 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 54
 Members: 0
 Total: 54
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
some questions about mysql |
|
 Posted: Fri Oct 17, 2008 12:40 pm |
 |
|
| baby_1 |
| Regular user |
 |
|
| Joined: Sep 19, 2008 |
| Posts: 12 |
|
|
|
 |
|
 |
|
hello dears
i have some questions , Please Help me
1-when we use order by , the target get us some numbers , what are the numbers?
these aren't the number of tables , if these are the number of columns , which table have these columns?
if these are some things else please tell what they are
2-have any commands instead of load_file() to read the content of a file?
3-in mysql injection can we change the data into tables?(if yes how)
Thanks |
|
|
|
|
| Posted: Sat Oct 18, 2008 5:30 pm |
|
|
| baby_1 |
| Regular user |
|
|
| Joined: Sep 19, 2008 |
| Posts: 12 |
|
|
|
|
|
|
|
|
|
|
|
|
Re: some questions about mysql |
|
| Posted: Sun Oct 19, 2008 12:11 am |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| baby_1 wrote: | hello dears
i have some questions , Please Help me
1-when we use order by , the target get us some numbers , what are the numbers?
these aren't the number of tables , if these are the number of columns , which table have these columns?
if these are some things else please tell what they are
2-have any commands instead of load_file() to read the content of a file?
3-in mysql injection can we change the data into tables?(if yes how)
Thanks |
1. ??
2. "LOAD DATA INFILE", but "LOAD_FILE" is usually better way. And of course you must understand, that most of the targets does not give you "file" privileges, so file reading via mysql is rare possibility in real world attack scenarios
3. Yes, if sql injection does occur in UPDATE, DELETE, INSERT or similar query. Usually it's SELECT query and mysql does not let you modify data in database in this case. MSSql, PostgreSql and some other database let you use multiple queries, separated by semicolon, but not MySql  |
|
|
|
|
|
|
|
|
| Posted: Wed Oct 22, 2008 3:11 pm |
|
|
| baby_1 |
| Regular user |
|
|
| Joined: Sep 19, 2008 |
| Posts: 12 |
|
|
|
|
|
|
|
| Thanks again for usefull information |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
