Re: [Guide]SQL injections
i tryed that command on my website i'm creating and nothing :), the sql dosen't stop...and i putet on email field :P...so my website is protected anti sql injection :).nice, and i use apache by the way :P not xampp :).
Re: [Guide] SQL injections
Re: [Guide] SQL injections
i will try to inject jiji
Re: [Guide] SQL injections
Dont use to Inject other servers sql! only use to test this will dont breack DB or SQL....only shotdown SQL
Re: [Guide] SQL injections
Super tare bravo frate!
Great guide
Re: [Guide] SQL injections
i find this code in SecuredMuWeb0.8 !
its a fake?? or ...
PHP Code:
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$time = date("l dS of F Y h:i:s A");
$script = $_SERVER[PATH_TRANSLATED];
$fp = fopen ("D:/MuServer/[WEB]SQL_Injection.txt", "a+");
$sql_inject_1 = array(";","'","%",'"'); #Whoth need replace
$sql_inject_2 = array("", "","","""); #To wont replace
$GET_KEY = array_keys($_GET); #array keys from $_GET
$POST_KEY = array_keys($_POST); #array keys from $_POST
$COOKIE_KEY = array_keys($_COOKIE); #array keys from $_COOKIE
/*begin clear $_GET */
for($i=0;$i<count($GET_KEY);$i++)
{
$real_get[$i] = $_GET[$GET_KEY[$i]];
$_GET[$GET_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_GET[$GET_KEY[$i]]));
if($real_get[$i] != $_GET[$GET_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: GET\r\n");
fwrite ($fp, "Value: $real_get[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_GET */
/*begin clear $_POST */
for($i=0;$i<count($POST_KEY);$i++)
{
$real_post[$i] = $_POST[$POST_KEY[$i]];
$_POST[$POST_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_POST[$POST_KEY[$i]]));
if($real_post[$i] != $_POST[$POST_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: POST\r\n");
fwrite ($fp, "Value: $real_post[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_POST */
/*begin clear $_COOKIE */
for($i=0;$i<count($COOKIE_KEY);$i++)
{
$real_cookie[$i] = $_COOKIE[$COOKIE_KEY[$i]];
$_COOKIE[$COOKIE_KEY[$i]] = str_replace($sql_inject_1, $sql_inject_2, HtmlSpecialChars($_COOKIE[$COOKIE_KEY[$i]]));
if($real_cookie[$i] != $_COOKIE[$COOKIE_KEY[$i]])
{
fwrite ($fp, "IP: $ip\r\n");
fwrite ($fp, "Method: COOKIE\r\n");
fwrite ($fp, "Value: $real_cookie[$i]\r\n");
fwrite ($fp, "Script: $script\r\n");
fwrite ($fp, "Time: $time\r\n");
fwrite ($fp, "==================================\r\n");
}
}
/*end clear $_COOKIE */
fclose ($fp);
?>
<?
error_reporting(E_ALL ^E_NOTICE ^E_WARNING);
$muweb['connection'] = 'mssql';
$muweb['localhost'] = 'xxx.xxx.xxx.xxx';
$muweb['dbhost'] = 'xxx.xxx.xxx.xxx';
$muweb['database'] = 'MuOnline';
$muweb['dbuser'] = 'sa';
$muweb['dbpassword'] = 'sql_pass';
require("includes/muweb.php");
?>
@ for hackalin :)) its "n" methods for inject !
new example from TosaMu
08-10-2008 10:13:26 88.232.213.113 [ ][ mu.dorin1.ro/index.php?op=reg ][ (ALEMCİ27)(ALEMCİ(564564456)(6564656454)(PİSKOPATOKAN_27_HOTMAİL,COM)(27500)(NE)(NE)(Submit)( ] 08-10-2008 10:13:56 88.232.213.113 [ ][ mu.dorin1.ro/index.php?op=reg ][ (ALEMCİ27)(ALEMCİ(1990)(1990)(PİSKOPATOKAN_27_HOTMAİL,COM)(27500)(NE)(NE)(Submit)( ] 08-10-2008 10:15:43 88.232.213.113 [ ][ mu.dorin1.ro/index.php?op=reg ][ (ALEMCİ27)(ALEMCİ(7894561230)(7894561230)(PİSKOPATOKAN_27_HOTMAİL,COM)(27500)(NE)(NE)(Submit)( ]
Re: [Guide] SQL injections
i belive is work my friend!
