+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Janus] SQLi challenge #4 (/showthread.php?tid=4593701)
Pages: Pages
1
2
[Janus] SQLi challenge #4 - JaNuS18 - Dec 20, 2014
Hi folks,
This is my challenge #4. Again, it will be a little harder than previous ones 🎉
- display all tables in primary database
- under each table (displayed only once) display numbered list (use roman numbers) of columns in that table (with their length in characters) sorted by column length descending
- display only column names with more than 6 characters in its name (hide all shorter ones)
- make a statistics about records in each table, number of columns and number of hidden columns (those shorter than 6 characters in column_name) in each table - see proof picture
aHR0cDovL3d3dy5ldmVuZW1lbnRpZWwtZnJhbmNlLmNvbS90YXJpZi1ldC1kZXZpcy10YXJpZnMucGhwP2lkYXBwZWw9NjA1MA==
(Base64 decode it using online decoder like https://www.base64decode.org/)
[img]http://img15.hostingpics.net/pics/98313178c1.jpg[/img]
- complete injection must be done in one vulnerable column
- don't use group_concat, limit and substring_index (use pure DIOS)
- your command should work without knowing anything about tables/columns on that site...
Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM
Let's SQL knowledge be with you 👍
- S-x-S
- Inject0r Killer
- 7h3_Ph3n0m
P.S.
Don't harm the site. 🙃 I choose it only for challenge...
Try also my other challenges for advanced injectors:
janus #1
janus #2
janus #3
* - RAi Jee - Dec 23, 2014
hey bro update the link u provided it cannot be decoded in base64
* - JaNuS18 - Dec 24, 2014
(Dec 23, 2014 09:58 PM)RAi Jee Wrote: hey bro update the link u provided it cannot be decoded in base64
It decodes fine. 😉
Just don't use hackbar (bug in decoding) but site I suggested - https://www.base64decode.org/
🤝
* - RAi Jee - Dec 24, 2014
(Dec 24, 2014 02:44 AM)JaNuS18 Wrote: It decodes fine. 😉
Just don't use hackbar (bug in decoding) but site I suggested -
🤝
yup but most people here use hackbar ,
* - JaNuS18 - Dec 25, 2014
(Dec 24, 2014 04:36 AM)RAi Jee Wrote: yup but most people here use hackbar ,
I am using hackbar too. But there are bugs in hackbars (problems with decoding)...
What do you think why did I put that link for decoding target URL? ✌
* - Lamer - Dec 25, 2014
Bugs are from myBB (what a shitty cms)
* - S-x-S - Jul 6, 2016
[img]http://img15.hostingpics.net/pics/86738152147852.png[/img]
* - JaNuS18 - Jul 6, 2016
(Jul 6, 2016 12:01 AM)S-x-S Wrote: Spoiler (Click to View)
Great work S-x-S. 🎉 Congrats. 👍
Please add missing part (see PM)
* - gn0m3 - Jul 7, 2016
I've been blocked by their security master JanuS can you pm me your Solution?
* - S-x-S - Jul 19, 2016
[img]http://img15.hostingpics.net/pics/7213597775222777.png[/img]
Master, thanks for the challenge
👍👍🤗🤗
* - JaNuS18 - Jul 19, 2016
(Jul 19, 2016 02:39 AM)S-x-S Wrote: ...
Master, thanks for the challenge
👍👍🤗🤗
Great 👍🎉
Added you to solvers 🎉
* - Kashmiri Hunter - Aug 3, 2016
(Jul 19, 2016 03:19 PM)JaNuS18 Wrote: Great 👍🎉
Added you to solvers 🎉
CHeck PM Related To This CHallenge 😅
* - JaNuS18 - Aug 5, 2016
(Aug 3, 2016 10:21 AM)Kashmiri Hunter Wrote: CHeck PM Related To This CHallenge 😅
Sorry, you should do all tasks.
👍
* - Inject0r Killer - Aug 19, 2016
http://prntscr.com/c7pkfw
Check Pm 🤝
* - JaNuS18 - Aug 19, 2016
(Aug 19, 2016 05:14 AM)Inject0r Killer Wrote: http://prntscr.com/c7pkfw
Check Pm 🤝
Nice. 👍
See all tasks carefully again. You didn't follow all tasks. Your proof picture differs from mine.
Also your output has big problems with tables at the end... Last details are not visible any more.
You are close. Good luck 👍