[Janus] SQLi challenge #14 - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449) +---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43) +----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103) +----- Thread: [Janus] SQLi challenge #14 (/showthread.php?tid=4833972)

[Janus] SQLi challenge #14 - JaNuS18 - May 23, 2015 ~ Tasks ~ - display version with your name, database and user - search for table in primary database where web page links are saved and use them as described below - display unique first letter in link with number of links starting with same first letter - under each letter display numbered list of links starting with that letter (see proof picture) ~ Target ~ aHR0cDovL3d3dy5waGVkLmNvbS5uZy9zdXBwb3J0X3BvcnQtaGFyY291cnRfZWxlY3RyaWNpdHlfZGlzdHJpYnV0aW9uX2NvbXBhbnkvc2FmZXR5 (Base64 decode it using online decoder like https://www.base64decode.org/) ~ Proof ~ Spoiler (Click to View) [img]http://img15.hostingpics.net/pics/858112challenge14.jpg[/img] ~ Rules ~ - use union select with DIOS (no group_concat in your syntax) - your injection should work without knowing anything about number of data in tables on that site - there are at least two ways to do it, try it without using Control Flow Functions (if() or case) - don't ask for hints or solution Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM Let's SQL knowledge be with you 👍 ~ Solvers ~ - Try also my other challenges for advanced injectors: 🎉 janus #1 janus #2 janus #3 janus #4 janus #5 janus #6 janus #7 janus #8 janus #9 janus #10 janus #11 janus #12 janus #13