@MeganC, to be clearer, looking at it from an information-science perspective:
- What is my password to this forum?
- How many times do you think you would need to type in random characters before you worked it out?
Xenforo uses a SHA256 hashed password. It's not right now in my skillset but from what I am reading I can obtain the hashed passwords 1) during logon authentication and 2) by retrieving all of the hashes in use from the instance of Xenforo in use by BF.
There are about 2640 members registered on BF. If I obtain all of the hashes then there is a 1/2640 chance of my getting yours the first time I try.
If I only obtain the hashes for the active sessions then the odds are much better. Like if ten people are logged in and you're one of them my odds of getting your hash right the first time I try to use it is 1/10.
The IP address for BF is 192.254.235.41 with a network name of 192-254-235-41.unifiedlayer.com
There are several hostnames associated with that IP:
- www.scripter.boiselinks.com
- 192-254-235-41.unifiedlayer.com
- luckybastards-mc.com
- www.garyspc.boiselinks.com
- www.luckybastards-mc.boiselinks.com
- www.imnaha.boiselinks.com
- hostgator.com
- spregle.com
- garyspc.com
- imnaha.net
- codebasher.com
- www.spregle.boiselinks.com
The site does not use secure protocols that would complicate exploitation of known PHP vulnerabilities. Next is to dump the website database and find the hashes in the user table.
There would be no need for me to type in random characters to obtain access to your account. I'd exploit the design of the site to obtain your hash and then use that to reset your password to something I could use.
Because that's how the site was designed.
Likewise, DNA isn't exactly random. The four nucleotides combine to create just four base pairs: AT, TA, CG, GC.
Valid sequences are composed of valid base pairs. But with the occasional flaw. Just like PHP.
And just like PHP the DNA code very much indicates the hand of a designer or creator.
Now you have me interested in learning more about Xenforo, MySQL, and PHP.
Last edited: