+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Detailed Basic and Full SQL Injection Tutorial (/showthread.php?tid=50356)
* - mor02 - Dec 4, 2010
http://www.xxxx.com/index.php?catid=1 union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--
the db type and version will pop up on the screen
i dont inderstand this queriy if for example i found colums id what i will do
thanx
* - pdz - Dec 4, 2010
thanks my brother ,good job
* - Nebula - Dec 5, 2010
Hanks great tut, it's heliping me to hack a site right now, thanks.
* - Y-Trick™ - Dec 6, 2010
Thanks, Dude.
It's very usefull =)
* - tequila - Dec 7, 2010
(Dec 4, 2010 04:56 AM)mor02 Wrote: http://www.xxxx.com/index.php?catid=1 union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--
the db type and version will pop up on the screen
i dont inderstand this queriy if for example i found colums id what i will do
thanx
Im pretty sure its explained in this tutorial, but im just bored.
Anyhow, lets go over the specific query at first:
Code
index.php?catid=1 union select 1,concat_ws(0x3a,user(),database(),version()),3,4--First off it seems that we have 4 columns available for this current example and the second column is vulnerable.
So as you can see here his extracting info from the second column using
Code
concat_ws(0x3a,user(),database(),version())concat_ws stands for "concatenate with separator" what means that it parses strings together and places a seperator between strings. In this example we have hex code 0x3a (thats :).
If we want to get more info out of that query we need to just ask the database. Let's do that now.
Code
index.php?catid=1 union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database()--So what we do here is (in simple terms) that we are asking the second column to group_concat (that means concatenate in groups) table names from information_schema.tables where table_schema=database().
The remaining 3,4 after group_concat are the column numbers, keep in mind that you must always drag them along for the query to work!
If you have any other questions feel free to pm.
* - osean - Dec 7, 2010
😉😉
very very nice post..ceer for all :D
* - bdman - Dec 9, 2010
nice post....but not worked
* - Happeh - Dec 11, 2010
Thanks for this. Helped me grasp the basics.
* - WinnieThePooh - Dec 11, 2010
Nice dude<3 But your forums layout is fucked.
* - ilovepizzaa - Dec 11, 2010
Thank you thanks
Thank you thanks
Thank you thanks
* - GosthShadow - Dec 18, 2010
http://demo.webwiznewspad.com/admin.asp go here and just click login xD
hm overlooked the demo -.-"
* - hacker300 - Dec 20, 2010
LEECHER OR WHAT? cyberhackers.org/thread-538.html
* - hacker300 - Dec 20, 2010
LEECHER OR WHAT? cyberhackers.org/thread-538.html
* - tayraN - Dec 20, 2010
nice post mate, this helped me :)
* - subzer00 - Dec 21, 2010
Now, when you say order of.. do you do
/index.php?catid= 1
/index.php?catid= 2
/index.php?catid= 3
and so on and so forth until you get the error?