Is this login exploitable?

[xkr3wx]

iwas wondering if the login on "my website" is exploitable

any one who can find a weakness would be greatley thanked as it will help me "improve" the site

<label for="login-username" class="login-text">Username</label>
<input tabindex="1" type="text" class="login-field" name="credentials.username" id="login-username" value="user" maxlength="32" />
</li>
<li>
<label for="login-password" class="login-text">Password</label>
<input tabindex="2" type="password" class="login-field" name="credentials.password" id="login-password" maxlength="32" />
<input type="submit" value="Log in" class="submit" id="login-submit-button"/>
<a href="#" id="login-submit-new-button" class="new-button" style="margin-left: 0;display:none"><b style="padding-left: 10px; padding-right: 7px; width: 55px">Log in</b><i></i></a>
</li>

[mischief]

weaknesses in forms generally aren't found on the html side, but they can be.

weaknesses are usually found in the code that interprets the form data.

[einari]

If I may continue on the subject, I have small batch of pics I want to share via web and the simplest way to restrict access that I can think of is something along the lines:

Code: Select all

<? if( $_POST['pass'] == 'password' ) {
   echo"";
   } else {
   header( 'Location: login.html');
   } ?>

Rest of the page prints a table with pics

the directory has a blank index.html to prevent unauthorized viewing. I was wondering how big a risk there is that someone can make the page print stuff before headers and therefore get to see the rest of the page, which is plain html. The above is all the php there is. Am I completely out of my mind trying to keep this as simple as possible. (the pics are just random pics of my drunken friends, nothing too sensitive, but still somewhat better not to put them on open directory )

[thedotmaster]

Edit: Oh crap, I just realised. The way you were doing it was fine. Still, this code will work for multiple files etc, as long as you have the second code snippet at the top.

First of all have a simple login form called 'login.php' or something.

Code: Select all

<?php
session_start();
if ($_SESSION['login'] == True) {
  header("location:SomePics.php");
}
if($_GET['login'] == 'true') {
  $user = $_POST['user'];
  $pass = $_POST['pass'];
  if ($user == 'username' && $pass == 'password') {
   $_SESSION['login'] = True;
   header("location:SomePics.php");
  } else {
   header("location:login.php?err=1");
  }
} else {
  if ($_GET['err'] == '1')
   echo "Invalid username and password';
  echo "<form action='login.php?login=true' method='post'><input type='text' name='user'/>";
  echo "<input type='password' name='pass'/>";
  echo "<input type='submit' value='Login' />";
}
?>


Then in 'SomePics.php', start off with:

Code: Select all

<?php
if ($_SESSION['login'] == True)
  header("location:login.php");
?>


This code hasn't been tested but should work. I don't code in PHP often so that may not also be the best nor most secure way to do things. However it will give you some basic security.
Note that anyone can go to the source directory of the images, unless you mess around with .htaccess

Hope this helped

[einari]

Edit: Oh crap, I just realised. The way you were doing it was fine. Still, this code will work for multiple files etc, as long as you have the second code snippet at the top.
8<---Snip---->8

yeah, goal is just to block the casual browser, hence the empty index.html and as little as possible to have anything 'breakable', that's why I didn't want to hassle with sessions etc.
That was the most simple solution I could think of and just wanted to see if I forgot something

Thanks for the input.

Btw. There shouldn't be a way to see the directory index when there is an index-file, or is there?

[thedotmaster]

Edit: Oh crap, I just realised. The way you were doing it was fine. Still, this code will work for multiple files etc, as long as you have the second code snippet at the top.
8<---Snip---->8

yeah, goal is just to block the casual browser, hence the empty index.html and as little as possible to have anything 'breakable', that's why I didn't want to hassle with sessions etc.
That was the most simple solution I could think of and just wanted to see if I forgot something

Thanks for the input.

Btw. There shouldn't be a way to see the directory index when there is an index-file, or is there?

Nope there isn't, but you might want to stick a .htaccess in there, denying people access just in case.