Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆ Anvilpoint CyberOps - Hacker for Hire ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › SQLi Error WAF Bypass - link inside

New Reply 

SQLi Error WAF Bypass - link inside
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
May 17, 2020 10:46 AM (This post was last modified: May 17, 2020 11:21 AM by krlo-s.)
Greetings Hackforums,

I have an SQLi vulnerable site WAF protected but I can't bypass it to get the columns of the database table "accounts"

Please can you help me?


https://www.dropbox.com/s/6jm0e3w3qtyp5q...y.txt?dl=0


I got database and tables by:
selselectect
whewherere
frfromom

Howerver columns do not show, I think the asterisk "*" is being blocked. I tried this:
tabletable_name_name
/*!0table_name
tABlE//_//N//A//me
databadatabase_namese_nam

tabletable_schema_schema
C//ol//UmNS
COLCOLUMNSUMNS
INFORMATION_SCHEMA//.C//ol//UmNS
INFORMATION_INFORMATION_SCHEMASCHEMA


Thank you
Disqual
Disqual Offline
01001000 01101001
**
HF l33t
Posts:
211
Threads:
8
Credibility:
000
Popularity:
66
βytes:
β 0
Game XP:
6
May 19, 2020 03:02 PM
I don't usually say this, but have you tried SQL Map? It has some mostly used WAF tampers. If doesnt help, pm me for more
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
May 23, 2020 06:01 PM
(May 19, 2020 03:02 PM)Disqual Wrote:  I don't usually say this, but have you tried SQL Map?  It has some mostly used WAF tampers. If doesnt help, pm me for more

SQLmap tamper doesn't work, I sent you a PM
Litecoin
Litecoin Offline
[n00b@HF:]
*
Registered
Posts:
73
Threads:
1
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
May 23, 2020 06:37 PM
Interesting i will have a proper look when i get home
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
May 28, 2020 07:51 AM
Please I need help pretty please
pizza500
pizza500 Offline
[user@HF:]
*
Registered
Posts:
115
Threads:
2
Credibility:
1101
Popularity:
44
βytes:
β 0
Game XP:
0
May 28, 2020 09:16 AM
try some syntax from here https://owasp.org/www-community/attacks/...assing_WAF
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 5, 2020 08:53 AM
Seems like tihs WAF is hard for everybody...
linhtinh
linhtinh Offline
[n00b@HF:]
*
Registered
Posts:
94
Threads:
12
Credibility:
000
Popularity:
0
βytes:
β 73.22
Game XP:
0
Jun 5, 2020 11:28 AM
Everybody dont know hard or not when vulnerable url not available
Kumara
Kumara Away
[closed@HF:]
Posts:
3,187
Threads:
270
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
15
Jun 5, 2020 11:34 AM
(Jun 5, 2020 11:28 AM)linhtinh Wrote:  Everybody dont know hard or not when vulnerable url not available

It's in the thread, did you not read or decide to shitpost?
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 5, 2020 07:32 PM (This post was last modified: Jun 5, 2020 07:33 PM by krlo-s.)
(Jun 5, 2020 11:28 AM)linhtinh Wrote:  Everybody dont know hard or not when vulnerable url not available

¿Are you fricking blind?, it's in my first post. Well, judging by how you write...I have no doubts about you.
linhtinh
linhtinh Offline
[n00b@HF:]
*
Registered
Posts:
94
Threads:
12
Credibility:
000
Popularity:
0
βytes:
β 73.22
Game XP:
0
Jun 6, 2020 04:25 AM
(Jun 5, 2020 07:32 PM)krlo-s Wrote:  ¿Are you fricking blind?, it's in my first post. Well, judging by how you write...I have no doubts about you.
[Image: YfZDoFU.png]
Yes i'm fricking blind
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 6, 2020 03:14 PM
So you are not, how you managed to bypass the asterisk "*" and other queries to get the columns?.
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 13, 2020 08:39 PM
Please help me out, you already bypassed it

Thanks

(Jun 6, 2020 04:25 AM)linhtinh Wrote:  [Image: YfZDoFU.png]
Yes i'm fricking blind
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 22, 2020 06:07 PM (This post was last modified: Jun 22, 2020 06:07 PM by krlo-s.)
Can somebody help me please?, it's possible but I don't know how to bypass *, among others.

Thank you
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Jun 27, 2020 08:24 PM
@linhtinh are you able to help me outp please?
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by d0ndonApr 8, 2024 07:03 PM 5 490 Apr 8, 2024 07:03 PM
Last Post: decrypt192
by Error22Mar 2, 2023 12:42 AM 7 398 Mar 2, 2023 12:42 AM
Last Post: Disqual
by EnigmaF0xAug 2, 2022 07:19 AM 5 411 Aug 2, 2022 07:19 AM
Last Post: Error22