[Tutorial] The Best Injection Method Ever You Should To See [New Method]

[Tutorial] The Best Injection Method Ever You Should To See [New Method] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Tutorial] The Best Injection Method Ever You Should To See [New Method] (/showthread.php?tid=5735331)

Pages: Pages 1 2 3 4 5

* - Berry White - Oct 12, 2017

(Oct 12, 2017 07:33 AM)JaNuS18 Wrote: Yes, you need true (or value 1) JUST in column #3. This is valid ONLY for that specific site, where display of column #4 is related to state of value in column #3

That NULLIF() "new priv8 method by pishicat_injector" is totally obsolete, actually a nonsense which works just by accident.

MySQL NULLIF(value1, value2) returns NULL when the first parameter is equal to the second parameter. Otherwise, it returns the first parameter.

So that "glorified new super duper method" 😅 doesn't work for that site if you use NULLIF(2,1), NULLIF(3,2), NULLIF(X,Y)... It works just in one and only case when first parameter (X) is 1 and other parameter Y is <> 1 --> so function result is 1.

But we don't need some extra function if we can put simple 1 (means TRUE) to column #3. 😝

Thanks for clearing this out to me mate, but is there anytthing in injection output that says when we use this? Like "The used SELECT statements have a different number of columns" Output?

* - JaNuS18 - Oct 12, 2017

(Oct 12, 2017 01:39 PM)Berry White Wrote: Thanks for clearing this out to me mate, but is there anytthing in injection output that says when we use this? ...

I answered you in my second sentence in text you quoted.

Required true in column #3, related to show column #4 is specific ONLY to this site, so tutorial about it is obsolete. Especially using some fancy "priv8" 😝 function just to put value 1 in column #3. Which makes column #4 visible.

There are many sites, where we have boolean field type and value of it is not required to be true or vulnerable column is not visible. You just need to have same columns types on all positions like in original query. Or UNION injection won't work.

* - Berry White - Oct 12, 2017

(Oct 12, 2017 01:53 PM)JaNuS18 Wrote: I answered you in my second sentence in text you quoted.

Required true in column #3, related to show column #4 is specific ONLY to this site, so tutorial about it is obsolete. Especially using some fancy "priv8" 😝 function just to put value 1 in column #3. Which makes column #4 visible.

There are many sites, where we have boolean field type and value of it is not required to be true or vulnerable column is not visible. You just need to have same columns types on all positions like in original query. Or UNION injection won't work.

Ohhh, now i understand all, rthanks

* - Kashmiri Hunter - Oct 12, 2017

Your Effort is OK. But These are old Things.

* - pishicat_Injector - Oct 12, 2017

(Oct 12, 2017 03:58 AM)•^v^–[ bLacKn3x ]–^v^• Wrote: Hi what about simply insert --> 1 in column number? this makes the datatype boolean True too :)

thats easier to handle if it comes to waf or something.

Regards

I have my way to inject site 👍 and thx for that notic my friend

(Oct 12, 2017 09:20 PM)Kashmiri Hunter Wrote: Your Effort is OK. But These are old Things.

as you say thx 👍

(Oct 11, 2017 01:43 PM)JaNuS18 Wrote: Sure, after I posted my syntax, you will explain it 😝 🤦‍♂ Story of your life...

P.S.
My syntax was later removed by request as it is used in a challenge

I thx you say to me that later are you see your solution here ? Curse

and I thx you say to me you All connections are cut off, so way I see you in all my Tut ,You are really very bad I don't love to see you in my Tut as you say to me befor about All connections are cut off, between us Be a man and keep your words 😝

* - c0sm1k - Oct 13, 2017

This was a fun thread. I like to see different ways a site could be injected. Once I had posted a challenge on another forum and someone made a youtube video of the solution 1 day later. This was good for me though because it was solved in a different way i had never thought of. I am grateful to see everyones methods 👍

* - JaNuS18 - Oct 13, 2017

(Oct 12, 2017 10:51 PM)pishicat_Injector Wrote: You are really very bad I don't love to see you in my Tut ...

