Skip to main content

SQLMap

SQLMap will become in handy when you already discovery vulnerability on the database. Using SQLMap, we can automated the process and simply dumping the database will get much more easier compare with manual technique.

Here I already setup a vulnerable box on my VMware and SQLMap install on your machine. You can download it here. 

Note: For Windows machine you'll need to install python version 2.6 or 2.7 only else it might not work. For your convenience just use Kali Linux.

What we can do here is analyze every URL and search for vulnerable parameter.
We got SQL Error
Send the vulnerable parameter to SQLMap using argument --banner --current-user --current-db --is-dba

Tips: Use -help or -hh for more information about the SQLMap argument
And the parameter is injectable!
Dump the password hashes with --users & --passwords arguments
You can either use dictionary attack with SQLMap or password cracker tool John the ripper
Using John the ripper to crack the password hashes
Test the cracked password with username: phpmyadmin password::toor
Success login to phpmyadmin

Comments

Post a Comment

Popular posts from this blog

List of SQLMAP Tamper Scripts

Just re-post one of my visited reference blog post: Original URL: http://www.forkbombers.com/2016/07/sqlmap-tamper-scripts-update.html Name Description Example apostrophemask.py Replaces apostrophe character with its UTF-8 full width counterpart '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871' apostrophenullencode.py Replaces apostrophe character with its illegal double unicode counterpart '1 AND %271%27=%271' appendnullbyte.py Appends encoded NULL byte character at the end of payload '1 AND 1=1' base64encode.py Base64 all characters in a given payload 'MScgQU5EIFNMRUVQKDUpIw==' between.py Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' '1 AND A NOT BETWEEN 0 AND B--' bluecoat.py Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator 'SELECT%09id FROM users where id LIKE 1' chardoubleencode.py Double url-encodes all character
2 comments
Read more

Create a session & restore abort/interrupted session in John The Ripper!

Been busy with report writing. Just wanna put some of these command and technique on how to restore interrupted session or aborted session in John The Ripper. 1. First step crack the hash with these commands : john --session=test --format=raw-sha --incremental=rockyou test.txt 2. To restore the abort /interrupted session that you wanted to resume just run these commands : john --restore=test Check the "test.log" Note:  Make sure that these file are not delete " .rec " and " .log " files if the file is deleted or missing it wont work. That's all happy cracking!
Post a Comment
Read more

iOS - Convert .app to .ipa

While doing a iOS Security Testing, I wondered how do we convert .app into .ipa. So basically here are the structure of .ipa files. 1. First, SSH in your iPhone (Jailbroken). 2. Download the .app folder via scp  3. Copy the .app folder into a folder called Payload. 4. Compress it with .zip extension using any compression software. 5. Change the extension from file.zip to file.ipa. That’s it. Now you can use these .ipa files to install the app into your iPhone.
Post a Comment
Read more