Thread:
IP Restriction 1.2 + Fake 404/Fake 403/Redirect
Sql injection thread: the one from fury will look up later ;)

Flaw:
With register_globals set to Off use this to get in with an false ip:
http://forum-url.com/index.php?w00t=true
And You are inside!

Fix:
Set register_globals to on or:
In the new htaccess/ip hack by Fury it's fixed by setting $valid / $w00t to false before the ip check so he just adds $valid = "false";
The ip restriction/htaccess hack by Isaiah had this flaw also but I can't find the code anymore ? :S

Then another last word in the mysql query for htaccess many hacks are using something like this:
$_SERVER['PHP_AUTH_USER']
isn't addslasht before the query!!!
Username: ' OR username = '
With this the script could be vuln to sql injections although it would be hard to find any damiging code...
Fix:
This post is NOT any critic on these hacks!!! It's for information and security...

I hope you enjoyed AND/OR learned from this post.

Greets,
Niels AKA Slash.

Real nice work mate, respect, i hope you test the one from fury soon too ;)

pff, you tested the hack of my hack glad you found some security issiues that should be fixed and one's that i fixed already cool mate. Thanks for the effort!