├── hom.png ├── download.png ├── images ├── who.jpg ├── head2.png ├── marine.jpg ├── marine_ford.jpg ├── Gear_Four_luffy.jpg ├── straw_hat_crew.jpg ├── Newgate_Vs_Teach.jpg └── Whitebeard_luffy_ace.jpg ├── local file disclosure using SQL Injection.pdf ├── dsqli.sql ├── README.md ├── head.php └── index.php /hom.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/hom.png -------------------------------------------------------------------------------- /download.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/download.png -------------------------------------------------------------------------------- /images/who.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/who.jpg -------------------------------------------------------------------------------- /images/head2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/head2.png -------------------------------------------------------------------------------- /images/marine.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/marine.jpg -------------------------------------------------------------------------------- /images/marine_ford.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/marine_ford.jpg -------------------------------------------------------------------------------- /images/Gear_Four_luffy.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/Gear_Four_luffy.jpg -------------------------------------------------------------------------------- /images/straw_hat_crew.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/straw_hat_crew.jpg -------------------------------------------------------------------------------- /images/Newgate_Vs_Teach.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/Newgate_Vs_Teach.jpg -------------------------------------------------------------------------------- /images/Whitebeard_luffy_ace.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/images/Whitebeard_luffy_ace.jpg -------------------------------------------------------------------------------- /local file disclosure using SQL Injection.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/Local-file-disclosure-SQL-Injection-Lab/HEAD/local file disclosure using SQL Injection.pdf -------------------------------------------------------------------------------- /dsqli.sql: -------------------------------------------------------------------------------- 1 | -- phpMyAdmin SQL Dump 2 | -- version 3.4.7 3 | -- http://www.phpmyadmin.net 4 | -- 5 | -- Host: localhost 6 | -- Generation Time: Mar 12, 2017 at 08:09 PM 7 | -- Server version: 5.5.17 8 | -- PHP Version: 5.6.12 9 | 10 | SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO"; 11 | SET time_zone = "+00:00"; 12 | 13 | 14 | /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; 15 | /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; 16 | /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */; 17 | /*!40101 SET NAMES utf8 */; 18 | 19 | -- 20 | -- Database: `dsqli` 21 | -- 22 | 23 | -- -------------------------------------------------------- 24 | 25 | -- 26 | -- Table structure for table `download` 27 | -- 28 | 29 | CREATE TABLE IF NOT EXISTS `download` ( 30 | `id` int(4) NOT NULL AUTO_INCREMENT, 31 | `image_name` varchar(225) NOT NULL, 32 | `location` varchar(225) NOT NULL, 33 | PRIMARY KEY (`id`) 34 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=6 ; 35 | 36 | -- 37 | -- Dumping data for table `download` 38 | -- 39 | 40 | INSERT INTO `download` (`id`, `image_name`, `location`) VALUES 41 | (1, 'Marine ford', 'images/marine.jpg'), 42 | (2, 'Luffy fourth gear', 'images/Gear_Four_luffy.jpg'), 43 | (3, 'Newgate Vs Teach', 'images/Newgate_Vs_Teach.jpg'), 44 | (4, 'straw-hat crew', 'images/straw_hat_crew.jpg'), 45 | (5, 'Whitebeard luffy ace ', 'images/Whitebeard_luffy_ace.jpg'); 46 | 47 | /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */; 48 | /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */; 49 | /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; 50 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Local-file-disclosure-SQL-Injection-Lab 2 | This is sample code to demonstrate how one can use SQL Injection vulnerability to download local file from server in specific condition 3 | 4 | exploit SQL Injection vulnerability in file download function which download file from server on the basis of output 5 | returned by vulnerable SQL query. 6 | Let’s consider scenario in which, there is one user supplied parameter which is getting process in SQL query and after processing, SQL query is returning location of the file. Now, let’s suppose that value returned by SQL query is getting pass to a function which download local file from server. In this case if user input is not getting check by web application, in that case attacker can easily manipulate SQL query to download any file from server with known location (file must have read permission on it). 7 | 8 | You can download detailed Paper from here 9 | Local file disclosure using SQL Injection 10 | 11 | To setup this lab on your machine, create database with name dsqli 12 | grant all privileges on that database for user with 13 | username = dsqli 14 | and 15 | password = icadsqli 16 | 17 | To create database and user which will be having read permission on the database, just follow given below process: 18 | 19 | --> Login to MySQL console with root account 20 | 21 | Command to create new database: -Create database dsqli; 22 | 23 | Command to create user dsqli with password icadsqli which will be 24 | having read/write permission on database dsqli: - 25 | 26 | grant all on dsqli.* to dsqli@localhost IDENTIFIED BY 'icadsqli'; 27 | 28 | Once you have setup database and user account, just import the database 29 | 30 | dump file (dsqli.sql which is available with the sample code) to database dsqli. 31 | 32 | Introdunction page 33 | 34 | 35 | 36 | Vulnerable page 37 | 38 | 39 | --==[[ With Love from Team IndiShell ]]==-- 40 | 41 | --==[[ Greetz To ]]==-- 42 | Zero cool, code breaker ICA, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, 43 | Baba, Silent poison India, Magnum sniper, ethicalnoob Indishell, Local root indishell, Irfninja 44 | indishell, Reborn India,L0rd Crus4d3r,cool toad, Hackuin, Alicks,Gujjar PCP,Bikash,Di nelson 45 | Amine,Th3 D3str0yer, SKSking, rad paul,Godzila,mike waals,zoo zoo,cyber warrior,shafoon, 46 | Rehan manzoor, cyber gladiator,7he Cre4t0r,Cyber Ace, Golden boy INDIA,Ketan Singh, D2 47 | Yash, Aneesh Dogra, AR AR, saad abbasi, hero, Minhal Mehdi, Raj bhai ji, Hacking queen, 48 | lovetherisk, D3. 49 | --==[[ Love to To ]]==-- 50 | My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, 51 | Rafay Baloch, Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Jagriti, Salty, Hacker fantastic, 52 | Jennifer Arcuri and Don(Deepika kaushik), Govind 53 | -------------------------------------------------------------------------------- /head.php: -------------------------------------------------------------------------------- 1 | 8 | 9 | 10 | 11 | --==[[IndiShell Lab]]==-- 12 | 13 | 151 | 162 | '; 163 | 164 | echo $head ; 165 | 166 | echo ' 167 | 168 | 169 |
170 | 171 | ####################################################################################################################################
172 | --==[[ Local File disclosure using SQL Injection ]]==--
173 | --==[[ With Love From Team IndiShell ]]==-- 174 |
175 |
177 | 178 | ####################################################################################################################################
179 | 181 | 182 | 183 | 184 |
185 | '; 186 | ?> -------------------------------------------------------------------------------- /index.php: -------------------------------------------------------------------------------- 1 | alert('file not found');"; 23 | } 24 | 25 | } 26 | 27 | $conn = mysqli_connect("127.0.0.1","dsqli","icadsqli","dsqli"); 28 | 29 | if(isset($_POST['image_download'])) 30 | { 31 | 32 | $news="select * from download where id=".$_POST['image']; 33 | if($result = mysqli_query($conn, $news)){ 34 | while($row = mysqli_fetch_assoc($result)) 35 | { 36 | $file=$row['location']; 37 | file_download($file); 38 | 39 | } 40 | } 41 | 42 | 43 | else { 44 | echo "something went wrong"; 45 | } 46 | } 47 | 48 | include('head.php'); 49 | 50 | 51 | 52 | 53 | 54 | echo '
55 | 56 | 57 | 60 | 63 | 64 | 67 |
58 | 59 | 61 | 62 | 65 | 66 |
68 |
'; 69 | 70 | if(isset($_POST['home'])) 71 | { 72 | 73 | echo '

