+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: SQLi information_schema in mysql (WAF) (/showthread.php?tid=6264964)
SQLi information_schema in mysql (WAF) - d0ndon - Feb 29, 2024
Hi, guys. How to bypass "information_schema" word filtration? Random upcase, urlencoding, etc... not working. I think this is a nginx filtration.
RE: SQLi information_schema in mysql (WAF) - Edmond24 - Mar 9, 2024
(Feb 29, 2024 08:59 AM)d0ndon Wrote: Hi, guys. How to bypass "information_schema" word filtration? Random upcase, urlencoding, etc... not working. I think this is a nginx filtration.
hex unhex methode often works, unicode as well, pm me the link i will help you
RE: SQLi information_schema in mysql (WAF) - d0ndon - Mar 11, 2024
(Mar 9, 2024 01:26 AM)Amadeus Wrote: hex unhex methode often works, unicode as well, pm me the link i will help you
Hi. This is a post request. Nginx blocking any*information_schema*any.
information_sch\u0065ma - blocked
information_sch\u00f0ma - not blocked, but not working.
(Mar 11, 2024 12:43 AM)d0ndon Wrote: Hi. This is a post request. Nginx blocking any*information_schema*any.
information_sch\u0065ma - blocked
information_sch\u00f0ma - not blocked, but not working.
UPD. Not any*information_schema*any - information_schema pattern. Sorry for poor english. Innodb method not working, performance_schema not found.
RE: SQLi information_schema in mysql (WAF) - Edmond24 - Mar 11, 2024
please pm me the link, only so i can help you
RE: SQLi information_schema in mysql (WAF) - d0ndon - Mar 13, 2024
(Mar 11, 2024 11:57 PM)Amadeus Wrote: please pm me the link, only so i can help you
I can't share link, for security reason. White hat pentest. If you can help me, show me how to obfuscate 'information_schema' pattern.
RE: SQLi information_schema in mysql (WAF) - decrypt192 - Apr 8, 2024
(Feb 29, 2024 08:59 AM)d0ndon Wrote: Hi, guys. How to bypass "information_schema" word filtration? Random upcase, urlencoding, etc... not working. I think this is a nginx filtration.
cool