+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Blind SQL injection] Help (/showthread.php?tid=5945557)
[Blind SQL injection] Help - SERPENT@ - Feb 27, 2019
Hello guy's.. In the below HTTP request it said parameter: administration_id , was vulnerable.. Anyone can help me to inject it?
For inject it, you need to register and logged-in to view this content.
I have tryed with SQLMAP, but not working..
PHP Code
<?php
GET /product_updates?administration_id=237891964997994205 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Referer: https://moneybird.com/237891964997994205
Cookie: _mb_session=eyJzdWIiOiJNekkydDdBMHREUXpzVFEzc1RReU5UVTJCQUEiLCJleHAiOjE1NTEyNTU1NTIsImF1ZCI6InExWXlNamEzc0RTME5ET3h0RFMzdERReE1qQlZzb28yTTlaUjhxOG9yUENQOG5ZMnkzSHlLUWtKejhzTGQwMExMX0MxOFBVd0x5Z3pxREF1aVRMS0RnM3hNN1EwTHJaVmlxMEZBQSIsIm5hbWUiOiJVeXBJTFVrdFVnSUEiLCJlbWFpbCI6IlV5cE9UUzVJelN0SkxTNUpMVEkwTmpaM0tDaktMOG5QeTAzTXpORkx6czlWQWdBIiwiem9uZWluZm8iOiJVM0l0TGNvdlNOVjN6QzB1U1MxS1NjeFZBZ0EiLCJsb2NhbGUiOiJubCJ9.e3ls88UtpN7-3HVHq_M9uNv-h6-p4o_czSsrVHwYnlIN4rq3hBVRsS6jA-o5lrq9PFoxmBwC52PpdcqsIW1RCA; trusted_computer=true; _moneybird_session=e566b43b8f4e703ffbf76cd03f2e1ea8c598d490e0343d0923ef3b8a1b94b53d
Connection: Keep-Alive
Host: moneybird.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US
RE: [Blind SQL injection] Help - Sitrep - Feb 28, 2019
"administration_id" are a part of moneybird as an API and "237891964997994205" are your authentication token. Just some information that I found out, if it helps anything. I'm not sure if or how you can Sqli an API like that, but maybe someone with more knowledge have a good answer.
RE: [Blind SQL injection] Help - hacker1 - Mar 1, 2019
use hack bar dude and do convert the strings to characters.