+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Janus] SQLi challenge #15 (/showthread.php?tid=4850261)
[Janus] SQLi challenge #15 - JaNuS18 - Jun 4, 2015
- display version, nick name, user and database
- make statistics how many pages were added by each day and display list for days with more than two posted pages per day (newer post dates first - see proof picture)
aHR0cDovL3d3dy5iYW5mZnZveWFnZXJpbm4uY29tL3BhZ2UucGhwP3BhZ2VJRD0xNDk=
(Base64 decode it using online decoder like https://www.base64decode.org/)
[img]http://img4.hostingpics.net/pics/672870challenge15.jpg[/img]
- use union select with pure DIOS (no group_concat, no substring_index, no flow control functions)
- command count() may be used only once in your syntax (repeated count() with limit is not allowed as you brake last rule)
- for statistics use only table columns, no local variables,
- don't ask for hints or solution
- your injection should work without knowing exact dates when each news is posted
Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM
Let's SQL knowledge be with you 👍
-
Try also my other challenges for advanced injectors: 🎉
janus #1
janus #2
janus #3
janus #4
janus #5
janus #6
janus #7
janus #8
janus #9
janus #10
janus #11
janus #12
janus #13
janus #14
* - Inject0r Killer - Aug 13, 2016
Site Can Not Be Loaded 🙃
* - JaNuS18 - Aug 14, 2016
(Aug 13, 2016 09:49 PM)Inject0r Killer Wrote: Site Can Not Be Loaded 🙃
Thanks for reporting 🤝
Target and POC updated.
* - Inject0r Killer - Sep 9, 2017
This Target Is Also not working 😏
* - JaNuS18 - Sep 10, 2017
Thanks for your report 🤝
Sorry, I won't update challenges from 2015 any more.
* - Inject0r Killer - Sep 10, 2017
🤭 Then why dont you post those solutions 😏 or share those queries in pm plz 🤝
* - JaNuS18 - Sep 10, 2017
(Sep 10, 2017 05:33 AM)Inject0r Killer Wrote: 🤭 Then why dont you post those solutions 😏 or share those queries in pm plz 🤝
I don't support copy/paste learning, because:
- Hackbar is full of DIOS syntax named by people who are not original authors
- People are using some syntax without understanding it.
- On forum you have plenty of copy/paste challenges where people even don't understand what are they displaying in output 🤫
- ...
All this because of copy/paste strategy. The best way of learning is by your own experiments.
This challenge tasks can be recreated on any SQLi vulnerable site where you have some news/pages/articles and date when each of them was posted. So tasks are still open, I just don't provide target URL (publicly) any more.
* - rawaz karim - Sep 10, 2017
thx m.r Janus you are right i understand some of them and some i am not understanding
some query i well try to understanding query know l know join,dios,alias,left join,on,in,or,and,benchmark,replace,insert,...etc because of you thx bro
* - Inject0r Killer - Sep 10, 2017
(Sep 10, 2017 05:58 AM)JaNuS18 Wrote: I don't support copy/paste learning, because:
- Hackbar is full of DIOS syntax named by people who are not original authors
- People are using some syntax without understanding it.
- On forum you have plenty of copy/paste challenges where people even don't understand what are they displaying in output 🤫
- ...
All this because of copy/paste strategy. The best way of learning is by your own experiments.
This challenge tasks can be recreated on any SQLi vulnerable site where you have some news/pages/articles and date when each of them was posted. So tasks are still open, I just don't provide target URL (publicly) any more.
Thats right 😝