Re: [Guide] SQL injections
And here is a list of SQL Injection functions...you better protect yourself against those otherwise I will be the guy destroying your noob a55 server :thumbup:
Code:
ABORT -- abort the current transaction
ALTER DATABASE -- change a database
ALTER GROUP -- add users to a group or remove users from a group
ALTER TABLE -- change the definition of a table
ALTER TRIGGER -- change the definition of a trigger
ALTER USER -- change a database user account
ANALYZE -- collect statistics about a database
BEGIN -- start a transaction block
CHECKPOINT -- force a transaction log checkpoint
CLOSE -- close a cursor
CLUSTER -- cluster a table according to an index
COMMENT -- define or change the comment of an object
COMMIT -- commit the current transaction
COPY -- copy data between files and tables
CREATE AGGREGATE -- define a new aggregate function
CREATE CAST -- define a user-defined cast
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger
CREATE CONVERSION -- define a user-defined conversion
CREATE DATABASE -- create a new database
CREATE DOMAIN -- define a new domain
CREATE FUNCTION -- define a new function
CREATE GROUP -- define a new user group
CREATE INDEX -- define a new index
CREATE LANGUAGE -- define a new procedural language
CREATE OPERATOR -- define a new operator
CREATE OPERATOR CLASS -- define a new operator class for indexes
CREATE RULE -- define a new rewrite rule
CREATE SCHEMA -- define a new schema
CREATE SEQUENCE -- define a new sequence generator
CREATE TABLE -- define a new table
CREATE TABLE AS -- create a new table from the results of a query
CREATE TRIGGER -- define a new trigger
CREATE TYPE -- define a new data type
CREATE USER -- define a new database user account
CREATE VIEW -- define a new view
DEALLOCATE -- remove a prepared query
DECLARE -- define a cursor
DELETE -- delete rows of a table
DROP AGGREGATE -- remove a user-defined aggregate function
DROP CAST -- remove a user-defined cast
DROP CONVERSION -- remove a user-defined conversion
DROP DATABASE -- remove a database
DROP DOMAIN -- remove a user-defined domain
DROP FUNCTION -- remove a user-defined function
DROP GROUP -- remove a user group
DROP INDEX -- remove an index
DROP LANGUAGE -- remove a user-defined procedural language
DROP OPERATOR -- remove a user-defined operator
DROP OPERATOR CLASS -- remove a user-defined operator class
DROP RULE -- remove a rewrite rule
DROP SCHEMA -- remove a schema
DROP SEQUENCE -- remove a sequence
DROP TABLE -- remove a table
DROP TRIGGER -- remove a trigger
DROP TYPE -- remove a user-defined data type
DROP USER -- remove a database user account
DROP VIEW -- remove a view
END -- commit the current transaction
EXECUTE -- execute a prepared query
EXPLAIN -- show the execution plan of a statement
FETCH -- retrieve rows from a table using a cursor
GRANT -- define access privileges
INSERT -- create new rows in a table
LISTEN -- listen for a notification
LOAD -- load or reload a shared library file
LOCK -- explicitly lock a table
MOVE -- position a cursor on a specified row of a table
NOTIFY -- generate a notification
PREPARE -- create a prepared query
REINDEX -- rebuild corrupted indexes
RESET -- restore the value of a run-time parameter to a default value
REVOKE -- remove access privileges
ROLLBACK -- abort the current transaction
SELECT -- retrieve rows from a table or view
SELECT INTO -- create a new table from the results of a query
SET -- change a run-time parameter
SET CONSTRAINTS -- set the constraint mode of the current transaction
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session
SET TRANSACTION -- set the characteristics of the current transaction
SHOW -- show the value of a run-time parameter
START TRANSACTION -- start a transaction block
TRUNCATE -- empty a table
UNLISTEN -- stop listening for a notification
UPDATE -- update rows of a table
VACUUM -- garbage-collect and optionally analyze a database
Enjoy!
