HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Options

A bizarre edge effect on a vanilla forum I saw.

The site has vanilla embedded in wordpress.

if you start a discussion title with the following words you can't open the discussion and get redirected to the discussion topics page.

ls
ping
echo
su
passwd

to name a few.

e.g. discussion title "ping someone"
or
discussion title "ls where are you"
or
discussion title "passwd what are you"
or
discussion title "ps is used for processes"

clicking on any discussions with titles above goes to discussion topics page not the discussion. and you can't open up the discussion. however if you put anything preceding some unix commands - the problem goes away.

e.g. discussion title "x ping someone" - does not create redirect.

yet other unix commands have no impact.
e.g.
bc sh bash od file sudo

I can't replicate on my local host. just curious if anyone has experienced this.

I wonder if it is wordpress related, or host environment related. perhaps a plugin, but I don't think so.

I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

Comments

  • Options
    x00x00 MVP
    edited February 2014

    This is a crude security layer.

    Quite often this is static rules then sever rule such are crude regular expression in .htaccess. Mostly likely a wordpress plugin or advice page implemented this.

    grep is your friend.

  • Options

    sounds plausible. thx x00.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

Sign In or Register to comment.