So how do people work those T35 password image exploits?

3 May 2010, 7:59 PM#1

Just curious..I wouldnt mind dipping into the persons password dump since I see his t35

Edit:
Looks like it tricks the server into thinking the request is from pixel.quantserve.com which allows it to be ran into the pages html...hm..

4 May 2010, 1:13 AM#2

It is called an Flw and is pure PHP scripting.
You can not 'Dip into his password list' unless you guess his Password list URL, Since it us purly PHP.

4 May 2010, 1:23 AM#3

!Marvelous! wrote:
It is called an Flw and is pure PHP scripting.
You can not 'Dip into his password list' unless you guess his Password list URL, Since it us purly PHP.

All you have to do is figure out where it is being sent to =P I have dipped into plenty of password lists in the past. and I have dipped into one of these ones before.

I am simply asking how they are made.

4 May 2010, 1:47 AM#4

Right, and you can not see where they are going because it is PHP.

4 May 2010, 2:07 AM#5

!Marvelous! wrote:
Right, and you can not see where they are going because it is PHP.

Page source or look at the link it says it is from.

4 May 2010, 2:21 AM#6

You can NOT see PHP script for THIS reason...
You can look at where it says it is from but that still leaves you guessing the .txt file name.
Unless you plan to Bruteforce guess the page title then you are SOL.

4 May 2010, 2:27 AM#7

!Marvelous! wrote:
You can NOT see PHP script for THIS reason...
You can look at where it says it is from but that still leaves you guessing the .txt file name.
Unless you plan to Bruteforce guess the page title then you are SOL.

Thats not exactly hard.

Someone sure hasn't heard of intelitamper

4 May 2010, 7:28 PM#8

If the FLW is on gaiafag.t35.com/login.php, go to gaiafag.t35.com and you might see an index showing where the password is stored.