2

A website of my client was compromised by a person claiming he/she has now access to the database. From the fact that this person sent an email saying "contact me and I will tell you where the hole is" I can only hope the access is limited to read-only.

I inspected access logs and found a script & unescaped GET request variable allowing to pass malicious probes

The attack started pretty usually:

xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:02 -0600] "GET /x.x?x=2 HTTP/1.1" 200 13785 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:02 -0600] "GET /x.x?x=2'A=0 HTTP/1.1" 200 181 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:03 -0600] "GET /x.x?region='0=A HTTP/1.1" 200 181 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"

Then it follows by queries like those

xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:03 -0600] "GET /x.php?x=(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+%2f**%2fcOnCaT(0x217e21,%2f**%2fvErSiOn(),0x217e21))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a) HTTP/1.1" 200 55 "http://x/x.php?x=(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+%2f**%2fcOnCaT(0x217e21,%2f**%2fvErSiOn(),0x217e21))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a)" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"

From what I can see the person got pretty good idea of how the database and its content looks like.

I would like to know what tool is being used to generate these probes after an unprotected input is found so I can run it myself to discover full scope of what the attacker could have gained access to.

We're talking about a PHP/MySQL legacy app without reliable input sanitisation here, so I guess the best way to see what's wrong is to run some security scanner myself.

How can I resolve it?

Solution

The tool I required to scan that website for more issues & to try to exploit them && fix them was sqlmap. I hope it helps somebody in the future.

  • If is solved, remove the "Solved" from the title and mark the answer as valid response. – OscarAkaElvis Jul 5 '17 at 22:26
  • I missed the "solved" check next to possible answers. Thanks, done. – Jan Klan Jul 6 '17 at 23:39
2

It doesn't matter which tool was used.

Even if you knew which tool was used, it doesn't mean that the tool would necessarily be able to exploit all that can be exploited.

If your app is vulnerable to SQL injection, then in all likelihood no tool at all is needed by even a moderately-skilled attacker to do anything that can be done with the database credentials the web server is using to access the database.

You have an application with a known vulnerability to SQL injection. It should be taken offline until fixed. You already have logs pointing you to the mechanisms the tool appears to have successfully exploited, so you already know where at least one vulnerability is -- in x.php or one of its dependencies. You should also be able to simply replay the logged requests with curl.

0

I think that the tool is Havij Pro or Jsql
Some SQLi exploit should be written manually to work out , so sometimes the tool fuzzing won't be useful , but it is still a good idea to check your code with these tools .

0

The tool I required to scan that website for more issues & to try to exploit them && fix them was sqlmap. I hope it helps somebody in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.