Read-only archive

A preserved archive of the Logical Gamers community forums, 2009-2025. The original threads and posts, served read-only. Registration, posting and private messages are gone for good.

Military.com URL injection

1.4k views · started by GAMEchief ·
#1
Military.com URL injection
Found this image in the Junkyard. Check it out. Has all sorts of MySQL and header data in the $_GET value, lol. You could set this to be anything. I'm wondering if blobheadervalue2 takes external URLs. Or what custom headers could be sent to do something worthwhile.
I tried changing blobtable to MungoBlobs; DROP TABLE MungoBlobs, but to no avail. You guys can prolly find something if you tried. It's freakishly late, so I don't have time to think, so good luck. Figured I'd share this, as I found it hilarious considering it's on a government website.

http://images.military.com/cs/Satellite?blobcol=urldata&blobheadername1=Content-Type&blobheadername2=Content-Disposition&blobheadervalue1=image/jpeg&blobheadervalue2=inline;filename%3DSmartWeapon_111109.jpg&blobkey=id&blobnocache=false&blobtable=MungoBlobs&blobwhere=1209982875284&ssbinary=true

images.military.com/cs/Satellite
?blobcol=urldata
&blobheadername1=Content-Type
&blobheadername2=Content-Disposition
&blobheadervalue1=image/jpeg
&blobheadervalue2=inline;filename%3DSmartWeapon_111109.jpg
&blobkey=id
&blobnocache=false
&blobtable=MungoBlobs
&blobwhere=1209982875284
&ssbinary=true
#2
Wait I don't get what your saying.
Did you take that picture or something.
#3
No. It's from the military official website. But the URL to the picture allows you to modify a lot of the server-side variables, which is stupid and exploitable. If you aren't familiar with server-side variables, don't worry about it.
#4
GAMEchief wrote:
No. It's from the military official website. But the URL to the picture allows you to modify a lot of the server-side variables, which is stupid and exploitable. If you aren't familiar with server-side variables, don't worry about it.


blobkey looks the most exploitable, if it is what I think it is you should be able to put your inject right there with ease.
#5
Seems a bit risky but I've been messing around with it. You can get it to give you a bit of info but none of it is to use.
#6
Chris wrote:
blobkey looks the most exploitable, if it is what I think it is you should be able to put your inject right there with ease.

I was thinking blobtable, but yes, blobkey would be great at sniffing information. Especially if you changed Content-Type to text/html.
I'm having no luck without seeing how the information is parsed, though. It just keeps giving me server errors. >=[
#7
Oh shit. I thought at first you were trying to hack the Military... I was like you are a dumb fuck... then I got that it just appears different to you. xD. Good job. xD
#8
BooBearSH wrote:
Oh shit. I thought at first you were trying to hack the Military... I was like you are a dumb fuck... then I got that it just appears different to you. xD. Good job. xD

If one could get the SQL injection to work, one could actually hack the military. But going as blindly as one must, it's pretty impossible to figure out where things are and what protection there is against it.
Like you're in a room - a huge room. And somewhere on the wall is a button that will give you access all military information in this specific database (which we don't know what all is in it). But you're blindfolded and the room is full of holes, pits, and non-vital traps. It could take forever, and is virtually impossible, but possible to find that button.
And it would be very possible, but it seems that have SQL injection protection against DROP TABLE (not surprising). :(
The question is merely how much protection do they have and how does one bypass it.
#9
GAMEchief wrote:
If one could get the SQL injection to work, one could actually hack the military. But going as blindly as one must, it's pretty impossible to figure out where things are and what protection there is against it.
Like you're in a room - a huge room. And somewhere on the wall is a button that will give you access all military information in this specific database (which we don't know what all is in it). But you're blindfolded and the room is full of holes, pits, and non-vital traps. It could take forever, and is virtually impossible, but possible to find that button.
And it would be very possible, but it seems that have SQL injection protection against DROP TABLE (not surprising). :(
The question is merely how much protection do they have and how does one bypass it.


I was thinking is it possible they have it set up to a set amount of possible inputs and you cannot properly inject because they are not one of those set possibilities?
#10
Possibly, but if that were the case, I'd imagine they'd just use numerical IDs instead of text references.
#11
GAMEchief wrote:
Possibly, but if that were the case, I'd imagine they'd just use numerical IDs instead of text references.


Yeah that's why I was arguing with myself about that :P

It just trips me out to think there would be that large of a vulnerability, for images.
#12
wow thats pretty smart GameChief good find