Re: [Guide] SQL injections
hehe i dont whanna give all this info i just create a littel guide to test the webserver protection! damn man you give here all hack info!
Re: [Guide] SQL injections
nice !!! tnx for the guide
Re: [Guide] SQL injections
Quote:
Originally Posted by
HurryPoker
hehe i dont whanna give all this info i just create a littel guide to test the webserver protection! damn man you give here all hack info!
Every good hacker knows this info.And there are many good hackers.
Learns what a hacker learns,think like a hacker thinks,and then you will understand how to protect yourself :thumbup1: I am scarred shitless of hackers.You should see the precautions I take....I impress myself on what I do not to get hacked in any ways :ott1:
Re: [Guide] SQL injections
Decent thread - however, the common problem why so many holes are discovered is because over 80% of the servers are currently based on Mu Web. It is a decent script, but like any other script - it requires modifications.
Do yourself a favour - use these scripts but try to improve the script in terms of security - once you've gathered some basic HTML/CSS knowledge and basic PHP - then I'd suggest you go create your own web site.
Meti
Re: [Guide] SQL injections
Quote:
Originally Posted by
MeTi
Decent thread - however, the common problem why so many holes are discovered is because over 80% of the servers are currently based on Mu Web. It is a decent script, but like any other script - it requires modifications.
Do yourself a favour - use these scripts but try to improve the script in terms of security - once you've gathered some basic HTML/CSS knowledge and basic PHP - then I'd suggest you go create your own web site.
Meti
The lastest MuToolz will be secure at least for a while,and I have a feeling john_d will be updating them regularly.
Anyways,hurrypoker,good guide.Your other guides are also pretty cool :sleep: respect
Re: [Guide] SQL injections
Quote:
Originally Posted by
Crystal-X
The lastest MuToolz will be secure at least for a while,and I have a feeling john_d will be updating them regularly.
Anyways,hurrypoker,good guide.Your other guides are also pretty cool :sleep: respect
John has more experience in this field - and know how to secure a script properly. However - as this will be a component that is basically installed on a Content Management System (in this case, Joomla) - you would have to secure the Joomla script. And Joomla is currently one of the largest, and well-known content management systems - so you will need to know how to properly apply work on the security.
John is coding a component not a complete web site - so basically the "bridge" will be secured as I do believe John has the experience required to secure such bridge - but the Joomla script will have to be secured by their respective server operators. However - Joomla is updated frequently and if you regularly update your Joomla copy you decrease the chance of possible security holes - but there's always ways to get in.
Meti
Re: [Guide] SQL injections
Quote:
Originally Posted by
Crystal-X
Every good hacker knows this info.And there are many good hackers.
Learns what a hacker learns,think like a hacker thinks,and then you will understand how to protect yourself :thumbup1: I am scarred shitless of hackers.You should see the precautions I take....I impress myself on what I do not to get hacked in any ways :ott1:
hackers is alwasy 1 step infront of "coders" that i thing :P
Re: [Guide] SQL injections
hackers is alwasy 1 step infront of "coders" that i thing WRONG!
The coders are the real hackers!
Re: [Guide] SQL Injections
Re: [Guide] SQL Injections
IT`S JUST ONLY STOP THE SQL :) so.... bad luck :))
Re: [Guide] SQL Injections
RO: bwahahhahaha.
Ma sparg de ras! Oricum, ai inceput bine treaba! Vezi ca mai sunt si alte chestii de acoperit, nu doar panaramele de muweburi facute de =Master=... spre ex: in mu web 0.7 sau 0.8 poti teleporta pe cine vrei si unde vrei cu doar 2 clicuri :)
In rest, ca sa nu fie panica prea mare... mai bine va configurati singuri un server apache + php, nu folositi XAMPP, de ce? other sql injections!
EN: Good job! keep up the good work. Remember, always wash your hands and use custom made sites, not mu web and related crap.
I hack for fun, you?
