[21redallday12]

So just throught i would share this sql injection technique.

MY AIM WAS TO SEE IF I COULD, AND TO REPORT IT IN HOPE FOR A REWARD.

I decided find a vulnerability in a online casino[A major player in uk], So i started off by finding out how online casino's are regulated, and it turns out that they are regulated by the gambling commision. On there website [www.gamblingcommission.gov.uk/‎] there is a list of every single LEGAL gambling sites. Next i looked for one that used older software, and gernrally older software.

I found 3 sutible targets, next i manually scanned the websites for vulnerability's didn't find much apart from a few sensitive directorys & XSS. [Tested cookies,refferers, user-agents the whole shabang(english term)]

So i decided to download the casino program, which is an .exe executable. I am not very familiar with decompling/reverse engineering, but my first attempt was to try and decompile the code so i can find out what is going on server side. Did not work, i assume it was written in a lower level langauge. I have decompiled/revesed .net and flash files before, and i thought it was possible to decompile, obviously not. (decompiling is not my area)

Next, bridged my to laptops together and started listening on wireshark on one laptop, whilst i installed the program on the other(due to OS complications one laptops windows, the other ubuntu)

I was watching the the packets/requests whilst it was installing (Mainly looking for HTTP GET/POST data), and sure enough the requests started to flow. At first it was simply grabing images from the server EG -
GET /sensitive-directory/images/casino.jpg HTTP /1.1
GET /sensitive-directory/images/logo.jpg HTTP /1.1
etc

Then i noticed one requests, which was to a script , which contianed a GET parameter named something like user_id=879888
GET /sensitive-directory/command.asp?user_id=241241&rando=4342424&type=new HTTP /1.1

(another thing i forgot to mention, the casino.exe program has its one user-agent, so if you tried it directly from your browser without tampering your useragent it would simply not work, i think it replied with an odder http response code)

Next, i opened up firefox + local proxy chaged my request to the same user-agent as the program eg FakeCansionName Version 1.35[]. Tested the parameter with the single quote and open sesimi.
Microsoft SQL Sever Syntax error/ or unclosed quote, carn't remember.

Then i did a quick few tests eg AND 1=1, 1=0, Sleep delay etc, ; sleep -- . and its vulnerable!
--BTESU :


PS for anybody trying to find vulnerablites on servers using this techinque, I would probably stick to testing HTTP if your new to this. You might get confisude with the encrpyted APP-DATA, etc.
The APP-DATA using a very stong encryption and you will need the private key to decrypt. HTTP is obvousily unencrypted so its easy to test, even for amauters.

I have found a similar vulnerablity, in a flash program before by downloaded the flash file, decompiling [which is very very simple], then look for GET/POST and other sensitive infromation.

If you find any .net apps, then you can acctually decompile and properly understand the code rather then going blind like i did.

Just thought i would share this with you as i don't see these kind of unotherdox methods on here.

PS my spellings a mess its, late and a carn't be botherd to be grammaticaly correct :)
[I have reported the vulnerablity, and thats why i am posting it openly]

I'm not a white hat, and i'm not a black hat, hat's just don't suite me.

21redallday12

[on-silo]

Spoiler (Click to View)So just throught i would share this sql injection technique.

MY AIM WAS TO SEE IF I COULD, AND TO REPORT IT IN HOPE FOR A REWARD.

I decided find a vulnerability in a online casino[A major player in uk], So i started off by finding out how online casino's are regulated, and it turns out that they are regulated by the gambling commision. On there website [www.gamblingcommission.gov.uk/‎] there is a list of every single LEGAL gambling sites. Next i looked for one that used older software, and gernrally older software.

