(May 30, 2016 07:53 AM)nios1515 Wrote:  Hi everyone i really need help after testing on a website i found an error based sql injection i was lucky the database user is "root" i have all privileges i did load_file(/etc/passwd) i didn't found anything special still need the full path of the website i used sqlmap to upload a file but nothing tried to brute force full path directories nothing can anyone help
THANK YOU VERY
P.S : the website is using Apache Tomcat/6.0.20

(May 30, 2016 09:59 AM)SlimJimTheHunter Wrote:  have tried adding [] to variables and other FPD methods? There is a good tutorial in the web hacking section

(May 30, 2016 10:15 AM)thepentesters Wrote:  Just because your MySQL user is root does not mean that the process is running as root. A lot of configurations of MySQL don't allow for write access. But, considering it did, I'd just go ahead and start with /var/www/public_html/ or /var/www/website.com/ and see what that brings. Upload a simple:

Code

<?php shell_exec(base64_decode($_GET["cmd"])); ?>

And if you happen to find it then run pwd to get the working directory. My bet is on /var/www/public_html/ as it's more than likely a shared hosting service you found that on. So be careful, as with shared hosting, you could get in a lot more trouble than you think.

(May 30, 2016 10:34 AM)Hooded Robin Wrote:  try to read the apache configuration file to find vhost path definitions which might help you find writeable web directory. You can also try to read the configuration files for Tomcat, which have application specific path info and in some cases can also contain cleartext credentials. Read the docs for Apache and Tomcat and start trying to find juicy config files to leak paths and other good stuff...