[TuT]SQL injection by X-forwarded-for[TuT]

Николай · 2012-06-10T15:03:04+00:00

SQL injection : X-forwarded-for [color=#1E90FF]Requirements : [*]Site that use X-forwarded-for [*]Basic knowledge with SQLi (string based) [*]Live HTTP headers [color=#1E90FF]Introduction : X-forwarded-for is often use to get the ip of user even though he uses a proxy. Example and explanation : function getip() { if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; } else { $ip = $_SERVER; } This code create an ip variable with the real ip. if (preg_match("#^{1,3}\\.{1,3}\\.{1,3}\\.{1,3}#",$ip)) { return $ip; } else { return $_SERVER; } } This code check if it's real ip but this code is vulnerable, why ? Because a regex has a beginning and a end. The beginning delimiter is [color=#FF0000]^ and the ending delimiter is [color=#FF0000]$, note that the [color=#FF0000]$ is missing. So the regex check only the beginning of the ip. If your ip is 127.0.0.1 the regex will send back true but if your ip is 127.0.01+whateveryouwant the regex will send back true to

balaghacking Offline

[n00b@HF:]

Posts:

Threads:

Credibility:

000

Popularity:

βytes:

β 0

Game XP:

#31

May 19, 2014 08:24 PM

Nice tut
...... thanks for sharing.. :)

wick3dj0k3r Offline

[closed@HF:]

Posts:

Threads:

DO NOT DEAL WITH THIS MEMBER

βytes:

β 0

Game XP:

#32

May 20, 2014 10:07 PM

Never knew this, thanks OP for sharing this ...

Next Oldest | Next Newest

Previous 1 2 3

New Reply

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
NGINX - X-Forwarded-For/X-Real-Ip by HardStoNJan 8, 2025 12:37 PM	4	248	Jan 8, 2025 12:37 PM Last Post: HardStoN
[TUT][noob friendly][PIC]ERROR BASED INJECTION(DOUBLE QUERY)[TUT] by webbJan 5, 2017 12:31 AM	43	4,192	Jan 5, 2017 12:31 AM Last Post: Maxs
[NEED TUT]Up shell to MS-SQL via SQL Injection by thanh159May 27, 2016 07:19 AM	4	258	May 27, 2016 07:19 AM Last Post: b4tb0t

Login
Username/Email:
Password:	Lost Password?
	Remember me