Friday, January 25, 2008
at
3:40 PM
Posted by
SONU MISHRA
Some More Example Of SQL INJECTION
Continued from the last post,in this post, we will see some real example of the SQL Injection.
For the LOGIN Form :-
user:admin (you dont even have to put this.)
pass:' or 1=1--
or
user:' or 1=1--
admin:' or 1=1--
some sites will have just a password so
password:' or 1=1--
The injection attack has actually made our query behave differently than we intended. By using a single quote (') they have ended the string part of our MySQL query username = ' ' and then added on to our WHERE statement with an OR clause of 1 (always true). username = ' ' OR 1 This OR clause of 1 will always be true and so every single entry in the "customers" table would be selected by this statement!
Although the above example displayed a situation where an attacker could possibly get access to a lot of information they shouldn't have, the attacks can be a lot worse. For example an attacker could empty out a table by executing a DELETE statement.
MySQL & PHP Code:
$name_evil = "'; DELETE FROM customers WHERE 1 or username = '"; // our MySQL query builder really should check for injection $query_evil = "SELECT * FROM customers WHERE username = '$name_evil'"; // the new evil injection query would include a DELETE statement echo "Injection: " . $query_evil;
Display:
SELECT * FROM customers WHERE username = ' '; DELETE FROM customers WHERE 1 or username = ' ' If you were run this query, then the injected DELETE statement would completely empty your "customers" table.
Sunday, January 20, 2008
at
12:04 PM
Posted by
SONU MISHRA
SQL Injection
SQL injection is a strong password cracking technique that exploits a security vulnerability occurring in the database layer of an application.SQL Injection is subset of the an unverified/unsanitized user input vulnerability ("buffer overflows" are a different subset), and the idea is to convince the application to run SQL code that was not intended. If the application is creating SQL strings naively on the fly and then running them, it's straightforward to create some real surprises.
The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently concatenated into a dynamic SQL command, the malicious code is executed. The injection process works by prematurely terminating a text string and appending a new command. Because the inserted command may have additional strings appended to it before it is executed, the malefactor terminates the injected string with a comment mark "--". Subsequent text is ignored at execution time.
Example: var Shipcity; ShipCity = Request.form ("ShipCity"); var sql = "select * from OrdersTable where ShipCity = '" + ShipCity + "'";
The user is prompted to enter the name of a city. If she enters Redmond, the query assembled by the script looks similar to the following: SELECT * FROM OrdersTable WHERE ShipCity = 'Redmond' However, assume that the user enters the following: Redmond'; drop table OrdersTable-- In this case, the following query is assembled by the script: SELECT * FROM OrdersTable WHERE ShipCity = 'Redmond';drop table OrdersTable--' The semicolon (;) denotes the end of one query and the start of another. The double hyphen (--) indicates that the rest of the current line is a comment and should be ignored. If the modified code is syntactically correct, it will be executed by the server. When SQL Server processes this statement, SQL Server will first select all records in OrdersTable where ShipCity is Redmond. Then, SQL Server will drop OrdersTable. As long as injected SQL code is syntactically correct, tampering cannot be detected programmatically. Therefore, you must validate all user input and carefully review code that executes constructed SQL commands in the server that you are using. Coding best practices are described in the following sections in this topic.
Input characterMeaning in Transact-SQL
; Query delimiter.
' Character data string delimiter.
-- Comment delimiter.
/* ... */ Comment delimiters. Text between /* and */ is not evaluated by the server.
xp_ Used at the start of the name of catalog-extended stored procedures, such as xp_cmdshell.
Saturday, October 27, 2007
at
8:51 AM
Posted by
SONU MISHRA
Blocking Cell Phone Number From Seen in Caller IDs
Freinds after reading this article you will be able to block your cell phone number from showing up on other people's caller IDs. It's very simple to block your cell phone number. You have two options: you can permanently block your phone number or you can block your number on a call by call basis.
Blocking Your Cell Phone Number Permanently:
The most permanent solution is to request a "line block" from your cell phone carrier.
1) To do this you simply need to call the customer service for your specific provider and they can block your number. When you do this your number will never show up to anyone.
2) To call your customer service to block your cell phone number, just dial 611 from your cell phone and you will reach them.
3) If there is a situation where you want your number to show up, you will still have an option. When you have a permanent block on your cell phone number you will need to dial *82 before dialing the number you are calling. When you do this your phone number will show up just once for that specific call. Ex: *82 (555) 555-5555.
Blocking Your Cell Phone Number Temporarily:
Sometimes you may want to block you number for a specific call. You might not want someone to know that you are trying to reach them for the 15th time in a row, or you might be calling a business and might not want them to know your number.
1) If you want to block your cell phone number on a call by call basis you need to dial *67 before dialing the number. Ex *67 (555) 555-5555.
2) When you do this you will not have any feedback that it worked. If you want to test this, just call your home phone, or anther phone that has a caller ID from your cell to confirm that your phone number is blocked.
NOTE:One important thing to remember is that your number will not be blocked from emergency services or any toll free numbers.
How to Find the Owner of a Cell Phone Number:
If you want to identify and unidentified phone number you can with reverse phone number search websites. You can do free reverse phone number search at http://www.infospace.com/ but if you want to find out who owns a cell phone number then use http://www.cellreversesearch.com/.
Steps 1 Step One Go to www.cellreversesearch.com 2 Step Two Enter any phone number 3 Step Three Hit Search 4 Step Four Check Results 5 Step Five Sign up for owner's name, address and cell phone account history information
Tuesday, October 16, 2007
at
12:36 PM
Posted by
SONU MISHRA
Bluesnarfing-Mobile Hacking
What is Bluesnarfing? Ans:Bluesnarfing is the unauthorized access of information from a wireless device through a bluetooth connection, often between phones, desktops, laptops, and PDAs that allows access to calendar, contact list, emails and text messages, and on some phones users can steal pictures and private videos,from Mobile or any other bluetooth device.
Watch video for Bluesnarfing
BlueSnarf exploits weak OBEX implementation on mobile phoneBlueSnarfexploitsweakOBEXimplementationonmobilephonesOPP: Object push profile, unauthorised access, for vCardOPP:Objectpushprofile,unauthorisedaccess,for vCardsSYNCH: Profile for exchange of private dataSYNCH:ProfileforexchangeofprivatedataCalendar, contacts, pictures, …Calendar,contacts,pictures,…Authorised access!Authorisedaccess!.Adv connects to OBEX push profileNo authentication, no pairing needed .invisible connection .In vulnerable implementations:.SYNCH profile exists parallel to OPP .Adv: retrieve files via filenames .Unauthorised, via OPP profile !!! .e.g. GET telecom/pb.vcf (contacts) Bluetooth being short range technology: NO security feature!
Method In order to perfom a BlueSnarf attack, the attacker needs to connect to the OBEX Push Profile (OPP), which has been specified for the easy exchange of business cards and other objects. In most of the cases, this service does not require authentication. Missing authentication is not a problem for OBEX Push, as long as everything is implemented correctly. The BlueSnarf attack connects to an OBEX Push target and performs an OBEX GET request for known filenames such as 'telecom/pb.vcf' for the devices phone book or 'telecom/cal.vcs' for the devices calendar file. (There are many more names of files in the IrMC Specification). In case of improper implementation of the device firmware, an attacker is able to retrieve all files where the name is either known or guessed correctly.
