Messing with Sinisterly's mod_rewrite.

Messing with Sinisterly's mod_rewrite. - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Messing with Sinisterly's mod_rewrite. (/Thread-Messing-with-Sinisterly-s-mod-rewrite)

Messing with Sinisterly's mod_rewrite. - Misha- - 02-19-2015

I noticed that this website is using mod_rewrite in a nice fashion, so I decided to mess with it.
Here's how to read threads which you shouldn't be able to read.

First, we need the id of a thread which we can't access.
https://sinister.li/Thread-Bidroop-project

Spoiler:

How you get the ID is up to you.

Now, since we know the forum is running MyBB, we know that the path for showing a thread is http://thisisanexampleorisit.com/showthread.php?tid=1
So instead of using Sinisterly's mod_rewritten bullshit (https://sinister.li/Thread-Bidroop-project), we're going to do it the normal way.
https://sinister.li/showthread.php?tid=10007
Still can't read it though.

Now we use some old MyBB trickery, replacing showthread.php with printthread.php
https://sinister.li/printthread.php?tid=10007
And now we can read it.

Spoiler:

I actually wrote an addon for firefox to automatically replace showthread with printthread lol.

Anyway, that's all for this shitty, but fun tutorial.
Something you may want to try is just kinda bruteforcing thread ids and looking for fun stuff.
Example:

Code:
https://www.sinister.ly/showthread.php?tid=10001
https://www.sinister.ly/showthread.php?tid=10002
https://www.sinister.ly/showthread.php?tid=10003
https://www.sinister.ly/showthread.php?tid=10004

etc.

RE: Messing with Sinisterly's mod_rewrite. - lux - 02-19-2015

Ain't even mad. Good find.

It's nice to see users using their initiative.

RE: Messing with Sinisterly's mod_rewrite. - Misha- - 02-19-2015

(02-19-2015, 11:49 PM)Lux Wrote: Ain't even mad. Good find.

It's nice to see users using their initiative.

Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

RE: Messing with Sinisterly's mod_rewrite. - lux - 02-19-2015

(02-19-2015, 11:53 PM)Misha- Wrote: Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

Whilst it does kind of bypass the point, it was a good find. This would be a thread which belonged in a restricted sub-forum, so it cannot impact the userbase in which it relates to, unfortunately with you being a new member that's unlikely to happen.

But still, have a plus rep and a fedora tip.

Spoiler:

RE: Messing with Sinisterly's mod_rewrite. - Misha- - 02-20-2015

(02-19-2015, 11:58 PM)Lux Wrote: Whilst it does kind of bypass the point, it was a good find. This would be a thread which belonged in a restricted sub-forum, so it cannot impact the userbase in which it relates to, unfortunately with you being a new member that's unlikely to happen.

But still, have a plus rep and a fedora tip.

Spoiler:

I doubt i'm gonna sell any products, so I don't think i'll really need the rep, but thanks.
It's the thought that counts.

RE: Messing with Sinisterly's mod_rewrite. - Misha- - 02-20-2015

Another way of bypassing it :

Go here.
https://sinister.li/misc.php?action=syndication

Choose which forums you want to look in (you can select several)

Spoiler:

Then put as much as you want on limit, i'll go with 50.
Now click generate link, which gives me this:
https://sinister.li/syndication.php?fid=296,297&limit=50

Now you can visit that and read the content of the threads.
Or if you want to do it faster, just edit the forum ids in the url.
(These - fid=296,297)

RE: Messing with Sinisterly's mod_rewrite. - Lain - 02-21-2015

mod_rewrite? nginx? What is this madness?

This is a nice find though, thanks for sharing.

RE: Messing with Sinisterly's mod_rewrite. - Eclipse - 02-21-2015

(02-19-2015, 11:53 PM)Misha- Wrote: Ah, good to hear.
There was always the thought in the back of my mind that I could get banned for this thread.

Naa, we welcome users taking the initiative to find vulnerabilities. It gives @Oni the chance to fix them. Ideally, this should have been posted in a restricted sub-forum, but it's not that big of a deal.

RE: Messing with Sinisterly's mod_rewrite. - Oni - 01-24-2016

Bumping this, as I need to fix this still.

Also:
[Image: unmizK0.png]