who's gonna help with https, mysql and php

[bhubert1978]

hello everybody,

let me just tell some little stuff about myself. I am a real newbie to this "genre" of computing and actually it is just because of a little thing I would like to accomplish. I have some knowledge of HTML, PHP and mySQL but I never tried to hack anything.

Anyway - my problem is: there is a mySQL database, and a web application (php, over https) is programmed over it. It is a basically a user database where I am also a user, and a dataset itself.

There are a lot of tables which show other user information from various other tables.

My goal is now: I would like to create exactly one dataset for my user with some data which is currently not available on my user.

Now I have tried so much I have read tutorials but a lot of stuff isn't working since there is https. I have searched a real long time for some solution but I actually gave up.

I also thought about someone paying some money to do it but even the search for someone like this is really hard...:-(

Maybe someone of you guys may help me???

Thank you very much in advance, best regards, bhubert

[ande]

Hmm, could you try to reprhase your question?

[bhubert1978]

hi ande,

ok, I will try to rephrase it:

is there anyone out there, who can help me to write a single row into a mysql database which is secured by https protocol?

I am willing to learn or for the faster way do nearly anything to get help on this problem?!

I hope this sounds better to you?

Thanks in advance, best regards, bhubert

[ande]

Okay so, first thing first. SSL or HTTPS does not affect MySQL or PHP. Now am I right if I say you want to know how to read and write data from MySQL with PHP? In that case, I can help you.

[bhubert1978]

hi ande,

thanks for your quick response. Actually I guess there is a little misunderstanding. I know how to write into mysql db with PHP, also how to read date from the db.

There is a database which is not owned by me which should be hacked so that I can put another dataset into it. The only thing I have is a username and password for the database which is a regular user without any rights. And now there should be a way to put another datarow into the database for my dataset.

THat is why I am posting in a hacking forum :-) because I have no clue how to accomplish that. :-(

May somebody help me with this problem, like I said I am also willing to pay money to accomplish this problem!

Thank you very much, BR bhubert

[ande]

If you got a MySQL user that does not have any rights over the database you want to edit, you cannot edit it. Obviously. But I may have misunderstood what you said. If you happen to have rights to edit the database, login with a SQL client or use PHP and do "UPDATE table SET yourcolumn='new value' WHERE yourcolumn='old value'"

That will update all rows WHERE yourcolumn is "old value". Lets say this is a forum database and you want to edit the postcount for userid 1; "UPDATE users SET postcount=999999 WHERE userid=1"


Is this what you mean?

[bhubert1978]

hi ande,

thanks again for your response. Unfortunately the forum was pretty slow up to now...that's the reason why I didn't write back earlier.

Anyway, basically you are right with your last post. But I guess somehow there is a misunderstanding on my side... since this forum is called "Hacking & Security" I thought somebody could help me "hacking" this mysql database?! :-)

Sorry in this case. I know how to update and insert data into a mysql database, I don't know how to hack it *ggg*

thanks, best regards bhubert

[ande]

As far as I know, the privileges system in MySQL is pretty secure. Although you might get lucky.

[Stackprotector]

hi ande,

thanks again for your response. Unfortunately the forum was pretty slow up to now...that's the reason why I didn't write back earlier.

Anyway, basically you are right with your last post. But I guess somehow there is a misunderstanding on my side... since this forum is called "Hacking & Security" I thought somebody could help me "hacking" this mysql database?! :-)

Sorry in this case. I know how to update and insert data into a mysql database, I don't know how to hack it *ggg*

thanks, best regards bhubert

Maybe try bruteforcing the mysql root user on localhost.
You can also try uploading a shell - try to root the server - and or try to exploit mysql, or find\change password.