Reverse Shell Employee Portal:
1. The Default credentials of the employee portal did not work and
hence we can try to bypass authentication using sql injection.
2. This can be done by providing the payload – ‘ OR 1=1# in the user
name field or in the password field.
3. Once logged in, check for any GET requests where parameters are
sent in URL.
4. On providing the single quote to the id parameter, the application
disclosed the sql database error.
5. Now try to balance the sql query on the id parameter using --+ or --
#
6. On providing the payload ‘ --+ it is observed that the sql query is
balanced and it displays the valid output.
7. Now try to find the web path from the error statement. From the
error, it is observed that the path - “C:\xampp\htdocs\
employee_monitoring_system\downloadable_student.php”.
8. Now find the number of columns by finding the order number using
ORDER BY.
9. It is observed that the order number 8 is giving valid response and 9
gives an error. This confirms that there are 8 columns.
10. Now use union statements to find out which column output is
getting displayed in the website.
11. From the output it is observed that the columns 3,4,7,8 are
vulnerable and these columns can be used to display sensitive info
from the database.
12. As shown in above figure, used 3 rd column to retrieve
database name by adding database() command, it gives database
name capstone in the response.
13. The sql commands can be used to create files in the remote
server using outfile command. Writing or creating a file with server
side webshell payload: union select 1,2,3,4,5,6,7,8, into outfile " C:\
xampp\htdocs\employee_monitoring_system\\[Link]" --+
14. But now to add code in the php file, add the php reverse shell
command to any vulnerable column in the url.
15. Providing the command to the outfile discloses an error. Now
try to browse the [Link] file in url and add command in a cmd
parameter.
16. We can see the output for the command mentioned in the url.
Login Bypass College Portal:
1. Tried to bypass authentication using sql injection.
2. This can be done by providing the payload – ‘ OR 1=1# in the user
name field or in the password field.