Yes I am "bad" because I am telling you your "priv8 tutorials" are full of errors and nonsense.

To make me less bad here is a free review of your The Best Injection Method Ever You Should To See:

#1
If you want to write tutorials you should know SQL first, at least you should read official SQL tutorials so you won't "sell" statements like on picture bellow:
[Image: 473014nullif.jpg]

Nullif doesn't return positive/negative values. So you are teaching people nonsense. Don't "invent" wrong new methods and don't explain functions wrong.

Correct explanation for nullif is:
MySQL NULLIF(param1, param2) returns NULL when the first parameter is equal to the second parameter. Otherwise, it returns the first parameter.
Where do you see positive or negative value as a possible result? For example: what is negative value of nullif(4,4)? 😧

#2 Next nonsense on picture bellow:
[Image: 167509nullif2.jpg]

So you invented "new line error" OMG 🤦‍♂ And your explanation of it is not understandable even to yourself... When you inject your code you ruin original query (or other queries which use that parameter) so such errors are normal and you can simply skip them. You can inject there even if that error is written on web page...

#3 Next nonsense on picture bellow:
[Image: 120078nullif3.jpg]

Close your injection properly with %23 (and don't use %60) and that error is gone. So because you did it wrong way you continue your tutorial with routed query. 😊 Routed query there is NOT needed as you can inject it without it.

#4 Next nonsense in your tutorial:
[Image: 840366nullif4.jpg]

Nullif can't be positive/negative! Wrong use of nullif can belong to GHI team 😝 Nobody want to take you that from you. Last sentence on picture is a joke. It is totally same if you check for boolean column from first or from last column. Direction is not important. But you even don't know you are testing for boolean values in each column as you are playing with nullif.

If you add title of your tutorial like The Best Injection Method Ever You Should To See [New Method] then I won't look away not saying anything to such false marketing. 😠 Its real value is practically zero.

I totally agree with this comment:

(Oct 12, 2017 08:17 AM)LD_PRELOAD Wrote: The tutorial is borderline retarded. Just a different way of ending the injection. Absolutely no new method on the table, what a waste of a thread.

Beside wrong explanations here is a list of problems in this "tutorial":

nullif function is obsolete as you could add simple 1 in column #3

you closed your injection wrong way with %60 so you start experimenting with routed query. Use %23 and all that wouldn't be needed.

in whole tutorial you didn't explain why value 1 should be there in column #3 !!!

if you want to impress us with using some function to put value 1 in some column, I explained you at least 5 different functions for same task (FIND_IN_SET, INSTR, LENGTH, LOCATE, STRCMP...). So why only nullif is new/best ever. 😝 All mentioned functions are obsolete for your target URL, so don't use them just to make simple things complicated.

your so called "method" is totally useless, as same effect you get by putting value 1 or true to column #3. But you can't write fancy tutorial with just once sentence: put 1 in column #3. You need to add some functions, routed query, wrong closing ... to make your "priv8" and "new" tutorial more dramatic and HQ 🤫

nullif is not new. It exists in MySQL tutorials over 20 years.

your "new" nullif won't work if used nullif(2,1),nullif(3,2) nullif(5,2)... but you didn't say why. It will work just for nullif(x,y) where x=1 and y<>1 Because we need value 1 (or True) in column #3 to make column #4 visible.

your tutorials can be used ONLY for that specific site, as only there display of column #4 is based on value of column #3. So what is the purpose of such "best ever" method if it works just in that site 😅

If I don't communicate with you by PM any more it is because you are multi account and plagiator, you stole my text, you are stealing text from others for your "priv8" tutorials. No personal communication with you doesn't mean I won't comment your "priv8", "best ever", "new" tutorials. Every time you will teach other people nonsense, I will comment.

