+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Found a SQL Vuln *I think* But no idea what to do with it. (/showthread.php?tid=3262545)
Found a SQL Vuln *I think* But no idea what to do with it. - Sir Paul McCartney - Feb 16, 2013
So yeah, I think I found a SQL vulnrability on a MC server that banned me, lawl.
So yeah; http://www.dungeonrealms.net/bans/index.php
Just type ' into the username it it returns;
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
I guess you guys know what to do, if you can do anything let me know :p
edit;
it's XSS vuln too,
I tried <font color=red>test</font>' and it returned;
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''test''' at line 1
I'm not very good at hacking websites lol, I know some of you are pretty good and i guess this seems like an easy target.
* - rfpd - Feb 16, 2013
It's vulnerable to SSI not SQLi, trying to upload a shell for you
Nevermind you are right I've found sql, blind and xss
* - AlphaDelta - Feb 16, 2013
It's definitely exploitable,
![[Image: QWrIlBY.png]](https://i.imgur.com/QWrIlBY.png)
I'm not entirely sure if any of those tables would contain any useful information considering I haven't been anywhere else on the website other than that link.
* - rfpd - Feb 16, 2013
Use xss to get cookies I don't think you can get some logins from this tables
* - Sir Paul McCartney - Feb 16, 2013
AlphaDelta, you are awesome.
All of the fields are part of the game,
dungeonrealms.net,
Is it possible to drop the database or something like that?
* - benzi - Feb 16, 2013
yes,you can drop the db.
its regular string injection-
Code
'and 0 union select version(),2,3,4,5,6,7,8,9-- -follow this tut
https://hackforums.net/showthread.php?tid=1923250
but pay attention for string.
* - rfpd - Feb 16, 2013
I hacked it using tamper data lol o.O
* - Sir Paul McCartney - Feb 16, 2013
Feel free to do what you want, because it will ruin the ingame!
It will be so funny as they usually charge $10 to play on the server, because it's in heavy BETA, it's OPEN BETA weekend so anyone can join, will be hilarious if they have no backups.
* - rfpd - Feb 16, 2013
(Feb 16, 2013 10:09 AM)๖ۣۜBlank™ Wrote: Feel free to do what you want, because it will ruin the ingame!
It will be so funny as they usually charge $10 to play on the server, because it's in heavy BETA, it's OPEN BETA weekend so anyone can join, will be hilarious if they have no backups.
I don't think you can hack anything it doesn't seem to have admin table information
* - Sir Paul McCartney - Feb 16, 2013
Doesn't matter, they use minecraft as the game (which the accounts will be seperate for) but the use the MySQL database to store info for the game.
If the database was gone the whole server would just crumble
* - LevelUp - Feb 16, 2013
I took a look through and there doesn't seem to be anything of crucial status.
Code
'and 1=0 union select 1,2,3,4,5,6,7,8,group_concat(0x3c62723e,table_name) from information_schema.tables where table_schema=database()-- -* - Coffee - Feb 16, 2013
There doesn't see to be any "game ruining" information in that database, not really worth the effort
* - Sir Paul McCartney - Feb 17, 2013
(Feb 16, 2013 07:55 PM)Coffee Wrote: There doesn't see to be any "game ruining" information in that database, not really worth the effortThey use that database only for storing like your gems, ect
The user database isn't accesible by anyone because it uses Minecraft..
* - Butofort - Feb 17, 2013
Ohh i like it :D very nice man thank