+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Please, help me with SQL injection (/showthread.php?tid=4700000)
Please, help me with SQL injection - Coeg - Feb 22, 2015
I tried to find column on this website
www*trisakti*ac*id/?page=jobs&ID=1105
But i can't find the number of column 😭 . I tried sqlmap and that won't do either 😯 .
Can someone help me to inject this website?
I'm willing to learn as much as possible. Thank you for your attention 😉
* - dotRobby - Feb 22, 2015
I can't find a vulnerability in that website :/
* - Coeg - Feb 22, 2015
So, is it not possible to inject that website?
* - dotRobby - Feb 22, 2015
(Feb 22, 2015 11:51 PM)Coeg Wrote: So, is it not possible to inject that website?
I'm afraid not :/
I suggest using dorks to find websites to hack. There's a list on this topic:
https://hackforums.net/showthread.php?tid=581153
* - Coeg - Feb 23, 2015
Sigh, I'm feeling down. Because i just want to hack that website, not anything else. But thank you dotRobby for trying to inject that site! But, I must find a way to break that
* - Ooze - Feb 23, 2015
I injected the site try 6 columns that worked for me also try this url http://www.trisakti.ac.id/?page=ultah PM me for details
* - r0ml4h - Feb 23, 2015
white space waf
Code
http://www.trisakti.ac.id/?page=jobs&ID=-1105'/**/union/**/select/**/1,2,3,4,5,6,7,version(),9,10,11/**/from/**/information_schema.tables/**/where/**/table_schema=database()%23* - syrian thunder - Feb 23, 2015
r0ml4h did it for u ...good luck body :)
* - Coeg - Feb 23, 2015
hi r0ml4h! Thanks for the reply, i tried that but i found nothing. Have you tried to get that site database?
* - r0ml4h - Feb 23, 2015
@Coeg really, because it working fine for me, version of database is : 5.0.95, there is no other waf except whitespace waf, try do it manually to exploit this site, there is a lot tutorial about sql in HF you can find it easily
* - Earn - Feb 24, 2015
Off-topic: Congrats on the 4700000th thread.
* - Viktory - Feb 24, 2015
(Feb 23, 2015 04:59 PM)Coeg Wrote: hi r0ml4h! Thanks for the reply, i tried that but i found nothing. Have you tried to get that site database?
r0ml4h gave you the solution...
Just replace "version()" with "group_concat(table_name)" in his syntax to find the table name yourself.
* - Coeg - Feb 24, 2015
r0ml4h, maybe it was because that whitespace waf that i found nothing. So how to bypass and get over from that type of waf?
Thanks for the reply everyone
Okay i got it. Thanks r0ml4h! So this is the way to bypass the whitespace waf. Thank you very much r0ml4h!