HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 43 guests online
 
Advertisement

You are here: Home
EH-Net
May 24, 2013, 02:25:52 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
  Home Help Calendar Login Register  
  Show Posts
Pages: [1] 2
1  Ethical Hacking Discussions and Related Certifications / CEH - Certified Ethical Hacker / Re: CEH v7.1 Review on: March 04, 2012, 12:51:14 PM
=)
2  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Analysis of "r00t 4 LFI Toolkit" on: February 21, 2012, 02:09:06 PM
Thanks for the update
3  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Some questions as usual ? on: February 15, 2012, 12:00:33 PM
Quote from: manoj9372 on February 03, 2012, 02:08:37 AM
I got reading some stuff as usual i ended up with some doubts ,so i decided to ask here,

I am sure most of the guys here knows about xsssqli

Similar to this is it possible to inject xss code through an sql injection?

While thinking about this it has raised some questions in my mind

1)say a web site is vulnerable to sql injection,
is it possible to inject xss code in to the sql vulnerable part and make it vulnerable to xss ?

2)Also can we Introduce All the threee types of xss like persistent,non-persistent and DOM based with this ?

3)In general Assume if a web-application is vulnerable to sqli and xss means ,what are the other possible attacks
we can introduce with those vulnerabilities (like CSRF etc)?

4)And if you like please say a few words about xss as a SERVER SIDE THREAT ,so that i can understand about it as a server side threat,because some of the ppl around me just thinks it as a client side vulnerability that can just damage to client side..

Bear with me Smiley






Im not sure about xsssqli but I do know if the sql injection is a ristricted area for a guest user to reach , you always can use XSS  andf bit of javascript make a automated sql injection script and so the SQL Injection trough admin .
here is a video tut ..
http://www.youtube.com/watch?v=2b0VD4_rg8Q

1. Yes you can . if a page is vulnerable to SQL Injection , You can perform a XSS with SQL Injection . for a example

Code:
"http://victime.com/page,php?id=1 union select 1,0x3c7363726970743e616c65727428226e7974666f7822293c2f7363726970743e,3,4 --"

the code   
Code:
0x3c7363726970743e616c65727428226e7974666f7822293c2f7363726970743e
is in hex . pure code its
Code:
"<script>alert("nytfox")</script>"

2.  It depends on the app

3. yes there is a possibility for that also . but it actually this also depends on the application

4. in to my knowledge you can't attack Server side with just XSS
4  Ethical Hacking Discussions and Related Certifications / Social Engineering / Re: Email engineering on: January 31, 2012, 06:05:55 AM
you can use a fake email sender. with that you can send from anyones e-mail address. and if you wanna get his password . do a MITM in the local network and grab the password .
5  Resources / Looking For Work / Re: Help me with my Resume on: January 31, 2012, 02:56:48 AM
to complete certification courses you have all the information you need here in the in link below
http://www.ethicalhacker.net/content/section/1/3/

 Cheesy
6  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: How to test if website is writable on: January 31, 2012, 02:36:48 AM
Im not sure what are you asking by writable . but if you checked permissions on files and dirs and if they are not viewer writable then I guess your fine . if they meant by hackable . use some vuln scanning tools and see if they gives your exploitable vulns . I prefer nikto ,  Acunetix WVS (spider trows big unwanted traffic but does a good job)
7  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Please help me with PHP injection(Some command not working) on: January 30, 2012, 11:57:50 PM
Quote
www.testme.com/user.php?user=something&password=${@print(md5(worked))} 

In that "${@print(md5(worked))" "md5" is inbuilt function inside PHP  and ''worked' is the value

so its possible if you wanna execute system commands using "system" function and for value as command you wanna execute for a example "cat /etc/passwd". its that simple
example

Code:
www.testme.com/user.php?user=something&password=${@print(system(cat /etc/passwd))}
8  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Best tools for non-intrusive scans on: January 30, 2012, 11:39:31 PM
their are tons of applications for vulnbility identification. ^ alota users have fillied with you replies on tools . but if I was you & if I cant be loud on the system . Im just gonna use a spide the system using a spider and manually identifies the vulns. not that hard not won't be much loud . using tools is all good . but in like data submition forms . some submit values and see whats reply they get . that might get annoyed . just my idea Smiley
9  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Red flags for a website's security? on: January 30, 2012, 11:29:58 PM
Quote from: MaXe on January 30, 2012, 06:31:09 AM
Quote from: nytfox on January 29, 2012, 01:27:01 AM
... and I dont think they will make you submit your information online unless the application and backend database's are secure .

Did you see the recent Stratfor leak? Their servers were supposed to be secure  Grin

blame the hackers Tongue . MaXe good point tho . even how much we think a system is secure their is always a point hidden to exploit . its just matter of time some one finds it
10  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Zend Framwork - Pentest on: January 30, 2012, 11:27:27 PM
BTW if its possible for you do a code analysis and see if you can identify bugs inside the code. 
11  Resources / Tutorials / Re: a question about metasploit on: January 29, 2012, 02:50:07 AM
btw you can use search commend to get selected exploits , like "search smb" . try it and lemme know Smiley
12  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Bypassing File Upload Restrictions on: January 29, 2012, 01:48:30 AM
I agree with what Maxxe said . but include to that . all you have to do is misdirect the vailidations on the upload scrtipt . like "Content-Type" when your uploading a image you might be having a application as type . change it to image/jpeg . like wise their are lota ways you can upload a execution file as a image .

still some scripts cruch the image and make thumbs and change resolutions . if the image is getting cruch like that . you might have a issue upload the image . but still their few php function issues, I have put a ref link bellow

http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesize/
 
13  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Zend Framwork - Pentest on: January 29, 2012, 01:35:42 AM
I'm not sure how much this will help . but in to knowledge Zend Core Framework is pretty secured, once I did a pentest on a Zend . their was not much exploit . but I found some XSS , and Redirection flows and miss functions in vote poll . all because of poor verification on submitions
14  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: Red flags for a website's security? on: January 29, 2012, 01:27:01 AM
I wouldn't worry about your data getting stolen while your transmuting from your machine to their servers , but make sure your machine isn't infect by RATS , Keyloggers , Stealers , Botnets etc ... and I dont think they will make you submit your information online unless the application and backend database's are secure . I didn't actually visit the site . but if the application is secure you got nothing to worry about
15  Ethical Hacking Discussions and Related Certifications / Web Applications / Re: URL Encoder on: January 29, 2012, 01:07:58 AM
What ^ Said
Pages: [1] 2
Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.068 seconds with 21 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.