its a sprawling oscommerce based largely bespoke pile of code

Hi all

I have a client (in the day job) that has some unkown SQLi vulnerabilities.

I have access to the source code etc, but its massive

Anyone recommend any tools (FOSS) that will help me to track down these vulnerabilites?

I know this is probably script kiddie territory so if you don't want to disclose in the open a PM would be appreciated

s3 with a skin basically

https://forums.aws.amazon.com/thread.jspa?messageID=233344

sorry to clarify - cos im using it all over the place i put the JS into a PHP function so I can just go
<?php echo filterBox()?>
<table class="filterable>...etc

nice way of breathing life into legacy stuff

got a massive table of data

can't be arsed to create some kind of ajax blah blah blah autocomplete search thing

check this out

http://kobikobi.wordpress.com/2008/09/15/using-jquery-to-filter-table-rows/

basically just apply the class="filterable" to your table and then dump this in - uses jquery so assumes you are including that in the head etc

function filterBox(){
    $return=<<<NOWDOC
<script type="text/javascript">
$(document).ready(function(){
    //add index column with all content.
    $(".filterable tr:has(td)").each(function(){
        var t = $(this).text().toLowerCase(); //all row text
        $("<td class='indexColumn'></td>")
        .hide().text(t).appendTo(this);
    });//each tr
    $("#FilterTextBox").keyup(function(){
        var s = $(this).val().toLowerCase().split(" ");
        //show all rows.
        $(".filterable tr:hidden").show();
        $.each(s, function(){
            $(".filterable tr:visible .indexColumn:not(:contains('"
                + this + "'))").parent().hide();
        });//each
    });//key up.
});//document.ready
</script>
<h1><b>Jquery Filter Box:</b><input id="FilterTextBox"/></h1>
NOWDOC;
    return $return;
}

nice, apachetop never heard of it

looks useful, will get that set up tomorrow

just noticing that you hardly ever talk about coding any more

v nice

http://images.neaturl.net/mj/Robots_Cant_Read_Captchas.png

nice

http://www.google.com/search?client=ubuntu&channel=fs&q=PHP+compilation+tip%3A+Can%27t+Find+mysql_config&ie=utf-8&oe=utf-8

just thought i woudl mention this awesome app i stumbled across trying to figure out how i was going to manage the GB of ebooks i've managed to procure

calibre

written in python, a little on the buggy side but really slick, powerful and cross platform

its actually inspired me to learn python

check it out
http://calibre-ebook.com/

p.s. I bought a booken cybook gen 3

very good, but dont sit on it when you go to bed with the lights out - expensive mistake

you know what - i turned my error reporting up to the max, and then used a custom error handler to turn even the slightest error into an exception

that then gives me a detailed stack trace so I can easily figure out whats gone wrong

since then, although im fixing fairly nit picking notices etc, the code is proving to be a lot more stable and takes less time to fix bigger errors

yeah thats cool

generally use less on the command line for this kind of thing

any great ideas on how you could get some basic searching going on there as well - don't generally want to page through a zillion lines

I suppose just

while(!preg_match($pattern, $data)){ 
$start+=512
fseek($fp, $start);
fread($fp, $chunksize);
}

would do it

cheers

yeah I abandonded this in the end..

easier to just set up curl slaves elsewhere and use them

this was bs actually - best just remove it..