? [bolofecal]
8 years ago

0

I make in localhost a vulnerable script.

if (isset($_POST['username'], $_POST['password'])) { $username = $_POST[****'username']; $password = $_POST[****'password']; $sql = "SELECT * FROM `user` WHERE `username`='$username' AND `password`='$password';"; $users = mysqli_query($con, $sql); }

And send

username = "'; INSERT INTO `user` (`username`, `password`) VALUES ('test', 'test'); #" password = ""

This is the complet query

SELECT * FROM `user` WHERE `username`=''; INSERT INTO `user` (`username`, `password`) VALUES ('test', 'test'); #' AND `password`='';

If I put this query in phpmyadmin the query select no user and insert the new line test:test but when I inject this value in form and post the new line isn’t inserted. It can be a protection against injection or I do some syntax error?

?

f0rk [HackingGuy]
8 years ago

0

?

There’s no place like 127.0.0.1

cn9 [1337boy]
8 years ago

0

Does the user have the privileges to do that?

WaRWolFz crew

dloser
8 years ago

1

Many interfaces to SQL like the PHP mysql functions simply do not allow multiple statements in a single query.

? [bolofecal]
8 years ago | edited 8 years ago

0

Yep the user have all privileges. Thanks @dloser Have some method to bypass it?

?

dloser
8 years ago

0

Find another vulnerability? :p

? [bolofecal]
8 years ago

0

I will use this like username

'"; mysqli_query($con, "INSERT INTO `user` (`username`, `password`) VALUES ('test', 'test');");//

and the query will create a new mysqli_query

$sql = "SELECT * FROM `user` WHERE `username`=''"; mysqli_query($con, "INSERT INTO `user` (`username`, `password`) VALUES ('test', 'test');");//' AND `password`='$password';";

lol

Thanks, I’m making some scripts to test.

?

dloser
8 years ago

0

Well, you wouldn’t be the first to try it. That I can assure you. shakes head

;)

? [bolofecal]
8 years ago

0

PHP injection don’t work in this case lol

?

puikaaa
8 years ago | edited 8 years ago

0

From my experience - most websites have PMA in the same directory tree (ex. www.sitename.com/phpmyadmin), so it is actually better to find voulnerabilities in the site itself - SQL injections, Shell injections etc. Past month I’ve been studying Vega and I suggest you to try it out too. It will sniff the target for vulnerabilities and if it finds, for ex., SQL or SHELL injection area, you can try to inject in specified area and get the access to whole database/s and even more.
Also, if you do find voulnerable SQL injection area, try using SQLMap. It’s basic, but it’s worth a try.

P.S. This indian guy posted another, very basic and easy way to get access to PMA via login form. Video is little bit annoying and slow, but funny. You will get the idea. :D

Best of luck @bolofecal and I hope you are doing this for learning purpose :D haha

Mr. Cyph3r [MrCyph3r]
8 years ago | edited 8 years ago

0

If I recall correctly MySQL supports stacked queries but PHP’s API does not (PHP-MySQL combination).
So you can’t inject stacked queries like that.

And your php injection attempt was funny :p

A little doubt about SQL injection

0

?

0

0

1

0

?

0

0

?

0

0

?

0

0