In MySQL and MariaDB the official methods of commenting would be
|
1 2 3 |
-- # /* comment */ |
The ‘#’ is also known as a “fragment identifier” and is typically used to identify a portion of an HTML document that sits within a fully qualified URL.
When passing ‘#’ inside a URL to the back-end database we can use ‘%23’.
(more…)
For this year’s birthday the most awesome gift I received was from hasherazade 🙂
I am very thankful to her for making my birthday so special 🙂
This crackme is a bootloader written in 16-bit assembly. This is how this look like.
This is a crash I found in MySQL versions up to 5.5.45. In the function procedure analyse() I found this crash while passing a sub query.
Syntax:
|
1 |
SELECT * FROM `table_name` PROCEDURE ANALYSE((SELECT*FROM(SELECT 1)x),1) |
So an Example POC would be:
|
1 |
select * from information_schema.tables procedure analyse((select*from(select 1)x),1); |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
--------------------------------------------------------------------------------------------------------------- mysql> select * from information_schema.tables procedure analyse((select*from(select 1)x),1); ERROR 2013 (HY000): Lost connection to MySQL server during query mysql> mysql> select 1; ERROR 2006 (HY000): MySQL server has gone away No connection. Trying to reconnect... ERROR 2003 (HY000): Can't connect to MySQL server on 'localhost' (10061) ERROR: Can't connect to the server mysql> --------------------------------------------------------------------------------------------------------------- |
By checking the parent process of a given process we can determine if the process is being debugged or not by expecting “explorer.exe” to be the usual parent process started by the user.
For this technique the following Windows APIs are used.
We also use a pointer to PROCESSENTRY32 structure which will store the information of each process taken from the snapshot.
[code language=”C”]
typedef struct tagPROCESSENTRY32 {
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID;
ULONG_PTR th32DefaultHeapID;
DWORD th32ModuleID;
DWORD cntThreads;
DWORD th32ParentProcessID;
LONG pcPriClassBase;
DWORD dwFlags;
TCHAR szExeFile[MAX_PATH];
} PROCESSENTRY32, *PPROCESSENTRY32;
[/code]
I got listed in the Dato Capitol Hall of Fame for reporting a XSRF issue in their website.
https://en.datocapital.com/report-security-issue.html
A simple tool to convert the IP to different obfuscated forms written in C by me 🙂 I just wrote this for fun. You may use this when it comes bypassing application filters and much more 🙂
Example:
IP address of http://google.lk : http://222.165.163.91
Other forms you can write the same IP:
[+] http://3735397211
(more…)
This is another simple anti-reversing trick used to detect a debugger. As I have shown earlier in my post about the TEB structure and the PEB structure, NtGlobalFlag is located in the PEB Structure at offset PEB+104.
When the process is being debugged the NtGlobalFlag is set to 0x70.
I was interested in learning about the anti-reversing techniques in the world of reverse engineering. There are so many techniques out there and I thought of trying few techniques and understanding them from the lowest level. I thought of sharing the things I’ve been experimenting these days.
IsDebuggerPresent is a Windows API that can be used to detect a debugger. Here’s an example code:
[code language=”C”]
/*
* IsDebuggerPresent Example
* Author: Osanda Malith Jayathissa (@OsandaMalith)
* Website: http://osandamalith.wordpress.com
*/
#include <windows.h>
int main() {
MessageBox(0, IsDebuggerPresent() ? "Debugger found" : "Debugger not found","Status",0x30);
}
[/code]
If we open in a debugger “Debugger Found” text will get triggered in the MessageBox API. How this API works? Open the API in the debugger and you get the following piece of code.
[code language=”C”]
MOV EAX,DWORD PTR FS:[18]
MOV EAX,DWORD PTR DS:[EAX+30]
MOVZX EAX,BYTE PTR DS:[EAX+2]
[/code]
(more…)
When we try to open a compiled AutoIT application in a debugger we get this error message.
Let’s try to find the return address from the MessageBoxA API from the stack.
(more…)
This is a application which I coded in last year but I have forgotten to make a blog post. Using this tool you can create a ‘..’ folder in Windows and store your data inside it. No one can access your files using the explorer since the path is not valid, they can only see the name 🙂
This trick can be used in pentesting and is widely used by malware for hiding other malicious files. I coded this tool just for fun 😀
