Bypassing antiviruses is not a big deal now a days, the point is how creative you can get to do that. So here is the technique documented by me (inf0g33k) in a research paper on exploit-db and explained in a video on Securitytube. This technique works by generating a shellcode and executing it directly on the target machine instead of compiling it in an exe file. Backdoor created using this technique was getting caught by some antiviruses because i tested it on virustotal and they send samples to antivirus vendors so now Bruno Cardenas Cyberoff (Luzzell) made a little tweak that can make this technique bypass all the antiviruses again.
In this video , I have demonstrated how to upload shell on a server when .php or .asp extension are not allowed to upload. For any help Contact - k3rn3l@live.in
Like our Facebook Page - http://www.facebook.com/secxplrd
Twitter - http://www.twitter.com/secxplrd Google Plus - http://plus.google.com/100988376390276034135/
Hello Security Explorers , Welcome to Security Explored
This is the next tutorial in Sql Injection Series.
WAF Bypassing Through Sql Injection.
WAF stands for Web Application Firewall.
A web application firewall (WAF) is an appliance, server plugin, or filter that applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-site Scripting (XSS) and SQL Injection. By customizing the rules to your application, many attacks can be identified and blocked. The effort to perform this customization can be significant and needs to be maintained as the application is modified.
Now We are Moving A step Forward in Sql Injection , Advanced SQL injection.
In this Tutorial , I hope that u know basic sql injection .
If don’t then you should read my recent tutorial With a video demonstration.
“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' ORDER BY title ASC' at line 1”
You will get these columns - id,headline,offer,price,contact,id,headline,offer,price,contact,apr,updated,id,title,p1,p2,p3,p4,updated,id,email,name,surname,address,phone,curr_car,year,id,username,password,email
Again I need username and password ,So the columns I am going to dump are “username” , ”password”
Hello Security Explorers, Welcome to Security Explored.
Today I Am going to teach you basic sql injection with a live demo.
As you have already heard of sql injection ..
An often used way to attack the security of an website is to input SQL statements in a web form to get a badly designed website to dump the database content to the attacker - an SQL injection. It's a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
we go this error “Unknown column '12' in 'order clause' ”
This shows that there is no 12th column in the database or there are only 11 columns in the database .
Ok next Step
We got the number of columns in the database , now we need to find the vulnerable column, the column in which we will inject and extract data.
To do that we are going to use “Union all select”
The “order by” , “union all select “ and much more , all are Mysql commands .If you want to learn the real knowledge behind sql injection , you need to learn about MY-SQL.
The “0x3a” between these two columns just put “ : “ ,colon sign such that you can easily distinguish betwwen username and password.
Here we get admin information ,
Username : ishir
Password : ishir123
If you need to get data other than username and password , so you have to choose columns name and table name .
Like ,
http://www.leadacidbatteryinfo.org/newsdetail.php?id=-44+union+all+select+1,2,group_concat(COLUMNS NAME SEPARATED BY “,” SIGN),4,5,6,7,8,9,10,11+from+TABLE NAME--
Now you have username and passwords of the admin , so the next thing you need to find admin page where you can login with this data ,
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Features
Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB database management systems.
Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries.
Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.
Support to enumerate database users, users' password hashes, users' privileges, users' roles, databases, tables and columns.
Automatic recognition of password hashes format and support to crack them with a dictionary-based attack.
Support to dump database tables entirely, a range of entries or specific columns as per user's choice. The user can also choose to dump only a range of characters from each column's entry.
Support to search for specific database names, specific tables across all databases or specific columns across all databases' tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass.
Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user's choice.
Support for database process' user privilege escalation via Metasploit's getsystem command which include, among others, the kitrap0d technique ( MS10-015).
Xplico is an open source Network Forensic Analysis Tool (NFAT) that allows for data extraction from traffic captures. It supports extraction of mail from POP, IMAP, and SMTP, can extract VoIP streams, etc. This is the version that has a GUI allowing you to view photos, texts and videos contained in MMS messages.
Port Independent Protocol Identification (PIPI) for each application protocol;
Multithreading;
Output data and information in SQLite database or Mysql database and/or files;
At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, …-);
TCP reassembly with ACK verification for any packet or soft ACK verification;
Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
No size limit on data entry or the number of files entrance (the only limit is HD size);
IPv4 and IPv6 support;
Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcher) are all modules;
The ability to easily create any kind of dispatcher with which to organize the data extracted in the most appropriate and useful to you;
Users
user: admin, xplico
password: xplico, xplico
Source code
Download here. md5: 0d27690e2fd8516be2441393831f4026
Installation instructions are in the INSTALL file and in the Wiki.