I found 3 sutible targets, next i manually scanned the websites for vulnerability's didn't find much apart from a few sensitive directorys & XSS. [Tested cookies,refferers, user-agents the whole shabang(english term)]

So i decided to download the casino program, which is an .exe executable. I am not very familiar with decompling/reverse engineering, but my first attempt was to try and decompile the code so i can find out what is going on server side. Did not work, i assume it was written in a lower level langauge. I have decompiled/revesed .net and flash files before, and i thought it was possible to decompile, obviously not. (decompiling is not my area)

Next, bridged my to laptops together and started listening on wireshark on one laptop, whilst i installed the program on the other(due to OS complications one laptops windows, the other ubuntu)

I was watching the the packets/requests whilst it was installing (Mainly looking for HTTP GET/POST data), and sure enough the requests started to flow. At first it was simply grabing images from the server EG -
GET /sensitive-directory/images/casino.jpg HTTP /1.1
GET /sensitive-directory/images/logo.jpg HTTP /1.1
etc

Then i noticed one requests, which was to a script , which contianed a GET parameter named something like user_id=879888
GET /sensitive-directory/command.asp?user_id=241241&rando=4342424&type=new HTTP /1.1

(another thing i forgot to mention, the casino.exe program has its one user-agent, so if you tried it directly from your browser without tampering your useragent it would simply not work, i think it replied with an odder http response code)

Next, i opened up firefox + local proxy chaged my request to the same user-agent as the program eg FakeCansionName Version 1.35[]. Tested the parameter with the single quote and open sesimi.
Microsoft SQL Sever Syntax error/ or unclosed quote, carn't remember.

Then i did a quick few tests eg AND 1=1, 1=0, Sleep delay etc, ; sleep -- . and its vulnerable!
--BTESU :

PS for anybody trying to find vulnerablites on servers using this techinque, I would probably stick to testing HTTP if your new to this. You might get confisude with the encrpyted APP-DATA, etc.
The APP-DATA using a very stong encryption and you will need the private key to decrypt. HTTP is obvousily unencrypted so its easy to test, even for amauters.

I have found a similar vulnerablity, in a flash program before by downloaded the flash file, decompiling [which is very very simple], then look for GET/POST and other sensitive infromation.

If you find any .net apps, then you can acctually decompile and properly understand the code rather then going blind like i did.

Just thought i would share this with you as i don't see these kind of unotherdox methods on here.

PS my spellings a mess its, late and a carn't be botherd to be grammaticaly correct :)
[I have reported the vulnerablity, and thats why i am posting it openly]

I'm not a white hat, and i'm not a black hat, hat's just don't suite me.

21redallday12

I wish people did well worded and understandable write-ups like this more often, kudos

[g0han]

On my phone so that's a lot of text to read, I'll read on my computer later :L

[Grim]

very nice man! very few HQ people like this on here

[21redallday12]

I wish people did well worded and understandable write-ups like this more often, kudos

Thanks bro.

very nice man! very few HQ people like this on here

Thanks, good to hear nice feedback.

[rDNix]

Awesome this is how you work when you put target on your mind .. am really like how you are thinking , thank you .

[Avocado]

I like these sorts of posts in this section, breath of fresh of here. Thank you, an interesting read for sure.

[Jack Daniels™]

I'd love to learn stuff like this.. How did you first learn? Pretty interesting to read too.

[21redallday12]

Awesome this is how you work when you put target on your mind .. am really like how you are thinking , thank you .

Thanks, i really appreicate it.

I like these sorts of posts in this section, breath of fresh of here. Thank you, an interesting read for sure.

Thanks, i enjoy adding different concepts to this section.

I'd love to learn stuff like this.. How did you first learn? Pretty interesting to read too.

I think its quite simple and logical, when you think about it. I was writing a program in python and then wondered how to connect to a database when i realised application connect to dbs.
Thanks again

-- -- ---
By the way this method works against flash aswell, decompiling flash/swf is very very simple then just look for get/post variables etc.

[aksh1008]

dm me we can work together

[karsina]

from 2014 bro :D
i think too late

[Big Cash Spender]

dm me we can work together

Gravedigger!

[0x3043]

It is a 5 year old post dude, gravedigging af !!