Most sites that I SQL Inject either don't have an admin login, or the information from the columns doesn't work. How could there be login info in the database if there isn't a login? The thing I really don't get is when the login doesn't work. Sometimes I find 3 different admin panels on a site, and none of them do the passwords work on. I'm just wondering if anyone has any scientific reasons why this would be happening all the time.
Why don't the admin logins ever work? |
 
Well don't use public dorks for one thing.. You are wasting your time, because the fact that the site is still up most likely means that some other skid failed at getting in too. There has probably been 100s of noobs tryin to take down the site. Just make up your own dorks and you will have a better chance and finding a new site.
>> curl -o z.php http://www.google.com/
(Sep 23, 2013 11:26 AM)mem0rex Wrote: Well don't use public dorks for one thing.. You are wasting your time, because the fact that the site is still up most likely means that some other skid failed at getting in too. There has probably been 100s of noobs tryin to take down the site. Just make up your own dorks and you will have a better chance and finding a new site. Well I agree with that, but I'm really just asking why it doesn't work. (Sep 23, 2013 08:08 PM)itzthead Wrote: Well I agree with that, but I'm really just asking why it doesn't work. He's trying to say that quite simply, you've probably come across ones that don't work because you've been using very simple dorks. Or public dorks. Using something as simple as inurl:".php?id=" intext:"cars" - for example, has probably been queried with more times than you have body parts. Therefore, the likeliness of the sites you find being fresh, is very low. Why this matters? Because other people will of already gotten to the vulnerability first, and if successful, could of deleted the admin page so other people can't get in. Also, not every site has an admin panel, or they could've restricted your viewing access.
Right, I understand that. I use my own dorks.
The removal of the admin panel theory is possible I guess, but it seems unlikely to happen so often. Any site with an admin table should have an admin panel though, or at least did at one time. I still don't get why the logins wouldn't work though. Doesn't the site have to compare the entered passwords with the information in the db? (Sep 23, 2013 07:17 AM)itzthead Wrote: Most sites that I SQL Inject either don't have an admin login, or the information from the columns doesn't work. How could there be login info in the database if there isn't a login? The thing I really don't get is when the login doesn't work. Sometimes I find 3 different admin panels on a site, and none of them do the passwords work on. I'm just wondering if anyone has any scientific reasons why this would be happening all the time. this website and a majority of its members are a good part of the reason you encounter this issue, maybe if all these middle eastern fucks from third world countries stopped defacing everything they find left and right, and making idiotic posts like a majority of those you see here, including the skidded out tutorials everywhere then you wouldnt find this problem with much of the targets you do these days, however its about 10 years too late for that to happen. shit will just keep going downhill. abandon all hope.
Idk man everytime I get a shell on the site I fix the vulnerability so others cant get in. Other guys probably do the same thing or something like that to stop others from getting in.
>> curl -o z.php http://www.google.com/
Sep 24, 2013 12:01 PM
(This post was last modified: Sep 24, 2013 03:03 PM by frictionless.)
(Sep 24, 2013 10:27 AM)mem0rex Wrote: Idk man everytime I get a shell on the site I fix the vulnerability so others cant get in. Other guys probably do the same thing or something like that to stop others from getting in. keep on deskidding. fuck the haters. death to skids. |
|
|
