[Janus] SQLi challenge #3 - Printable Version

[Janus] SQLi challenge #3 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Janus] SQLi challenge #3 (/showthread.php?tid=4580097)

Pages: Pages 1 2

[Janus] SQLi challenge #3 - JaNuS18 - Dec 11, 2014

Hi folks,

This is my challenge #3. Previous two were basic for advanced injectors. We were sorting data in DIOS output in searching alternatives for concatenating data there. After that warming up it is time to go to next level 🎉

~~~ Task~~ ~
- display version with your name
- display numbered list of all tables in primary database (one table per row)

~~~ Site~~ ~
aHR0cDovL3d3dy5jaG5yaS5vcmcvcHJvZmlsZS5waHA/cHJvZmlsZUlkPTIzODk=
(Base64 decode it)

~~~ Proof~~ ~
[img]http://img15.hostingpics.net/pics/42028814c1.jpg[/img]

As this challenge is harder I will force you to change your usual injections - see rules bellow.
~~~ Rules~~ ~
- complete injection must be done in one vulnerable column
- you may not use concat or any other function with character _ in function's name (like group_concat...)
- you may not use function IN() or Benchmark()
- in your complete syntax command from may be used only once
- your command should work without knowing anything about databases/tables on that site...

Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM

Let's SQL knowledge be with you 👍

~~~ Solvers~~ ~
- r0ml4h
- iHacker-n00b
- sweetoow
- Aakash Choudhary
- S-x-S
-Kashmiri_Wolf
- delwaralam

P.S.
Don't harm the site. 🙃 I choose it only for challenge...

Try also my other challenges:
janus #1
janus #2

* - iHacker-n00b - Dec 12, 2014

[Image: VhakhND.png]

Hello Everyone Exams Over xD Thnx For The Challenge

* - Aakash Choudhary - Dec 12, 2014

Fucking Redirection. well done simple injection. Time to done with RULES

* - r0ml4h - Dec 12, 2014

Quote:hey bro, can you check your website, because i get error like this

thanks god, error is gone, i spent 4 hours to build my query and all will be in vain if website target going error

[Image: nzxcUMU.jpg]

thanks for challenge

* - Lamer - Dec 12, 2014

LOL this is part of the challenge , try order by 10 you will see no redirection, after for rules things without "_" etc Idk how to solve

* - JaNuS18 - Dec 12, 2014

(Dec 12, 2014 08:13 AM)iHacker-n00b Wrote:
Hello Everyone Exams Over xD Thnx For The Challenge

You may not use any function with character _ in its name (group_concat, make_set...)...

See the rules!

(Dec 12, 2014 04:02 AM)benzi Wrote: nice one, done.

I can't evaluate you as a solver without seeing your syntax🤝

* - Lamer - Dec 12, 2014

benzi never send syntax, he think he has rights over people.....:)

* - iHacker-n00b - Dec 13, 2014

(Dec 12, 2014 03:36 PM)JaNuS18 Wrote: You may not use any function with character _ in its name (group_concat, make_set...)...

See the rules!

oops! Sorry :P
Check Now,
[Image: ApWRLKX.png]

Use of From - Once
No Use of Function having '_'
Result in One Column..
I Believe I Cleared This :P

* - JaNuS18 - Dec 13, 2014

I can't edit first post any more so results are here:

Solvers:
- r0ml4h
- iHacker-n00b

🎉

* - iHacker-n00b - Dec 13, 2014

(Dec 13, 2014 02:59 PM)JaNuS18 Wrote: I can't edit first post any more so results are here:

Solvers:
- r0ml4h
- iHacker-n00b (not injected in one column, partial solver)

🎉

Na! :3 Check Pm Now :P I Injected in One Column :v

* - JaNuS18 - Dec 14, 2014

(Dec 13, 2014 10:01 PM)iHacker-n00b Wrote: Na! :3 Check Pm Now :P I Injected in One Column :v

Solvers list updated after you corrected your syntax. 🤝

Rules are there to follow them Rahul. Or skip the challenge. 🤫

I am fair to all equally. 😉

* - sweetoow - Dec 15, 2014

Nice challenge..
[Image: irk9HyM.png]

* - 8lack - Dec 15, 2014

Anyone give me query plz.. am trying but.fail..coz i am noob :(
My mail: [email protected]

* - JaNuS18 - Dec 15, 2014

Solvers list is updated:

Solvers:
- r0ml4h
- iHacker-n00b
- sweetoow
- Aakash Choudhary

👍

* - Aakash Choudhary - Dec 15, 2014

Very nice challenge brother.
Because of your challenge [ mainly RULES ] i learned DIOS almost in that function.But once again my brother help me to understand that DIOS in that function.
Almost i learned because i am still understanding this DIOS in that function and will do more practice till i become perfect to handle that function
Thanks
Here is my proof

[Image: Kt9ehcs.png]

Thank you very much once again 🤝 🤝 🤝

I honestly accepted that i took help. So forgive me. Thanks