ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › [Janus] SQLi challenge #4

Thread Closed 

[Janus] SQLi challenge #4
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 20, 2014 11:16 AM (This post was last modified: Sep 19, 2017 09:39 AM by JaNuS18.)
Hi folks,

This is my challenge #4. Again, it will be a little harder than previous ones 🎉

~ Task ~
- display all tables in primary database
- under each table (displayed only once) display numbered list (use roman numbers) of columns in that table (with their length in characters) sorted by column length descending
- display only column names with more than 6 characters in its name (hide all shorter ones)
- make a statistics about records in each table, number of columns and number of hidden columns (those shorter than 6 characters in column_name) in each table - see proof picture

~ Site ~
aHR0cDovL3d3dy5ldmVuZW1lbnRpZWwtZnJhbmNlLmNvbS90YXJpZi1ldC1kZXZpcy10YXJpZnMucGhwP2lkYXBwZWw9NjA1MA==
(Base64 decode it using online decoder like https://www.base64decode.org/)

~ Proof ~
[img]http://img15.hostingpics.net/pics/98313178c1.jpg[/img]

~ Rules ~
- complete injection must be done in one vulnerable column
- don't use group_concat, limit and substring_index (use pure DIOS)
- your command should work without knowing anything about tables/columns on that site...

Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM

Let's SQL knowledge be with you 👍

~ Solvers ~
- S-x-S
- Inject0r Killer
- 7h3_Ph3n0m

P.S.
Don't harm the site. 🙃 I choose it only for challenge...

Try also my other challenges for advanced injectors:
janus #1
janus #2
janus #3
Janus - SQLi challenges for advanced injectors
RAi Jee
RAi Jee Offline
[n00b@HF:]
*
Registered
Posts:
93
Threads:
32
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 23, 2014 09:58 PM
hey bro update the link u provided it cannot be decoded in base64
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 24, 2014 02:44 AM (This post was last modified: Dec 24, 2014 02:45 AM by JaNuS18.)
(Dec 23, 2014 09:58 PM)RAi Jee Wrote:  hey bro update the link u provided it cannot be decoded in base64

It decodes fine. 😉

Just don't use hackbar (bug in decoding) but site I suggested - https://www.base64decode.org/

🤝
Janus - SQLi challenges for advanced injectors
RAi Jee
RAi Jee Offline
[n00b@HF:]
*
Registered
Posts:
93
Threads:
32
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 24, 2014 04:36 AM
(Dec 24, 2014 02:44 AM)JaNuS18 Wrote:  It decodes fine. 😉

Just don't use hackbar (bug in decoding) but site I suggested -

🤝

yup but most people here use hackbar ,
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 25, 2014 06:26 PM
(Dec 24, 2014 04:36 AM)RAi Jee Wrote:  yup but most people here use hackbar ,

I am using hackbar too. But there are bugs in hackbars (problems with decoding)...

What do you think why did I put that link for decoding target URL? ✌
Janus - SQLi challenges for advanced injectors
Lamer
Lamer Offline
[user@HF:]
*
Registered
Posts:
320
Threads:
39
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 25, 2014 06:56 PM
Bugs are from myBB (what a shitty cms)
S-x-S
S-x-S Offline
[user@HF:]
*
Registered
Posts:
113
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 6, 2016 12:01 AM
[img]http://img15.hostingpics.net/pics/86738152147852.png[/img]
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Jul 6, 2016 02:56 AM (This post was last modified: Jul 6, 2016 02:56 AM by JaNuS18.)
(Jul 6, 2016 12:01 AM)S-x-S Wrote:  Spoiler (Click to View)

Great work S-x-S. 🎉 Congrats. 👍

Please add missing part (see PM)
Janus - SQLi challenges for advanced injectors
gn0m3
gn0m3 Offline
[n00b@HF:]
*
Registered
Posts:
35
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 7, 2016 01:10 AM
I've been blocked by their security master JanuS can you pm me your Solution?
S-x-S
S-x-S Offline
[user@HF:]
*
Registered
Posts:
113
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 19, 2016 02:39 AM
[img]http://img15.hostingpics.net/pics/7213597775222777.png[/img]

Master, thanks for the challenge
👍👍🤗🤗
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Jul 19, 2016 03:19 PM (This post was last modified: Jul 23, 2016 01:08 AM by JaNuS18.)
(Jul 19, 2016 02:39 AM)S-x-S Wrote:  ...

Master, thanks for the challenge
👍👍🤗🤗

Great 👍🎉

Added you to solvers 🎉
Janus - SQLi challenges for advanced injectors
Kashmiri Hunter
Kashmiri Hunter Offline
[user@HF:]
*
Registered
Posts:
378
Threads:
37
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Aug 3, 2016 10:21 AM
(Jul 19, 2016 03:19 PM)JaNuS18 Wrote:  Great 👍🎉

Added you to solvers 🎉




CHeck PM Related To This CHallenge 😅
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Aug 5, 2016 01:44 PM
(Aug 3, 2016 10:21 AM)Kashmiri Hunter Wrote:  CHeck PM Related To This CHallenge 😅

Sorry, you should do all tasks.

👍
Janus - SQLi challenges for advanced injectors
Inject0r Killer
Inject0r Killer Offline
[user@HF:]
*
Registered
Posts:
223
Threads:
17
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Aug 19, 2016 05:14 AM
http://prntscr.com/c7pkfw

Check Pm 🤝
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Aug 19, 2016 06:02 AM
(Aug 19, 2016 05:14 AM)Inject0r Killer Wrote:  http://prntscr.com/c7pkfw

Check Pm 🤝

Nice. 👍

See all tasks carefully again. You didn't follow all tasks. Your proof picture differs from mine.

Also your output has big problems with tables at the end... Last details are not visible any more.

You are close. Good luck 👍
Janus - SQLi challenges for advanced injectors
Next Oldest | Next Newest
Thread Closed 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by GOD_SLAYERDec 24, 2022 12:16 PM 9 604 Dec 24, 2022 12:16 PM
Last Post: Skorp
by GOD_SLAYERAug 19, 2022 07:11 PM 0 166 Aug 19, 2022 07:11 PM
Last Post: GOD_SLAYER
by Berry WhiteApr 24, 2020 11:08 AM 4 508 Apr 24, 2020 11:08 AM
Last Post: ApertureSecurity