XSS Filter Bypassing Techniques

Sometimes a simple XSS query just won't do the trick. The reason your query isn't working, is because the website has a WAF or Filter set in place. A filter will block as many XSS and SQLi queries as possible. In this case, we're dealing with XSS.

There are many ways on bypassing XSS filters, but I will only explain a few.

--XSS CrOss Site ScriPting

What is Xss?

Explenation.

The full name for Xss is cross site scripting.
You can take this name literally. Because we inject right into the site/ into the inputs.
Changing/editing html. which gives us the advantage to gather user information if they click the malicious input!.cross site scripting is injecting javascript and html into the inputs of a site.

     What is a cookie?

FULL PATH DISCLOSURE TUTORIAL

In this little write up today, I am going to try and explain you what 'FPD' is, how to detect it, analyze it, and some pretty good methods of finding it in the wild.

/* Note that my write up was intended to PHP-based websites, but some of the methods works for ASP/ASPX too. */

what is FPD

 FPD' (Stands for Full Path Disclosure) is one of the most common methods of attacks (While I doubt this kind of action categorized as a form of an attack, it is still a highly-related method of website security testing), that Pen-testers / Hackers / whatever use in order to gain an error which will expose the full installation path of the targeted site.

Why is this happening?

By default (Don't quote me here. Some web-services and packages disable this function, but partly in most cases), the PHP error reporting function -

Code:

error_reporting(0);

different hash types

diferent websites use different types of hashing technique to store their password in the database.So,one must identify the hash type in order to crack it.
here are the different types of hash:

DES(Unix)
Example: IvS7aeT4NzQPM
Used in Linux and other similar OS.
Length: 13 characters.
Description: The first two characters are the salt (random characters; in our example the salt is the string "Iv"), then there follows the actual hash.
Notes: [1] [2]

how to find admin page of a website

Today im gonna show how to find admin panels when you have info to login.

There's a few options to find it.

1) Adding to URL

http://www.site.com/admin
http://www.site.com/administrator
http://www.site.com/admin.php
http://www.site.com/login

Oracle SQL injection

Hello guys this is a tutorial about Oracle based SQL injection
Here is the site to learn with

PHP Code:

http://www.comune.taranto.it/citta/dettaglio_news.php?id_news=491&id_categoria=122 

Let's try order by

Basic SQL injection with Login Queries

Bypassing Login pages on websites using SQL injectable queries

Level: Beginners and Intermediate
Requirements: Patience and stradegy
Alright in this tutorial, we'll be learning how to bypass login pages with the help of MySequel injection using Login Queries. 

 

 What is SQL injection?
Answer: Basically, it's a process where you execute a certain query in a website in order to extract information such as log-in information, users etc. for either personal gain or random use from the website's database.

Postgre Errorbased sqli

Postgre:

Traditional relational database management systems (DBMSs) support a data model consisting of a collection of named relations, containing attributes of a specific type. In current commercial systems, possible types include floating point numbers, integers, character strings,
money, and dates.

Lets start to play with Postgre:

1st Step find the vulnerability:

Code:

http://www.creatop.com.cn/index.cfm?MenuID=80'

MSSQL [asp] Sql injection

The sql injection on asp is same as on php...but a little bit of changes are made...

So first of all we will find some site that is Vulnerable and is on .asp

So assume that u got a site with the name of

Code:

http://www.target.com/

Sybase sql injection tutorial

I will make a small tutorial on error based sybase sql injection

site link is:
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630

put a ' at the end and you will see this
Sybase: Server message: Unclosed quote before the character string ' '

now to get the version:

Quote:

PHP Code:

http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert%28integer,@@version%29-- 

MS-Access Injection

site link for this tutorial

http://www.sdhc.k12.fl.us/Schools/School_Info.asp?Site=0151

how do we know its vuln?like regular injection,typing " ' " in the end of the value.

Code:

www.sdhc.k12.fl.us/Schools/School_Info.asp?Site=0151'

 error 80040e14

How to know DB and method of injection

How to know SQL_DB and method of injection

MySQL server

| from error

PHP Code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax 

Using the query after link

cookie sql injection,injecting via cookie [session based]

this tut will teach you how how to sql inject via cookie [also known as 'session based' or 'cookie parameter'].
first install chrome and download cookie editor addon from Philip.

after goto vulnerable link:
www.vulnerable.com/x.php
open cookie editor

WAF Bypassing

What is a WAF?

WAF stands for Web Application Firewall. A WAF is put in place by the web applications administrator in an attempt to prevent attacks such as SQLi and XSS. They detect malicious attempts with the use of signature based filters and escapes defined within a list of rules. As a result of this design, they are vulnerable to being easily bypassed by obfuscating your exploit code.

Methods of Bypass

There are many more ways of bypassing these than I can list here but this is a basic overview of three common and easy methods to try first.

SIMPLE QUERY BASED SQL INJECTION TUTORIAL

The soul purpose o fthis tutorial is to show you how to perform query based sql injection technique to retrive admin username and password.This is very easy once  you understand everything.this tutorial is only for mysql version>5

1st step is to find a sql vulnerable link.This type of link can be found by the following type of google dork

"inurl:index.php?catid="
"inurl:news.php?catid="
"inurl:index.php?id="
"inurl:news.php?id="

all with out "
we are here taking the following site

http://www.dynamicinst.net/news.php?id=25

HOW TO HACK ASPX SITES

 THIS TUTORIAL IS ONLY FOR EDUCATIONAL PURPOSES AND I AM NOT RESPONSIBLE FOR ANYTHING  YOU DO  ILLEGAL

i am going to give a tutorial on how to hack a aspx site.

the procedure are given below

the url in which the attack will be done is:

http://sterlitelubricants.com/automotive.aspx?state=viewpage&id=6

or

http://sterlitelubricants.com/automotive.aspx?state=viewpage&id=1

1st step:

http://sterlitelubricants.com/automotive.aspx?state=viewpage&id=6 ' having 1=1--

it will give the following error

BASIC ADMIN BYPASS

A injecting sql queries into another database or using queries to get auth bypass as an admin.

 Basic sql injection

Gaining auth bypass on an admin account.
Most sites vulnerable to this are .asp
First we need 2 find a site, start by opening google.
Now we type our dork: "defenition of dork" 'a search entry for a certain type of site/exploit .ect"
There is a large number of google dork for basic sql injection.
here is the best:
"inurl:admin.asp"