TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How we broke PHP, hacked Pornhub and earned $20k

327 点作者 KngFant将近 9 年前

11 条评论

krapp将近 9 年前
The takeway:<p><pre><code> You should never use user input on unserialize. Assuming that using an up-to-date PHP version is enough to protect unserialize in such scenarios is a bad idea. Avoid it or use less complex serialization methods like JSON.</code></pre>
评论 #12151005 未加载
评论 #12150237 未加载
评论 #12150249 未加载
评论 #12152053 未加载
danso将近 9 年前
OT: Is there a site that curates these kinds of interestingly detailed hacks? Like Dan Luu does for debugging stories? (<a href="https:&#x2F;&#x2F;github.com&#x2F;danluu&#x2F;debugging-stories" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;danluu&#x2F;debugging-stories</a>)
评论 #12150533 未加载
评论 #12151266 未加载
ckdarby将近 9 年前
That moment when the company you work at is on the front page of Hacker News xD
评论 #12151695 未加载
评论 #12151230 未加载
watbe将近 9 年前
This is an elaborate hack and a very detailed writeup. Thanks for sharing.
ndesaulniers将近 9 年前
&gt; Using a locally compiled version of PHP we scanned for good candidates for stack pivoting gadgets<p>Surprised that worked. Guess they got lucky and either got the comiler+optization flags the same as the PHP binary used, or the release process can create higly similar builds.
评论 #12151516 未加载
aprdm将近 9 年前
Really good write up. Some people are really smart, I wouldn&#x27;t ever be able to do that kind of stuff even after being programming for years.
评论 #12152727 未加载
tjallingt将近 9 年前
I have some questions about two things in the exploit code that puzzled me:<p><pre><code> my $php_code = &#x27;eval(\&#x27; header(&quot;X-Accel-Buffering: no&quot;); header(&quot;Content-Encoding: none&quot;); header(&quot;Connection: close&quot;); error_reporting(0); echo file_get_contents(&quot;&#x2F;etc&#x2F;passwd&quot;); ob_end_flush(); ob_flush(); flush(); \&#x27;);&#x27;; </code></pre> 1. they seem to be using php to code the exploit (solely based on the $ before the variable name) but i&#x27;ve never seen the &#x27;my&#x27; keyword before, what exactly is this language?<p>2. if i understand the exploit correctly they got remote code execution by finding the pointer to &#x27;zend_eval_string&#x27; and then feeding the above code into it. doesn&#x27;t that mean the use of &#x27;eval&#x27; in the code that is being executed is unnecessary?
评论 #12151388 未加载
评论 #12151391 未加载
Phithagoras将近 9 年前
Appears to be experiencing the hug of death. May be quite slow
评论 #12150162 未加载
评论 #12150026 未加载
评论 #12150056 未加载
cloudjacker将近 9 年前
wow<p>From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
评论 #12150178 未加载
评论 #12150181 未加载
评论 #12150157 未加载
评论 #12150391 未加载
评论 #12150179 未加载
fencepost将近 9 年前
So does Pornhub&#x27;s bug bounty program include some number of years of free paid membership along with financial bounties? Kind of a &quot;treat us right and we&#x27;ll let you treat yourself right&quot; kind of thing?
评论 #12150960 未加载
given将近 9 年前
Too bad they didn&#x27;t just go ahead and:<p>&gt; Dump the complete database of pornhub.com including all sensitive user information.<p>And of course leak the data to expose everyone that participates in this nasty business. It is such a sad thing that people are even proud to work at companies like this where humans are not worth more than a big dick or boobs.<p>And then you get around and say that child porn is so horrible. No, <i>all</i> porn is horrible and destroys our families and integrity. How can there be any dignity left if these things are held to be something good?
评论 #12153392 未加载