+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Janus] SQLi challenge #12 (/showthread.php?tid=4762782)
Pages: Pages
1
2
[Janus] SQLi challenge #12 - JaNuS18 - Apr 4, 2015
- display version with your name, database and user
- display TOP 3 tables by records count in primary database
aHR0cDovL3d3dy5ib29zdHVwLmNvbS5hdS9pdGVtLnBocD9pZD0x
(Base64 decode it using online decoder like https://www.base64decode.org/)
[img]http://img11.hostingpics.net/pics/919307challenge12.jpg[/img]
- use union select with DIOS (no group_concat, substring_index or find_in_set in your syntax)
- use only SQL, no javascript
- don't manipulate output after DIOS
- your injection should work without knowing anything about databases/tables/records on that site
- don't ask for hints or solution
Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM
Let's SQL knowledge be with you 👍
- Shafoon
- iHacker-n00b
- Ryuga
- Kashmiri_Wolf
Edit:
Site is not vulnerable any more... Closed!
Try also my other challenges for advanced injectors: 🎉
janus #1
janus #2
janus #3
janus #4
janus #5
janus #6
janus #7
janus #8
janus #9
janus #10
janus #11
* - krankenstein - Apr 17, 2015
![[Image: 3N5hJSf]](https://imgur.com/3N5hJSf)
https://imgur.com/3N5hJSf
Double query also possible
* - JaNuS18 - Apr 17, 2015
Sure 😅
but you should follow the rules and tasks 👍
* - Kashmiri Hunter - May 5, 2016
Master Site is no more vulnerable !
what to do now ? Master
* - techguyresearcher - May 5, 2016
Thanks For The Challange..
🤝
![[Image: 13149907_213044812413080_289232116_n.png...e=572D4111]](https://scontent-iad3-1.xx.fbcdn.net/v/t34.0-12/fr/cp0/e15/q65/13149907_213044812413080_289232116_n.png.jpg?efg=eyJpIjoiYiJ9&oh=bc54c289e1931421e7ffde0e3d684760&oe=572D4111)
* - JaNuS18 - May 5, 2016
(May 5, 2016 12:44 PM)Mohammad Shafoon Ahangar Wrote: Thanks For The Challange..
🤝
Please see the rules: TOP 3 tables by records count. Not just first three tables...
* - techguyresearcher - May 5, 2016
U Want Me To PRINT FIRST 3 TABLES HAVING HIGHEST REC IN IT (table_rows)???
Waitn for u reply?
* - JaNuS18 - May 5, 2016
(May 5, 2016 09:41 PM)Mohammad Shafoon Ahangar Wrote: U Want Me To PRINT FIRST 3 TABLES HAVING HIGHEST REC IN IT (table_rows)???
Waitn for u reply?
Yes.
TOP 3 tables by records count = three tables with most records - see my proof picture (picture was taken for other site as yours)
* - techguyresearcher - May 6, 2016
ty 😭
![[Image: 13140707_213314089052819_1652630061_n.pn...e=572F067C]](https://scontent-iad3-1.xx.fbcdn.net/v/t34.0-12/fr/cp0/e15/q65/13140707_213314089052819_1652630061_n.png.jpg?efg=eyJpIjoiYiJ9&oh=0ee00722bea9aebf8f6de9da7188ee5d&oe=572F067C)
* - Kashmiri Hunter - May 6, 2016
ShafOon I hope Now It Will Be Accepted !
* - JaNuS18 - May 6, 2016
(May 6, 2016 01:52 AM)Mohammad Shafoon Ahangar Wrote: ty 😭
Send me your syntax (again). I can't read it. See PM
P.S.
I see from your picture you are using same trick again as in your previous post. Can you do it without special characters like $ and loc strategy... (you know what I am saying... 😉)
Edit:
solver added: ShafOon 🎉
You solved it with string manipulation after DIOS. But as that manipulation and extra characters for your help wasn't prohibited in rules, I accept your solution.
Congrats 👍
* - Kushal - May 6, 2016
(May 6, 2016 02:56 AM)JaNuS18 Wrote: Send me your syntax (again). I can't read it. See PM
P.S.
I see from your picture you are using same trick again as in your previous post. Can you do it without special characters like $ and loc strategy... (you know what I am saying... 😉)
Edit:
solver added: Mohammad Shafoon Ahangar 🎉
You solved it with string manipulation after DIOS. But as that manipulation and extra characters for your help wasn't prohibited in rules, I accept your solution.
Congrats 👍
I am not suppose to solve challenges but i want to ask one thing. Can you give me links to solve your RULES/TASKS
* - JaNuS18 - May 6, 2016
(May 6, 2016 07:00 AM)Kushal Wrote: I am not suppose to solve challenges but i want to ask one thing. Can you give me links to solve your RULES/TASKS
Not sure if you are trolling or...
Read all SQLi tutorials you'll find around and you will be familiar with them...
Start reading tutorials mentioned here:
https://hackforums.net/showthread.php?tid=2008347
For advanced techniques read benzi's tutorials or tutorials at www.securityidiots.com
* - Kushal - May 6, 2016
Not trolling but wan to learn.Well i am not advance injector as i am with sqli by 2 months.
But if you guide me i can become advance injector.
By the way thanks for those links. Once i finished those links then i come to you to learn more. :D
* - Ryuga - May 7, 2016
~ ty. (pm me for query)
hxxp://i.imgur.com/F4gXkW2.png
site used ~ hxxp://agiperwatch.ru/new.php?id=40