[ThankYouAndGoodbye]

Its a bug in havij when it selects an unreliable regex, you would be able to exploit the site if you had taken the time to learn manual injection instead of relying on zero skill skids tools.

[ThankYouAndGoodbye]

Theres an easy answer to that, dont use havij, if your competant in manual sql injection revert back to that, the site is obviously vulnerable but havij cant determine a column count and thus cant call a group_concat() to pull information from the DB, however if you took a manual approach to it you would notice the changes in the site that havij missed because havij only reliese on the presence of one word in a web page to determine if it has changed.

---

And your obviously not very good at sql injection if it takes your 4 hours per site.

[ThankYouAndGoodbye]

Yes, havij is obviously returning false positves when it comes to the column count. If you want to stick to using skid tools, ill give you a tip: Change havij's "database" option to "mysql blind" - this will force havij to treat any sql injection like a blind injection and instead of relying on a correct column count with the group_concat() call, it will soley rely on llooking for positives when gussing table names letter by letter - it will take longer, but it wont require any skill or brain power on your behalf.

[ThankYouAndGoodbye]

When you fully understand manual sql injection, you see why havij is a peice of shit. Im just sick of seeing people relying on it as there only method of sql injection because its piss poor, havij can on only successfully exploit 1 in 5 sql injections that a human could do manually.

I just prefer to make people think before giving them an easy way out.

Happy Hacking