+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: blind sql injection "detailed tutorial" (/showthread.php?tid=56326)
* - HACKER-FUN - Jan 31, 2010
thanks man for tut
nice tut
* - 133720 - Feb 1, 2010
(Jan 31, 2010 03:17 PM)HACKER-FUN Wrote: thanks man for tut
nice tut
me too
Too shot
* - memate - Feb 3, 2010
what about sites that doesn't support union ?
* - Prugee - Feb 22, 2010
Nice man , but I don't understand that , how can I convert the numbert 100 and to get the lettter d ,
can you tell me this , PLEASEE , and give me the convertot ?????
PLEASE ..
* - Prugee - Feb 22, 2010
I fix this problem .. THNX ...
* - MenTaL_hax0r - Feb 25, 2010
Nice tutorial thx!
I don't understand 1 thing though -
here:
Code
www.cia.gov/news.php?id=1 and (SELECT substring(concat(1,password),1,1) from administrator limit 0,1)=1Why is substring and concat required? What does substring(concat(1,password),1,1) evaluate to?
Instead of that can't we use just this... ?
Code
www.cia.gov/news.php?id=1 and (SELECT password from administrator limit 0,1)=1* - nacker - Feb 26, 2010
I think that is server related and how it's configured. Try finding some site and give it a go.
* - hard - Feb 27, 2010
hi,
its good but i can't understand that how it execute the command
* - stratos8765 - Feb 27, 2010
Nice TuT bro!:)
Thnx!
* - MenTaL_hax0r - Feb 27, 2010
(Feb 26, 2010 04:50 AM)nacker Wrote: I think that is server related and how it's configured. Try finding some site and give it a go.
I did give it a go at a site. And the one I suggested does not work. Thats why I am all the more curious.
One more questions:
To run UPDATE query, shouldn't this work:
Code
www.cia.gov/news.php?id=1 and (UPDATE sometable SET score=12 WHERE id=3)>0It doesn't work on a site.
* - DarK. - Feb 27, 2010
(Mar 7, 2009 05:15 AM)holyboy94 Wrote: hey does this work for paypal??or for www.runescape.com
Wow, just wow.
* - nacker - Feb 27, 2010
(Feb 27, 2010 10:34 AM)MenTaL_hax0r Wrote: One more questions:
To run UPDATE query, shouldn't this work:
Codewww.cia.gov/news.php?id=1 and (UPDATE sometable SET score=12 WHERE id=3)>0
It doesn't work on a site.
That will not work. >0 is used with ascii when u try to detect character in char. For a blind injection i don't realy tryed to UPDATE table info, but i think that u can modify your query and tru it out, sorry that i couldn't help more.
* - MenTaL_hax0r - Feb 28, 2010
I'm using >0 because the UPDATE query returns the no. of rows affected.
* - v4n1ty - Feb 28, 2010
well blind sql injection doesn't shows the error... so it would probably be helpful when its visible
* - deepz - Feb 28, 2010
thnx bro
2shortttttttttttt