Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › Extracting data from SQL database knowing tables and columns

New Reply 

Extracting data from SQL database knowing tables and columns
jackjohn
jackjohn Offline
[n00b@HF:]
*
Registered
Posts:
37
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 8, 2016 10:56 AM
well say theoretically that I have found a vulnerable website, found the number of columns, found the vulnerable column and finally found the names of both the tables and the columns...how the hell I extract data like passwords or anything else ? I mean what query should I use ? Please help
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Mar 8, 2016 03:56 PM
Using DIOS syntax (no limitation with output)
or using group_concat (possible output limitation as output is limited to 1024 characters).

See syntax :
http://pastie.org/private/de9jfl89op1hdvskpjpf7a
Janus - SQLi challenges for advanced injectors
kolinn
kolinn Offline
[n00b@HF:]
*
Registered
Posts:
2
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 9, 2016 05:22 AM
hello bro! where can i get more DIOS code?
Frosteh
Frosteh Offline
[bin@HF:]
*
Registered
Posts:
816
Threads:
15
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Mar 9, 2016 06:12 AM
(Mar 9, 2016 05:22 AM)kolinn Wrote:  hello bro! where can i get more DIOS code?

I have a tutorial blog post which goes in depth regarding DIOS, specifically used for dumping the entire DB struct. But it's fairly easy to modify these queries to pull out the actual data. http://frostyhacks.blogspot.co.uk/2014/1...m-all.html
Anti0Day
Anti0Day Offline
[n00b@HF:]
*
Registered
Posts:
6
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 9, 2016 10:47 AM
Maybe column is empty......
Use SqlMap tool to try.
jackjohn
jackjohn Offline
[n00b@HF:]
*
Registered
Posts:
37
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 9, 2016 10:48 AM
thank you so much, I'll take a look to the DIOS tutorial
jackjohn
jackjohn Offline
[n00b@HF:]
*
Registered
Posts:
37
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 23, 2016 11:12 AM
Hi guys!!! Now say theoretically that I've been able to watch all the data in all the columns of all the tables...is it possible that there's not sensible data ?? I mean there's no trace of passwords or mails or telephone numbers ! In this case is the sql injection totally unuseful ??
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Mar 23, 2016 11:51 AM
(Mar 23, 2016 11:12 AM)jackjohn Wrote:  Hi guys!!! Now say theoretically that I've been able to watch all the data in all the columns of all the tables...is it possible that there's not sensible data ?? I mean there's no trace of passwords or mails or telephone numbers ! In this case is the sql injection totally unuseful ??

Did you check all databases for passwords?

If passwords are not stored in database that doesn't mean SQLi is generally useless. SQLi can't give you something that isn't stored in database(s).
Janus - SQLi challenges for advanced injectors
jackjohn
jackjohn Offline
[n00b@HF:]
*
Registered
Posts:
37
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 23, 2016 01:38 PM
yes it is what I was trying to say :) I meant it is useles in this particular case isn't it ? so is it possible that passwords are not stored anywhere ?
Forum Developer
Forum Developer Offline
[closed@HF:]
Posts:
770
Threads:
75
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Mar 23, 2016 08:12 PM
If you're using sqlmap hmu.
jackjohn
jackjohn Offline
[n00b@HF:]
*
Registered
Posts:
37
Threads:
10
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 24, 2016 03:48 AM
No I'm doing it "manually"
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by aviertismentApr 29, 2023 06:05 PM 0 183 Apr 29, 2023 06:05 PM
Last Post: aviertisment
by Error22Mar 2, 2023 12:42 AM 7 398 Mar 2, 2023 12:42 AM
Last Post: Disqual
by Error22Aug 24, 2021 10:09 AM 3 255 Aug 24, 2021 10:09 AM
Last Post: Error22