Waraxe IT Security Portal

Panic_Mode · Active user

Once more I want your hep.

First of all we got an sql injectable site where passwords can be retrieved because they are in plaintext and information schema command can be used.

Now to get deeper, i know that in this site there is a db where admin info (passes etc) are stored. These passwords are md5 encrypted not plaintext like the passwords on the table i retrieved.

The thing is, i know only one table name (common guess Razz

), how i can find other tables names too?

And something more, using that:

waraxe · Site admin

Table and column names can be enumerated via information_schema, if mysql version is >= 5.x, or they must be bruteforced or guessed.
This hash you got, it's old-style mysql hash. I will try to crack it.
And by the way, as you can read mysql.user table, then you probably have FILE privileges too. Which means, that you can try to read and write local files (LOAD_FILE and INTO OUTFILE) Wink

Panic_Mode · Active user

y with the information schema i got all the table names for that db.

2 more questions.

i there a way to modify (insert) data to a table?

and can you give me a bit more help for load file and into outfile?

tnx for help

*edit: load_file works. Got the data of /etc/passwd. But can it be more usefull? Maybe uploading a shell or something..

also into outfile doesn't work... magic quotes problem :p

Panic_Mode · Active user

so, seeing that in order to update a table I need an sql injetion in update querry, how can I search for update querries?

Having a form on the website which creates a user and after that you have the option to change some of your information, doesn't show us that there is an update querry behind that?