Penetration Testing mailing list archives
Re: Injected, whats next
From: "Brendan Dolan-Gavitt" <mooyix () gmail com>
Date: Fri, 18 Aug 2006 11:04:06 -0400
You should be able to use SELECT ... INTO OUTFILE to write the results of a SELECT statement out to a file on the server's filesystem. Since you can SELECT things that don't actually reference any table, this should let you write arbitrary data to the filesystem with the permissions of the database user. Since it uses PHP, I would try to find a writable, web-accessible directory on the server and do something like SELECT '<?php some_evil_php_code ?>' INTO OUTFILE '/var/www/accessible_by_db/'; Have fun :) -Brendan On 8/17/06, DokFLeed <dokfleed () dokfleed net> wrote:
I am testing a web application, I can run UPDATE & SELECT Does anyone know a way to upload a file to a server through MySQL ! does it allow running system commands or a way to dump a file from the database to the server? its LAMP , Linux, Apache, MySQL, PHP any ideas!! Dok smoke dope, eat soap, fly home in a bubble ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- Re: SQL injection (or not?), (continued)
- Re: SQL injection (or not?) Mike Klingler (Aug 08)
- Re: SQL injection (or not?) A. Ramos (Aug 09)
- RE: SQL injection (or not?) Isidro Ramon Labrador Rodriguez (Aug 09)
- RE: SQL injection (or not?) Tonnerre Lombard (Aug 09)
- Re: SQL injection (or not?) DokFLeed (Aug 09)
- Injected, whats next DokFLeed (Aug 17)
- Re: Injected, whats next Jon Hart (Aug 18)
- RE: Injected, whats next Clemens, Dan (Aug 18)
- Re: Injected, whats next Serg B. (Aug 18)
- Message not available
- Re: Injected, whats next Serg B. (Aug 18)
- Re: Injected, whats next Brendan Dolan-Gavitt (Aug 18)
- Re: Injected, whats next DokFLeed (Aug 18)