhhmmm......

Does anyone here use BlackICE as a firewall?

or u could just not have a phpnuke site.

::Seal Team 6:: #ST-6

Originally posted by: «LivewirÈ»
or u could just not have a phpnuke site.

__________________

Originally posted by: Ishbu904

Originally posted by: «LivewirÈ»
or u could just not have a phpnuke site.

---

so flash is the way to go?
lmao
---------------

It's not limited to just PHP. Any site that uses a database can have SQL injected into it. PHP just happens to have crappy validation. ASP.net is the most secure because of the validation controls it contains.

Easy fix to stop injection through form fields:

everywhere you have a form field go into the code and look for something like:

input type= (there'll be a < in front of it)

somewhere between the the '<' and the '>' add

length=8 in PHP
maxlength=8 in ASP

That will stop the form from processing anything over 8 characters long,which prevents using complete SQL commands.

That just stops one SQL injection type, there are others.

Better yet, don't use PHPNuke at all. There are plenty of other CMS's to use if you don't have time to learn simple html.

fausty busted our hacker hahaha also for php you can make it so only your ip is allowed in the admin section. wish i knew that before. Hey Psi long time no see.

Originally posted by: ..Talon..
Hey Psi long time no see.

Originally posted by: RedÐem0n
Better yet, don't use PHPNuke at all. There are plenty of other CMS's to use if you don't have time to learn simple html.

It's not the CMS, it's the database. The CMS is just the door they use to get to the database. Any CMS, whatever the language, is vunerable. PHP is just easier to get through than others.

Simple HTML is good, but labor intensive when it comes to storing data.XML is alot easier to store data in, but harder to learn.But, once you understand it its not that hard.

That's why ASP.net is often more secure. Alot of it's configuration data is stored in an XML-based file called web.config that's not writeable by the public and a good portion of its coding is run through server side DLL's. There's only one way to SQL inject ASP.net and its easy to prevent from happening.

BTW- hi guys

my guess is psi went to a IT-academy to learn how to "not get hacked"