Hi ! This is my first article and I hope you guys will surely learn something new. I am not interested in disclosing the information about the website , so let’s assume it as example.com . So let’s jump into the hacking.
So as a beginner in cybersecurity I have been learning about lot of vulnerabilities and the method to exploit those. I had also learned about the vulnerability SQL Injection and some basic payloads that are quiet enough to bypass login pages that are not secure . So I began to execute the payloads on some random login pages but failure was the result , but I kept on trying and one day I suddenly came over this website and I tried to find out the admin login page by Google Dorking method.
intitle:admin OR inurl:admin site:example.com
This the command used in Google Dorking to get the admin login page of a website. But in the website where I tried , it was not enough to get the login page . So I started researching about some tools that can get the login pages of a website . Then I came over the tool called Breacher . This is a very powerful tool than can enumerate through the website and can get us the login pages available. So I installed the tool and executed the command in my Kali machine.
Finding login pages using Breacher tool
Found the admin login page!!!
and yeahhh!!! got the admin login page with the help of Breacher. I just visited the website and in the first glance itself I understood that the page was not secure much because there were no captcha verification or any other security steps . Just the username and password field only. This was how the page looked like.
Now i just tested with the basic SQL payloads into the both username and password field .
admin’ or ‘1’=’1
To my surprise I got the admin access and I was able to view the contents in the website.
Admin page
Every information was available in the website such as images , username alotted for each department , mails recerived etc.
But I was not satisfied with the above results , I was more eager to find the exact username and password used for the admin access. For this I need to hack the database of the website . So i started searching for tools for this purpose and came across SQLMap tool.
Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
To perform the attack with SQLMap I once again accessed the admin page and gave some random values in the username and password field . Here I gave ‘test’ in both the fields.
Now turn on the Burpsuite and turn the intercept on and capture the above login request .
Login request in Burpsuite
Now save the whole request as an XML document . Here I’m saving it as ‘sqli’.
Now the attack starts . I just opened the terminal and executed the following command
sqlmap -r sqli — dbs
When the above command was executed , I got the whole database available in the website.
Database fetched from the attack
I mainly got 5 available database from the website as shown above. Now i need to list the tables from the database where the suername and password is available. For that the following command was executed.
sqlmap -r sqli — dbms mysql -D a1445ff46_xx987liqtexxxxxxx — tables (‘x’ is used due to confidentiality).
Surprisingly it listed about 99tables in that particular database and in one specific table the admin username and password is available
To dump the username and passwords available I executed the below command.
sqlmap -r sqli — dbms mysql -D a1445ff46_cxx987liqtexxxxxxx -T xxx_users — dump
This gave me the username and password for the admin user !
As you can see in the Catutype row it’s admin and the Catuname and Catpwd represents the username and password. Then i tried to login the admin page using these credentials and it was successful!!!
After finding out this vulnerability soon i reported it to them expecting that they will patch it very soon.
Thankyou guys for your time . ❤
Follow me on LinkedIn
https://www.linkedin.com/in/bijoy-varghese-2209201b0/