SQL Injection Tutorial Video

On January 31, 2009, in Security Posts, by Soroush Dalili

This is a good tutorial video about SQL Injection. Although in this video, it works with mysql, you can learn the concept of SQL Injection and also some useful techniques.

Creator: killerguppy101

Part1 (http://aria-security.persiangig.com/video/sqltut-Part1.rar)

——-

Part2.1 (http://aria-security.persiangig.com/video/sqltut-Part2.1.rar)

Part2.2 (http://aria-security.persiangig.com/video/sqltut-Part2.2.rar)

——-

Part3 (http://aria-security.persiangig.com/video/sqltut-Part3.rar)

Thanks from aria-security.com, Secr00t3r, ali_aria

Copy/Paste these links in your browser if they don’t work by clicking.

5 Comments
Leave A Response

Tagged with: •  

Hacking Videos: A Useful Link!

On January 31, 2009, in Security Posts, by Soroush Dalili

There are some good hacking videos in this link:

http://www.forcehacker.kit.net/videos.html

0 Comments
Leave A Response

Tagged with:  
Tagged with: • • • • •  

Blog Template Was Updated

On January 31, 2009, in Normal Posts, by Soroush Dalili

I found some XSS vulnerabilities in my blog’s template, so I reported them to its creator (Inanis).

Thanks from Inanis because of fast fix and also for this beautiful template.

You can see these in this link:

http://www.inanis.net/blog/index.php/downloads/inanis-glass-wordpress-theme/inanis-glass-readme/

0 Comments
Leave A Response

Tagged with: •  

Some XSS Tricks

On January 18, 2009, in Security Articles, by Soroush Dalili

I had submitted some XSS vulnerabilities in xssed.com by these names:

BugReport.ir (before soroush.secproject.com website)

And

Soroush.SecProject.Com (nowadays)

Now, because of using some tricks in these XSSes, they can be interesting. I want to describe some of these tricks here:

1- Insert JavaScript code inside of available script. In order to insert proper arbitrary JavaScript, we must insert something to close left side of JavaScript, then insert our own JavaScript, and finally close the right side of JavaScript to prevent errors.

As you can see in “http://www.xssed.com/mirror/39834/”, the XSS query is this:

?sx=”});};document.write(‘This is XSS test – BugReport.ir’);alert(‘Safe XSS BugReport.ir’);function startVideoPlayer(){getFailQS({destURL:”",show:”

In this query, first I closed the defined function by ["});};] , and then I inserted my arbitrary script there. After that, I used [function startVideoPlayer(){getFailQS({destURL:"",show:"]  to open a function to complete the right side of the code to prevent a JavaScript error.

You can see some other example of this group:

http://www.xssed.com/mirror/41138/

http://www.xssed.com/mirror/41800/

http://www.xssed.com/mirror/55622/

2- Insert JavaScript code in another format. Sometimes we can insert our JavaScript code via the some other forms of input such as Base64. In this way, we must look for algorithms of inputs.

As you can see in “http://www.xssed.com/mirror/55624/”, I inserted a Base64 string in order to perform XSS attack.

3- Using http://ha.ckers.org/xss.html techniques. There are always something new and fantastic in this XSS cheat sheet! I learned many things from it.

Example to bypass filters: “http://www.xssed.com/mirror/56197/”

4- Use your own idea to insert your codes. We must be creative in performing XSS. For example in “http://www.xssed.com/mirror/56651/”, I could not insert any string for my alert() function, so I insert something in title of the page, and then read them in my alert() function. It is obvious that I could use eval() function to execute some codes by this method.

?wrd=Tested in Mozilla (Onmouseover) — IRSDL is HERE — Soroush.SecProject.Com — Another XSS Trick in Yahoo&prn=[irsdl]&pth=test&opt=onmouseover%3dalert(window.document.title.substring(15)) onmouseout%3dalert(/SeeYou/)

Another example is “http://www.xssed.com/mirror/40384/” which is based on the “http://www.bugreport.ir/index_38.htm”:

[DNN URL] /Default.aspx/”onmouseover=”x=’al’;x=x+’ert(/WWW.BugReport.IR/)’;eval(x);alert().aspx

In this XSS, I used a feature of .Net which is “Slash after .aspx” in order to change PATH_INFO parameter in Server Variable. As “Dot Net Nuke (DNN)” used PATH_INFO instead of URL parameter, path was inserted into the default.aspx page without any checking. So I inserted “onmouseover” event there. But, there was a problem with alert() function which DNN could recognize it and omit it plus all of the string after it! So, I inserted alert() function as a string into the “x” variable, and then evaluate it by using eval() function. Another problem was that DNN needed “.aspx” at the end of the request (before Get parameters)! So, I inserted an “alert().aspx” at the end of the query which I knew that DNN will omit it plus all the string after that.

Moreover, you can see in “http://www.bugreport.ir/index_38.htm” that I used another query which is:

http://[DNN URL]/Default.aspx/bugreport/”onmouseover=”var a=’.aspx?’;document.location=’http://www.bugreport.ir/?archive’;

In this example, I must use a “:” for the “http://www.bugreport.ir/?archive”, but I could not insert it before the “?” because of getting error by the IIS (“:” is used to indicate a port). So, I inserted a “.aspx?” in a temp “a” variable in order to have: 1- a “.aspx” at the end of the query (before Get parameters) 2- insert “:” into the “http://”.

Note: I could not use “onmoueover” after the “?” because it replaced the double quotation in Get parameter by %22.

Good Luck.

0 Comments
Leave A Response

 
Previous Entries