+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: help to exploit sql injection (/showthread.php?tid=5552740)
Pages: Pages
1
2
help to exploit sql injection - MR-XX - Feb 16, 2017
how can exploit a sql injection vuln ending with word not a number ?
# SQL Injection/Exploit :
# http : // localhost /index.php?option=com_joomblog&task=tag&tag=Ihsan_Sencan[SQL]
* - Dutisto - Feb 16, 2017
I don't see where it's different whether you got words or numbers for your injection
* - MR-XX - Feb 16, 2017
(Feb 16, 2017 04:23 AM)Dutisto Wrote: I don't see where it's different whether you got words or numbers for your injection
Thank you man for your answer
but i will give example:
you see that link is vulnerable to SQL injection but i wasn't able to exploit it
http: //www .alexkincaid. com/index.php?option=com_joomblog&task=tag&tag=hack'
* - DelziumTheProudWhale_temp - Feb 16, 2017
(Feb 16, 2017 06:57 AM)MR-XX Wrote: Thank you man for your answer
but i will give example:
you see that link is vulnerable to SQL injection but i wasn't able to exploit it
http: //www .alexkincaid. com/index.php?option=com_joomblog&task=tag&tag=hack'
use havij
* - MR-XX - Feb 16, 2017
Same probleme
WAppEx 2.0 Analyze :
Analyzing bla bla bla..
Can't find keyword but let me do a try!
Can't find injection type... Trying Integer type if failed, retry with String type
Can't find db server type! But maybe there be some chances! [-o
Finding Injection Method...
Trying Mssql error based method...
I think i was wrong about injection type trying String type!
Trying union based method...
Finding columns count...
Can't find Columns count!
Trying Mysql error based method...
* - Dutisto - Feb 16, 2017
Do you succeed to got at least a SQL error or something ? How do you know that this link is vulnerable ?
PM if u want
* - MR-XX - Feb 16, 2017
(Feb 16, 2017 08:44 AM)Dutisto Wrote: Do you succeed to got at least a SQL error or something ? How do you know that this link is vulnerable ?
PM if u want
visit that link and will give you sql error
http: //www .alexkincaid. com/index.php?option=com_joomblog&task=tag&tag=hack'
* - Dutisto - Feb 16, 2017
Alright, i was able to inject whatever i want in this site. As i said, number or word doesn't matter^^
* - DelziumTheProudWhale_temp - Feb 16, 2017
(Feb 16, 2017 11:47 AM)Dutisto Wrote: Alright, i was able to inject whatever i want in this site. As i said, number or word doesn't matter^^
may i ask you how you did it?
i tried to do it however no luck
* - Dutisto - Feb 16, 2017
I can guide you in the right direction, pm me^^
* - DelziumTheProudWhale_temp - Feb 16, 2017
(Feb 16, 2017 01:12 PM)Dutisto Wrote: I can guide you in the right direction, pm me^^
you wont be able to reply to my pm tho
* - Dutisto - Feb 16, 2017
(Feb 16, 2017 01:12 PM)DelziumTheProudWhale_temp Wrote: you wont be able to reply to my pm tho
Oups, forgot about this. Alright, show some injections you tried, and i'll correct you^^
* - MR-XX - Feb 16, 2017
Guys , how about to show us here in public ?
* - Dutisto - Feb 16, 2017
That's what we gonna do ;)
* - MR-XX - Feb 17, 2017
(Feb 16, 2017 04:09 PM)Dutisto Wrote: That's what we gonna do ;)
Then where is it?