[JaNuS18]

~ Tasks ~
- display version with your name, database and user
- display TOP 3 tables by records count in primary database


~ Target ~
aHR0cDovL3d3dy5ib29zdHVwLmNvbS5hdS9pdGVtLnBocD9pZD0x
(Base64 decode it using online decoder like https://www.base64decode.org/)


~ Proof ~
[img]http://img11.hostingpics.net/pics/919307challenge12.jpg[/img]


~ Rules (edited) ~
- use union select with DIOS (no group_concat, substring_index or find_in_set in your syntax)
- use only SQL, no javascript
- don't manipulate output after DIOS
- your injection should work without knowing anything about databases/tables/records on that site
- don't ask for hints or solution

Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM

Let's SQL knowledge be with you 👍


~ Solvers ~
- Shafoon
- iHacker-n00b
- Ryuga
- Kashmiri_Wolf

Edit:
Site is not vulnerable any more... Closed!

Try also my other challenges for advanced injectors: 🎉
janus #1
janus #2
janus #3
janus #4
janus #5
janus #6
janus #7
janus #8
janus #9
janus #10
janus #11

[krankenstein]

https://imgur.com/3N5hJSf

Double query also possible

[JaNuS18]

Sure 😅

but you should follow the rules and tasks 👍

[Kashmiri Hunter]

Master Site is no more vulnerable !
what to do now ? Master

[techguyresearcher]

Thanks For The Challange..
🤝

[JaNuS18]

Thanks For The Challange..
🤝

Please see the rules: TOP 3 tables by records count. Not just first three tables...

[techguyresearcher]

U Want Me To PRINT FIRST 3 TABLES HAVING HIGHEST REC IN IT (table_rows)???
Waitn for u reply?

[JaNuS18]

U Want Me To PRINT FIRST 3 TABLES HAVING HIGHEST REC IN IT (table_rows)???
Waitn for u reply?

Yes.

TOP 3 tables by records count = three tables with most records - see my proof picture (picture was taken for other site as yours)

[techguyresearcher]

ty 😭

[Kashmiri Hunter]

ShafOon I hope Now It Will Be Accepted !

[JaNuS18]

ty 😭

Send me your syntax (again). I can't read it. See PM

P.S.
I see from your picture you are using same trick again as in your previous post. Can you do it without special characters like $ and loc strategy... (you know what I am saying... 😉)

---

Edit:
solver added: ShafOon 🎉

You solved it with string manipulation after DIOS. But as that manipulation and extra characters for your help wasn't prohibited in rules, I accept your solution.

Congrats 👍

[Kushal]

Send me your syntax (again). I can't read it. See PM

P.S.
I see from your picture you are using same trick again as in your previous post. Can you do it without special characters like $ and loc strategy... (you know what I am saying... 😉)

---

Edit:
solver added: Mohammad Shafoon Ahangar 🎉

You solved it with string manipulation after DIOS. But as that manipulation and extra characters for your help wasn't prohibited in rules, I accept your solution.


Congrats 👍

I am not suppose to solve challenges but i want to ask one thing. Can you give me links to solve your RULES/TASKS

[JaNuS18]

I am not suppose to solve challenges but i want to ask one thing. Can you give me links to solve your RULES/TASKS

Not sure if you are trolling or...

Read all SQLi tutorials you'll find around and you will be familiar with them...

Start reading tutorials mentioned here:
https://hackforums.net/showthread.php?tid=2008347

For advanced techniques read benzi's tutorials or tutorials at www.securityidiots.com

[Kushal]

Not trolling but wan to learn.Well i am not advance injector as i am with sqli by 2 months.

But if you guide me i can become advance injector.

By the way thanks for those links. Once i finished those links then i come to you to learn more. :D

[Ryuga]

~ ty. (pm me for query)
hxxp://i.imgur.com/F4gXkW2.png
site used ~ hxxp://agiperwatch.ru/new.php?id=40