+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Does SQL Injection in a subdomain allow takeover of main site? (/showthread.php?tid=5536230)
Does SQL Injection in a subdomain allow takeover of main site? - 8220347 - Jan 28, 2017
Say I find a sql injection vulnerability in subdomain.test.com. Would this give me access to information of users on test.com (logins), or just subdomain.test.com? Thanks
* - xx 0x0 xx - Jan 28, 2017
there are many cases
1-) this subdomain database is the same as test.com // then u can get the same database
2-) subdomain on the same server but not same database // this will require shell/root the server
3-) subdomain on other server with stand alone database // this is no you can't u will just get subdomain.test.com database
* - SIM-3192951 - Jan 28, 2017
If they have the same IP, there is a chance.
* - 8220347 - Jan 28, 2017
Are the majority of sites configured with the "subdomain database the same as test.com" or are most configured with "subdomain on other server with stand alone database"
* - xx 0x0 xx - Jan 28, 2017
(Jan 28, 2017 04:59 PM)8220347 Wrote: Are the majority of sites configured with the "subdomain database the same as test.com" or are most configured with "subdomain on other server with stand alone database"
i think most of web masters configure it as stand alone on other servers
* - Disparity - Jan 28, 2017
(Jan 28, 2017 05:35 PM)Mats0o0o0 Wrote: i think most of web masters configure it as stand alone on other servers
This, but they're often shared servers, so it's possible to get access to other user's sites on the server.
* - xx 0x0 xx - Jan 28, 2017
(Jan 28, 2017 06:44 PM)Disparity Wrote: This, but they're often shared servers, so it's possible to get access to other user's sites on the server.
you are totaly right i forget to mention this 🤝
* - SynthMesc - Jan 28, 2017
Often websites like to use the same database site wide, so yes. You will have access to the database of test.com
Cheers 🤝
* - amnaishaq1 - Jan 29, 2017
Yes You Will Have Access to The Database ... Some Time