+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TuT]SQL injection by X-forwarded-for[TuT] (/showthread.php?tid=2572800)
[TuT]SQL injection by X-forwarded-for[TuT] - Николай - Jun 10, 2012
SQL injection : X-forwarded-for
Requirements :
- Site that use X-forwarded-for
- Basic knowledge with SQLi (string based)
- Live HTTP headers
Introduction :
X-forwarded-for is often use to get the ip of user even though he uses a proxy.
Example and explanation :
PHP Code
<?php
function getip()
{
if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
$ip = $_SERVER["REMOTE_ADDR"];
}
This code create an ip variable with the real ip.
PHP Code
<?php
if (preg_match("#^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#",$ip))
{
return $ip;
}
else
{
return $_SERVER["REMOTE_ADDR"];
}
}
This code check if it's real ip but this code is vulnerable, why ?
Because a regex has a beginning and a end. The beginning delimiter is ^ and the ending delimiter is $, note that the $ is missing. So the regex check only the beginning of the ip. If your ip is 127.0.0.1 the regex will send back true but if your ip is 127.0.01+whateveryouwant the regex will send back true too.
PHP code that is vulnerable :
PHP Code
<?php
$req = mysql_query("SELECT username,password FROM admin WHERE username='".sql($_POST['username'])."' AND password='".md5($_POST['password'])."' AND ip='".getip()."'");
Exploitation:
First open Live HTTP headers then actualize the page :
[IMG]http://img15.hostingpics.net/pics/873830http1.png[/IMG]
Note that the injection will be a string based.
Now click on the url then click on replay and add :
Code
X-forwarded-for: 127.0.0.1[IMG]http://img15.hostingpics.net/pics/317006http2.png[/IMG]
Then add a quote after your ip address and a nice error like that will be displayed :
[IMG]http://img15.hostingpics.net/pics/953087sql1.png[/IMG]
And now do your injection like string based, the most important thing is that you have to understand that the injection point is your ip in X-forwarded.
Hope you learnt something new
* - Phizo - Jun 10, 2012
Awesome tutorial man, I haven't seen this posted before.
Keep up the good work!
* - No - Jun 10, 2012
This looks interesting and I haven't seen it around here before. Great work!
* - joomlafkr - Jun 10, 2012
Happy to see new stuff shared here !
Good work OP !
Actually sqlmap does that by increasing --level and --risk
and there are many other fields in the header that could be exploited !
* - Николай - Jun 10, 2012
Thanks for feedbacks glad you like.
* - doegizfruit - Jun 13, 2012
Nice tutorial very high quality!
Thanks for sharing this.
* - Николай - Jun 13, 2012
(Jun 13, 2012 09:39 AM)Suved Wrote: Nice tutorial.
Thanks for sharing.
How can i know the site use X-forwarded-for?
Only by the source code that because this method is pretty rare but sometimes very useful.
* - MaXoNe - Jun 13, 2012
Nice technique , I like it , finally something new :)
* - Zixem - Jun 13, 2012
Nice tutorial.
Thanks for sharing.
-Zixem-
* - PličkaMaterna - Jun 13, 2012
What is the point of sharing this?
You are spoonfeeding all those wannabe hackers here. I mean those people don't know what a header even is.
fuckhackforums
* - The Ion - Jun 13, 2012
Awesome tutorial man, I haven't seen this posted before.
Keep up the good work!
* - Николай - Jun 13, 2012
(Jun 13, 2012 10:25 AM)PIitvix Wrote: What is the point of sharing this?
You are spoonfeeding all those wannabe hackers here. I mean those people don't know what a header even is.
fuckhackforums
What is the point of posting your reply, I want to share my knowledge with all members this is the point of this forum, if you want to keep your knowledge without shared with others I think you're in wrong place.
* - Dynasty@HF - Jun 13, 2012
good tutourial this will help me out loads thanks for sharing this 🤗
* - Lynchings - Jun 13, 2012
Nice tutorial. Helped me. This has to be almost as good as RATTing people. :o
* - Prithvi - Jun 14, 2012
learned something new
Thanks bro..