ProxiesFood: Unlimited Residential Proxy ◆ Spoof Call and Spoof SMS set any caller ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › SQLi challenge

Thread Closed 

SQLi challenge
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Nov 30, 2014 03:22 AM (This post was last modified: May 27, 2016 04:47 AM by JaNuS18.)
~ Task ~
- display version with your name
- display all tables from primary database sorted by table records count (descending sort order).

~ Site ~
aHR0cDovL3d3dy5sb3djYXJib25saXZlcnBvb2wuY29tL2xpdHRsZV9ncmVlbl9ib29rLnBocD9pZD0x
(Base64 decode it)

~ Proof ~
[Image: e6b7c21c0658c5e3683b073aee3b2907.jpg]
Spoiler (Click to View)

~ Rules ~
- use colors,
- group_concat, benchmark and limit are not allowed

Post your solution at https://privnote.com and send me link to it

~ Solvers ~
- themastersinner

Edit:
Site is not vulnerable any more... Closed
Janus - SQLi challenges for advanced injectors
k44j1gujj4r
k44j1gujj4r Offline
[user@HF:]
*
Registered
Posts:
101
Threads:
2
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 30, 2014 05:07 AM
thnxxxxx i think i done so :)

[Image: gZJ0vB2.jpg?1]

~k44j1gujj4r~
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Nov 30, 2014 05:34 AM (This post was last modified: Nov 30, 2014 05:35 AM by JaNuS18.)
(Nov 30, 2014 05:07 AM)k44j1gujj4r Wrote:  thnxxxxx i think i done so :)

You didn't. 🙃 Sort tables by records count 🤝

Compare my picture with yours...
Janus - SQLi challenges for advanced injectors
k44j1gujj4r
k44j1gujj4r Offline
[user@HF:]
*
Registered
Posts:
101
Threads:
2
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 30, 2014 05:48 AM
got u now ;)

:)

~k44j1gujj4r~
themastersinner
themastersinner Offline
[user@HF:]
*
Registered
Posts:
224
Threads:
13
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 30, 2014 05:59 AM
[Image: zNpiR1f.png]
that was fun 🤝
techguyresearcher
techguyresearcher Offline
[n00b@HF:]
*
HF l33t
Posts:
63
Threads:
12
Credibility:
000
Popularity:
0
βytes:
β 2,000
Game XP:
0
Nov 30, 2014 07:53 AM
[Image: BzCdGgF.png]
thanks 4 the Challange MAn......!
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Nov 30, 2014 08:08 AM
(Nov 30, 2014 07:53 AM)techguyresearcher Wrote:  [Image: BzCdGgF.png]
thanks 4 the Challange MAn......!

Don't use limit. Your injection should work without knowing how many tables there are...

👍
Janus - SQLi challenges for advanced injectors
c00perzz
c00perzz Offline
[bin@HF:]
*
Registered
Posts:
749
Threads:
140
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 30, 2014 09:39 AM
Guys when a challenge is over wouldnt it be good if methods were posted?
techguyresearcher
techguyresearcher Offline
[n00b@HF:]
*
HF l33t
Posts:
63
Threads:
12
Credibility:
000
Popularity:
0
βytes:
β 2,000
Game XP:
0
Dec 1, 2014 12:37 AM
sOlution Plz?......?
😏
:)
:)
:)
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 2, 2014 05:07 AM (This post was last modified: Dec 2, 2014 05:30 PM by JaNuS18.)
(Dec 1, 2014 12:37 AM)techguyresearcher Wrote:  sOlution Plz?......?
😏
:)
:)
:)

Guys,

sorting records is basic operation in SQL. [img]http://x.hackforums.net/images/modern_bl/images/smilies/oui.gif[/img] How can such easy task stop you? I have more complex tasks on my list for you... [img]http://x.hackforums.net/images/modern_bl/images/smilies/whistle.gif[/img]

With my next few challenges I want to emphasize how important SQL knowledge is for SQL injection. [img]http://x.hackforums.net/images/modern_bl/images/smilies/pirate.gif[/img] This challenge was start of that...

So don't expect challenges where solution is copy/paste DIOS syntax (without understanding it) and trying out few WAF combinations from some list to bypass WAF. Solvers will have to show some SQL knowledge and logic. Good luck [img]http://x.hackforums.net/images/modern_bl/images/smilies/thumbsup.gif[/img]

After some time maybe some tutorials will be made...
Janus - SQLi challenges for advanced injectors
teknogeek
teknogeek Away
[closed@HF:]
Posts:
5
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 12, 2015 07:06 PM
I'm quite new to all this. Can't seem to get it to sort by the number of records in each table. Help anyone please?
Sahaj
Sahaj Offline
Invictus
****
HF Ub3r
Posts:
6,398
Threads:
259
Credibility:
000
Popularity:
58
βytes:
β 0
Game XP:
0
Jan 15, 2015 02:01 AM
=====404 not found.....==...... o.O
Lamer
Lamer Offline
[user@HF:]
*
Registered
Posts:
320
Threads:
39
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 15, 2015 02:04 AM
I solved it , the only thing I don't find is "sorted by table records count (descending sort order)"
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Jan 15, 2015 02:38 AM
(Jan 15, 2015 02:01 AM)Sahaj Wrote:  =====404 not found.....==...... o.O

[img]http://img4.hostingpics.net/pics/85682939c1.jpg[/img]
Janus - SQLi challenges for advanced injectors
assassin20051
assassin20051 Offline
[n00b@HF:]
*
Registered
Posts:
8
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 24, 2015 12:13 AM
can somebody tell me is the site still vulnerable ? as I am trying to to break the query but it's not giving me any error.

I have tried using ' , - , " but nothing seems to work.

I am still learning SQLi and tried a few basic challenges.
Next Oldest | Next Newest
Thread Closed 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by GOD_SLAYERDec 24, 2022 12:16 PM 9 604 Dec 24, 2022 12:16 PM
Last Post: Skorp
by GOD_SLAYERAug 19, 2022 07:11 PM 0 166 Aug 19, 2022 07:11 PM
Last Post: GOD_SLAYER
by Berry WhiteApr 24, 2020 11:08 AM 4 508 Apr 24, 2020 11:08 AM
Last Post: ApertureSecurity