So dear InjectorBoy alias pishicat_injector alias BlackRoas start writing correct tutorials 👍 (with references where you should mention them) and I won't comment for sure 🤝

I wish you good luck with that 👍

* - pishicat_Injector - Oct 13, 2017

(Oct 13, 2017 03:17 AM)c0sm1k Wrote: This was a fun thread. I like to see different ways a site could be injected. Once I had posted a challenge on another forum and someone made a youtube video of the solution 1 day later. This was good for me though because it was solved in a different way i had never thought of. I am grateful to see everyones methods 👍

Thank you for understanding these things 🤝

here in this section two member Each time a topic is added by me They comment negatively

in my Tut I Use

PHP Code 


<?php 
And point(53,12) 

PHP Code 


<?php 
And MOD(29,9) 

PHP Code 


<?php 
%26%26 MOD(29,9)   ↳ && Logical AND. Returns 0 if either argument is 0 or NULL otherwise returns 1. 

and other method , No one used this function to bypassing the WAF befor me and added in public Tut in all internet Tut 👍

I don't say this function it's priv8 but I say my try to bypassing the waf by this function it's the priv8 .

Many members were very dissatisfied with the publication of these issues on the public, They told me to stop publishing these issues because you spoil our secret knowledge ,
Like Iranian terrorism r3dcat from ashiyane.org

And I say to all this member I will share many priv8 method like this 😝

and about member his name is JaNuS18 he attack on me in all my Tut see that by your self, and I say to him I share my knowlege for free to all member here in SQL Section In HF and you I never see to you one Tut you learn member here from your knowlege , so I say to him ' I prefer from you many times ' and Go To H... 😝

Notic : you in my Buddy List I love to work with you 😁

Regards 😊

[Image: 3EzjcVW.png]

Sorry I can't see your post to reply to you Cuz You in my Ignore List 😝

* - LD_PRELOAD - Oct 14, 2017

Quote:Many members were very dissatisfied with the publication of these issues on the public, They told me to stop publishing these issues because you spoil our secret knowledge ,
Like Iranian terrorism r3dcat from ashiyane.org

oh so like a bunch of skids?
m8 I'm not one to jump in all this mess, but if what you're teaching is blatantly flase id recommend to take that "knowledge" back to where it came from =\

* - GhostLikesToast - Oct 15, 2017

Looks very interesting. Bookmarking this for down the road.

Thank you for your contribution pishicat_Injector

* - Hooded Robin - Oct 15, 2017

Another grade-A shit posting! Not sure how, but you've done it again sir.

* - LD_PRELOAD - Oct 15, 2017

(Oct 15, 2017 06:00 AM)Hooded Robin Wrote: Another grade-A shit posting! Not sure how, but you've done it again sir.

how are you doing man? long time no see

* - •^v^–[ bLacKn3x ]–^v^• - Oct 16, 2017

(Oct 13, 2017 02:15 PM)pishicat_Injector Wrote: in my Tut I Use

PHP Code
<?php And point(53,12)

PHP Code
<?php And MOD(29,9)

PHP Code
<?php %26%26 MOD(29,9) ↳ && Logical AND. Returns 0 if either argument is 0 or NULL otherwise returns 1.

and other method , No one used this function to bypassing the WAF befor me and added in public Tut in all internet Tut 👍

THIS MADE MY DAY 🤣🤣🤣🤣🤣🤣🤣🤣🤣🤣

lol you think there are only 5 injectors arround the world ???
This functions are very public...even to bypass WAF!...

You think no one use that because there is no Tutorial? Can you handle your life without web-tutorials?
You should stop injecting pakistani websites with shitty WAF ;)

regards

* - JaNuS18 - Oct 16, 2017

Two of multiaccounts of pishicat_injector are gone.

What a coincidence, they have same imaginary date of birth 😝

[Image: 855281InjectorBoyBlackRoas.jpg]

* - Berry White - Oct 16, 2017

(Oct 16, 2017 03:22 AM)JaNuS18 Wrote: Two of multiaccounts of pishicat_injector are gone.

What a coincidence, they have same imaginary date of birth 😝

LEL xDDDDDDD

I still dont get it, why did he did that lol, i mean, why is he so many 'persons' lol