[Artista]

Hey guys,

So I am playing around now and trying to learn something. I am not sure whether this site is vulnerable: -snip-

But I was playing around with sources and got to this:

Spoiler: Picture

-snip-

What about this line of code ? I was reading that if you can find F O R M it meanst the site might be vulnerable to SQL injection.

Code:

<form name="aspnetForm" method="post" action="Prijava.aspx?ReturnUrl=%2fadmin%2flogin.aspx" id="aspnetForm">

I am not sure, but there are some Username and Password fields, could this help me somehow in to login as Admin?

I got that URL from browsing the Source of Login HTML. It was written somewhere in between.


A

[h3r0]

Please revise this short guide.

http://www.hackcommunity.com/Thread-How-...legal+post

Unfortunately you are not allowed to post the full site name/url since you do not own that site/server. So on this forum that would be considered "Blackhat".

I would advise editing your post/removing that screen shot.


But on the subject of what you actually found.. It might be vulnerable to SQL injection but it seems like you just stumbled on a debug page explaining how to make SOAP requests.

[Spirit]

I removed the screenshot and link.
Please refer to what @h3r0 had to say.

[Artista]

Damn, I totally forgot about that one, as I was excited while I was exploring some information.
Thanks @"Maxx" for editing my post to look correct.

@h3r0: Do you have any suggestion how I might proceed to pen-test that site? I can then report the vulnerabilities to the Webmaster.


A

[lady_godiva]

Damn, I totally forgot about that one, as I was excited while I was exploring some information.
Thanks @"Maxx" for editing my post to look correct.

@h3r0: Do you have any suggestion how I might proceed to pen-test that site? I can then report the vulnerabilities to the Webmaster.


A

Hi @Artista

a form allows the user to insert some data and send it to the server. An example could be a login form. There should be some tutorial on the forum about SQL Injection but i think they are locked right now.

Anyway, a basic SQL Injection example is the following. Consider this query:

SELECT * FROM Table WHERE username='$user' AND password='$pass'

which selects all the row in table called Table where user and pass are the same that you provided in the form.

if we set for example $user = or '1' = '1
$pass = or '1' = '1

the resulting query will be:
SELECT * FROM Tabella WHERE username='' or '1' = '1' AND password='' or '1' = '1'

It he query above is not sanitized, the SQL statement will be executed as it is and will evaluate 1 = 1 which is always true. This is however the most basic example, SQL Injection can be a very complex technique so i suggest you studying a little bit about it searching in Google etc. Then of course feel free to ask if there's something you don't understand.