From SQLI to Shell.pdf

(654 KB) Pobierz
FROM SQL INJECTION TO SHELL
By Louis Nyffenegger <Louis@PentesterLab.com>
PentesterLab.com » From SQL Injection to Shell
Table of Content
Table of Content
Introduction
About this exercise
License
Syntax of this course
The web application
2
4
5
5
5
6
Fingerprinting
Inspecting HTTP headers
Using a directory Buster
8
8
10
Detection and exploitation of SQL injection
Detection of SQL injection
Introduction to SQL
Detection based on Integers
Detection on Strings
12
12
12
14
18
Exploitation of SQL injections
The UNION keyword
Exploiting SQL injections with UNION
Retrieving information
20
20
21
24
Access to the administration pages and code execution
Cracking the password
Uploading a Webshell and Code Execution
30
30
33
Conclusion
36
2/36
PentesterLab.com » From SQL Injection to Shell
3/36
PentesterLab.com » From SQL Injection to Shell
Introduction
This course details the exploitation of SQL injection in a PHP based website and how
an attacker can use it to gain access to the administration pages. Then, using this
access, the attacker will be able to gain code execution on the server.
The attack is divided into 3 steps:
1. Fingerprinting: to gather information on the web application and
technologies in use.
2. Detection and exploitation of SQL injection: in this part, you will learn
how SQL injections work and how to exploit them in order to retrieve
information.
3. Access to the administration pages and code execution: the last step
in which you will access the operating system and run commands.
4/36
PentesterLab.com » From SQL Injection to Shell
About this exercise
License
From SQL Injection to Shell by
PentesterLab
is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs 3.0 Unported License. To view a copy of this
license, visit
http://creativecommons.org/licenses/by-nc-nd/3.0/.
Syntax of this course
5/36

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin