[HACKER-FUN]

thanks man for tut

nice tut

[133720]

thanks man for tut

nice tut

me too
Too shot

[memate]

what about sites that doesn't support union ?

[Prugee]

Nice man , but I don't understand that , how can I convert the numbert 100 and to get the lettter d ,
can you tell me this , PLEASEE , and give me the convertot ?????
PLEASE ..

[Prugee]

I fix this problem .. THNX ...

[MenTaL_hax0r]

Nice tutorial thx!

I don't understand 1 thing though -
here:

Code

www.cia.gov/news.php?id=1 and (SELECT substring(concat(1,password),1,1) from administrator limit 0,1)=1

Why is substring and concat required? What does substring(concat(1,password),1,1) evaluate to?
Instead of that can't we use just this... ?

Code

www.cia.gov/news.php?id=1 and (SELECT password from administrator limit 0,1)=1

[nacker]

I think that is server related and how it's configured. Try finding some site and give it a go.

[hard]

hi,

its good but i can't understand that how it execute the command

[stratos8765]

Nice TuT bro!:)
Thnx!

[MenTaL_hax0r]

I think that is server related and how it's configured. Try finding some site and give it a go.

I did give it a go at a site. And the one I suggested does not work. Thats why I am all the more curious.

One more questions:
To run UPDATE query, shouldn't this work:

Code

www.cia.gov/news.php?id=1 and (UPDATE sometable SET score=12 WHERE id=3)>0

It doesn't work on a site.

[DarK.]

hey does this work for paypal??or for www.runescape.com

Wow, just wow.

[nacker]

One more questions:
To run UPDATE query, shouldn't this work:

Code

www.cia.gov/news.php?id=1 and (UPDATE sometable SET score=12 WHERE id=3)>0

It doesn't work on a site.

That will not work. >0 is used with ascii when u try to detect character in char. For a blind injection i don't realy tryed to UPDATE table info, but i think that u can modify your query and tru it out, sorry that i couldn't help more.

[MenTaL_hax0r]

I'm using >0 because the UPDATE query returns the no. of rows affected.

[v4n1ty]

well blind sql injection doesn't shows the error... so it would probably be helpful when its visible

[deepz]

thnx bro
2shortttttttttttt