This Lab is just to demonstrate how SQL Injection can be exploited to perform local file disclosure
if application if allowing user to download files on the basis of vulnerable SQL query'; 74 | 75 | } 76 | 77 | if(isset($_POST['downloads'])) 78 | { 79 | 80 | echo ' 81 | 82 |
Serial NumberImage nameImage LinkDownload
83 | 84 | '; 85 | $run='select * from download'; 86 | $result = mysqli_query($conn, $run); 87 | 88 | if (mysqli_num_rows($result) > 0) 89 | { 90 | 91 | while($row = mysqli_fetch_assoc($result)) 92 | { 93 | echo ''; 94 | } 95 | } 96 | echo '
'.$row['id'].''.$row['image_name'].'Open Image
'; 97 | 98 | 99 | } 100 | 101 | 102 | 103 | if(isset($_POST['us'])) 104 | { 105 | echo ' 106 | 107 | 108 |

112 | --==[[Greetz to]]==--
Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba ,Silent poison India,Magnum sniper,ethicalnoob Indishell,Local root indishell,Irfninja indishell
Reborn India,L0rd Crus4d3r,cool toad,Hackuin,Alicks,Gujjar PCP,Bikash,Dinelson Amine,Th3 D3str0yer,SKSking,rad paul,Godzila,mike waals,zoo zoo,cyber warrior,shafoon, Rehan manzoor
cyber gladiator,7he Cre4t0r,Cyber Ace, Golden boy INDIA,Ketan Singh,Yash,Aneesh Dogra,AR AR,saad abbasi,hero,Minhal Mehdi ,Raj bhai ji , Hacking queen ,lovetherisk and rest of TEAM INDISHELL
113 | --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,Gujjar PCP, 114 | Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)

115 | 116 | 117 | 118 |
119 | 120 | '; 121 | 122 | } 123 | 124 | 125 | 126 | ?> 127 | 128 | --------------------------------------------------------------------------------