Re: how to exploit SQL INJECTION?

From: Sugiowono (sugiowono_at_datacomm.co.id)
Date: 06/22/05

  • Next message: Chris Byrd: "Re: Risks associated to branch office IPSec devices" 
    To: Pablo Fernández <newsclient@teamq.info>
Date: Tue, 21 Jun 2005 22:46:25 -0700

    Hi All,

    Sorry for directly mail to you because my mail was always rejected by
    securityfocus.

    I had scanned my net using , and found a SMTP warning CVE-2002-0698 and told
    that we can remotely connect to that server using smtp service as a null
    session.

    1. Do you have a exploit code for CVE-2002-0698 ?
    2. If i already succeed connect as null session, what is the next step ? do
    you have doc about it.

    thanks for your attention,
    Sugiowono

    ----- Original Message -----
    From: "Pablo Fernández" <newsclient@teamq.info>
    To: "Pablo Escobar" <slackware77@gmail.com>
    Cc: <pen-test@securityfocus.com>; <nessus@list.nessus.org>; "Bugtraq"
    <bugtraq@securityfocus.com>
    Sent: Tuesday, June 21, 2005 3:22 PM
    Subject: Re: how to exploit SQL INJECTION?

    Well, exploiting a vulnerable SQL Injection site is very easy, you can
    do it directly from your browser (even with dillo, links, wget, axel!)
    (altough a PERL script is much more confortable).

    If nessus told you you have some script vulnerable you can exploit them
    hitting with your browser a URL such as
    http://>/resources/expand_subject.asp?id='UNION'
    That's assuming the script vulnerable is reachable directly using the
    LAN IP of the server, if you are using vhost in the HTTP server you
    should use it in the previous URL.

    I hope this is clear enough, I could have written this message in
    spanish, which I guess is your mother tongue, English used for the
    mailing's list sake.

    Saludos y suerte,
    Pablo Fernández

  • Next message: Chris Byrd: "Re: Risks associated to branch office IPSec devices"

    Relevant Pages

    • Re: how to exploit SQL INJECTION?
      ... Well, exploiting a vulnerable SQL Injection site is very easy, you can ... do it directly from your browser ... LAN IP of the server, if you are using vhost in the HTTP server you ... vulnerabilities to learn how to exploit it, I searched in google and i ...
      (Pen-Test)
    • Re: Got TCP/IP connection, but no file sharing!?
      ... No where can I find that having the Computer Browser Service ... and the server announces itself on the networking using the special ... and why doesn't a workgroup environment work the same ... server) generally acts as the master browser. ...
      (microsoft.public.windowsxp.network_web)
    • Re: =?ISO-8859-1?Q?Can=92t_see_a_compute?= =?ISO-8859-1?Q?r_in_the_network?=
      ... Find Computer Browser ... Find Server ... Find Workstation ... CONFIG and Browser and Sharedaccess are RUNNING. ...
      (microsoft.public.windowsxp.network_web)
    • Re: After setting up the network
      ... Find Computer Browser ... Find Server ... PsService v2.20 - Service information and configuration utility ... CPSServ Comprehensive Networking Services V1.10 - PERRINS2 ...
      (microsoft.public.windowsxp.network_web)
    • Re: CUPS Server Error
      ... Server Identity ... > # Classification: the classification level of the server. ... the default language if not specified by the browser. ... determines whether the scheduler will allow new printers ...
      (Debian-User)