逐浪CMSSQL注入及绕过

简要描述： 官网及demo站点演示，绕过注入过滤。 详细说明： 这个点： http://www.zoomla.cn/Search/SearchList.aspx?node=1%20aNd%20@@version%3E0&keyword=2013 http://demo.zoomla.cn/Search/SearchList.aspx?node=1%20aNd%20@@version%3E0&keyword=2013 这样一下：...

Hostscan - PHP tool for scanning specific range of hosts

Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side soft. How it...

SQL Servers MSSQL Vendor-specific SQL Injection

SQL injection techniques can allow remote attackers to execute SQL commands on SQL servers. Successful exploitation could allow attacker to disclose confidential information, modify or shut down the database or execute arbitrary code on affected servers...

博云非书资料管理系统SQL注入

简要描述： JSP+MSSQL，能搜到的使用该系统的网站不多，但多为大学学院使用 详细说明： 注入点: http://211.68.196.67:808/poweb/asearch.do?LanguageType=0&status=showpage 参数:LanguageType C:\Python27\sqlmapsqlmap.py -u "http://211.68.196.67:808/poweb/asearch.do?Langu ageType=0&status=showpage" --dbms=mssql sqlmap/1.0-dev - automatic SQL...

强智教务系统延时注入一枚

简要描述： 好多sa啊 详细说明： 看了一下乌云好像没人提交这个页面的注入，我就来提交一下吧详细如下 1、建站程序类型：ASP+MsSql 2、漏洞类型：SQL注入 3、缺陷文件：/Loginxsmm.asp 4、注入参数：XH 5.涉及版本：未知，求厂商明细 7、危害程度：高危 8、涉及厂商：湖南强智科技发展有限责任公司 9、厂商网站：http://www.qzdatasoft.com/ 10、安装量：非常大，案例页面：http://www.qzdatasoft.com/cgal.html 11、是否拥有源代码分析：暂无...

用友协作办公平台再次通杀SQL注入

简要描述： 用友协作办公平台再次通杀SQL注入 由于绝大部分系统采用的是MSSQL,权限非常大，返回的shell 不是system 就是administrator 详细说明： 1 漏洞文件 /witapprovemanage/appraupNew.jsp 漏洞代码如下 % Dao dao = DaoResourceManage.getContext"dao"; String masterkey = ""; FieldSet fswm = null; String tablenameStr = ""; ifrequest.getParameter"flowid"!=null masterk...

MSSQL 2000MSDE Resolution Buffer Overflow - Ver2 (CVE-2002-0649)

A buffer overflow vulnerability has been reported in Microsoft MSDE and Microsoft SQLServer. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...

[Responder] a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server

Responder is a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. This tool is first an LLMNR and NBT-NS responder, it will answer to specific NBT-NS NetBIOS Name...

DirectControlTM 3.1.7.0 - Multiple Vulnerabilities

DirectControlTM 3.1.7.0 - Multiple Vulnerabilities DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home :...

Critical: php

Issue Overview: The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of...

LimeSurvey 2.00+ (build 131107) - Multiple Vulnerabilities

LimeSurvey 2.00+ build 131107 - Multiple Vulnerabilities LimeSurvey v2.00+ build 131107 Script Insertion And SQL Injection Vulnerability Vendor: LimeSurvey Project Team Product web page: http://www.limesurvey.org Affected version: 2.00+ build 131009 2.00+ build 131022 2.00+ build 131031 2.00+...

LimeSurvey v2.00+ (build 131107) Script Insertion And SQL Injection Vulnerability

Summary LimeSurvey formerly PHPSurveyor is a free and open source on-line survey application written in PHP based on a MySQL, PostgreSQL or MSSQL database, distributed under the GNU General Public License. As a web server-based software it enables users to develop and publish on-line surveys, and...

[Patator v0.5] Multi-purpose brute-forcer, with a modular design and a flexible usage

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage. Currently it supports the following modules: ftplogin : Brute-force FTP sshlogin : Brute-force SSH telnetlogin : Brute-force Telnet smtplogin : Brute-force SMTP smtpvrfy : Enumerate valid users using the SMTP VRF...

[SET v5.1] The Social-Engineer Toolkit codename “Name of the Doctor”

The Social-Engineer Toolkit SET version 5.1 codename “ Name of the Doctor ” has been released. This version adds a complete rewrite of the MSSQL Bruter as well as a new attack vector utilizing the PSExec functionality within Metasploit. The MSSQL Bruter now incorporates UDP port 1434 quick...

Unofficial Pakistan Intelligence website hacked

While the rest of the world engaged in cyber security conferences and Anonymous operations, an Indian patriotic hacker used the time to attack Unofficial Pakistan Intelligence agency ISI. Hacker going by name "Godzilla" today claimed to hack into one of the server belongs to ISI website...

Unofficial Pakistan Intelligence website hacked

While the rest of the world engaged in cyber security conferences and Anonymous operations, an Indian patriotic hacker used the time to attack Unofficial Pakistan Intelligence agency ISI. Hacker going by name "Godzilla" today claimed to hack into one of the server belongs to ISI website...

Nmap NSE 6.01: ms-sql-info

Attempts to determine configuration and version information for Microsoft SQL Server instances. SQL Server credentials required: No will not benefit from 'mssql.username' & 'mssql.password'. Run criteria: Host script: Will always run. Port script: N/A NOTE: Unlike previous versions, this script...

MSSQL Password Hashdump

This module extracts the usernames and encrypted password hashes from a MSSQL server and stores them for later cracking. This module also saves information about the server version and table names, which can be used to seed the wordlist. This module requires Metasploit:...

Microsoft SQL Server Database Link Crawling Command Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Encrypt Database Password in dbconfig.xml or use integrated authentication

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-31004. panel JIRA should Encrypt the database password since it's in plain text in the dbconfig.xml file or it could use the integrated...