[Николай]

SQL injection : X-forwarded-for

Requirements :

• Site that use X-forwarded-for
  
• Basic knowledge with SQLi (string based)
  
• Live HTTP headers
  

Introduction :

X-forwarded-for is often use to get the ip of user even though he uses a proxy.
Example and explanation :

PHP Code


<?php 
function getip() 
{
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) 
    {
       $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  } 
    else 
    {
      $ip = $_SERVER["REMOTE_ADDR"];
  } 


This code create an ip variable with the real ip.

PHP Code


<?php 
    if (preg_match("#^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#",$ip)) 
    {
        return $ip;
    }
    else 
    {
        return $_SERVER["REMOTE_ADDR"];
    }
} 


This code check if it's real ip but this code is vulnerable, why ?

Because a regex has a beginning and a end. The beginning delimiter is ^ and the ending delimiter is $, note that the $ is missing. So the regex check only the beginning of the ip. If your ip is 127.0.0.1 the regex will send back true but if your ip is 127.0.01+whateveryouwant the regex will send back true too.

PHP code that is vulnerable :

PHP Code


<?php 
$req = mysql_query("SELECT username,password FROM admin WHERE username='".sql($_POST['username'])."' AND password='".md5($_POST['password'])."' AND ip='".getip()."'"); 


Exploitation:

First open Live HTTP headers then actualize the page :

[IMG]http://img15.hostingpics.net/pics/873830http1.png[/IMG]

Note that the injection will be a string based.

Now click on the url then click on replay and add :

Code

X-forwarded-for: 127.0.0.1

[IMG]http://img15.hostingpics.net/pics/317006http2.png[/IMG]

Then add a quote after your ip address and a nice error like that will be displayed :

[IMG]http://img15.hostingpics.net/pics/953087sql1.png[/IMG]

And now do your injection like string based, the most important thing is that you have to understand that the injection point is your ip in X-forwarded.

Hope you learnt something new

[Phizo]

Awesome tutorial man, I haven't seen this posted before.
Keep up the good work!

[No‌‌‌‌‌‌]

This looks interesting and I haven't seen it around here before. Great work!

[joomlafkr]

Happy to see new stuff shared here !
Good work OP !
Actually sqlmap does that by increasing --level and --risk
and there are many other fields in the header that could be exploited !

[Николай]

Thanks for feedbacks glad you like.

[doegizfruit]

Nice tutorial very high quality!
Thanks for sharing this.

[Николай]

Nice tutorial.
Thanks for sharing.
How can i know the site use X-forwarded-for?

Only by the source code that because this method is pretty rare but sometimes very useful.

[MaXoNe]

Nice technique , I like it , finally something new :)

[Zixem]

Nice tutorial.
Thanks for sharing.

-Zixem-

[PličkaMaterna]

What is the point of sharing this?
You are spoonfeeding all those wannabe hackers here. I mean those people don't know what a header even is.

fuckhackforums

[The Ion]

Awesome tutorial man, I haven't seen this posted before.
Keep up the good work!

[Николай]

What is the point of sharing this?
You are spoonfeeding all those wannabe hackers here. I mean those people don't know what a header even is.

fuckhackforums

What is the point of posting your reply, I want to share my knowledge with all members this is the point of this forum, if you want to keep your knowledge without shared with others I think you're in wrong place.

[Dynasty@HF]

good tutourial this will help me out loads thanks for sharing this 🤗

[Lynchings]

Nice tutorial. Helped me. This has to be almost as good as RATTing people. :o

[Prithvi]

learned something new

Thanks bro..