Re: WinBTC.online - Automated Doubler with MAX 0.05 BTC for Longevity
Found this web-site, and I could see security holes in the first minute browsing it.
I have just made a full vulnerability test on your web-site - https://winbtc.online
Yours is in a pretty bad shape at the moment.
Let me show you what I have found:
SQL Injection
"NOTE! Security issue like this can allow an attacker to gain access to your MySQL Database, and access private information."
Vulnerable input field: "Enter Your BTC Address Here"
The Field: http://puu.sh/oP9xK/96a40e6f5c.png
If you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:
The Error:
Want to test your-self?
Enter: btcadd=1'%22&r=&yn=submit into the "Enter Your BTC Address Here" field.
There are 1 more input field, which is Vulnerable to this same Security hole.
Vulnerable input field: "Enter Your BTC Address Here"
Location: https://winbtc.online/lookup.php
The Field: http://puu.sh/oPaff/7cada1149a.png
Want to test your-self?
If you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:
The Error:
Another Big Programming "Carelesness"
System takes queries from Database using this file: "https://winbtc.online/getuser.php".
NOW, you can just enter what ever "Depositer ID" you like, and you have access to Investor Info. However Database looks primitive.
Want to test your-self?
Add this to the link I gave you above - "?=1", and you will see the database records.
Like this: https://winbtc.online/getuser.php?q=1
And you will see:
This happens because the digit in the link is actually an ID from the Database, which lets you select which ever database record you want.
You can play around just by changing the digit.
Example:
https://winbtc.online/getuser.php?q=5
Cross-Site Scripting
"Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them."
I found this on multiple pages, however I will show you 1 example, otherwise the report will be too long.
One of the pages affected by this is: https://winbtc.online/faq.php
You can simply change this link to (example): https://winbtc.online/faq.php/%22onmouseover='prompt%28940945%29'bad=%22%3E
And now when you mouse-over everywhere on the page, the injected JS will activate. In this case, when you mouse-over anything, you will get a simple JavaScript Popup Message, to prove the concept is real and working.
Preview:
Sorry for the long report,
Thank you,
Devsoft.
I have just made a full vulnerability test on your web-site - https://winbtc.online
Yours is in a pretty bad shape at the moment.
Let me show you what I have found:
SQL Injection
"NOTE! Security issue like this can allow an attacker to gain access to your MySQL Database, and access private information."
Vulnerable input field: "Enter Your BTC Address Here"
The Field: http://puu.sh/oP9xK/96a40e6f5c.png
If you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:
The Error:
Code:
Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/lng6ojtci/public_html/winbtc.online/index.php on line 185
Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/lng6ojtci/public_html/winbtc.online/index.php on line 199
Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/lng6ojtci/public_html/winbtc.online/index.php on line 199
Want to test your-self?
Enter: btcadd=1'%22&r=&yn=submit into the "Enter Your BTC Address Here" field.
There are 1 more input field, which is Vulnerable to this same Security hole.
Vulnerable input field: "Enter Your BTC Address Here"
Location: https://winbtc.online/lookup.php
The Field: http://puu.sh/oPaff/7cada1149a.png
Want to test your-self?
If you enter this: btcadd=1'%22&r=&yn=submit in this field, you will get a MySQL Error:
The Error:
Code:
Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/lng6ojtci/public_html/winbtc.online/getuser.php on line 170
Another Big Programming "Carelesness"
System takes queries from Database using this file: "https://winbtc.online/getuser.php".
NOW, you can just enter what ever "Depositer ID" you like, and you have access to Investor Info. However Database looks primitive.
Want to test your-self?
Add this to the link I gave you above - "?=1", and you will see the database records.
Like this: https://winbtc.online/getuser.php?q=1
And you will see:
This happens because the digit in the link is actually an ID from the Database, which lets you select which ever database record you want.
You can play around just by changing the digit.
Example:
https://winbtc.online/getuser.php?q=5
Cross-Site Scripting
"Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them."
I found this on multiple pages, however I will show you 1 example, otherwise the report will be too long.
One of the pages affected by this is: https://winbtc.online/faq.php
You can simply change this link to (example): https://winbtc.online/faq.php/%22onmouseover='prompt%28940945%29'bad=%22%3E
And now when you mouse-over everywhere on the page, the injected JS will activate. In this case, when you mouse-over anything, you will get a simple JavaScript Popup Message, to prove the concept is real and working.
Preview:
Sorry for the long report,
Thank you,
Devsoft.