[JaNuS18]

Hi folks

My previous challenge #16 was warming up for challenge #17. Challenge #17 is probably my hardest till now... Task in #17 is same as in #16. The only difference is we can use ONLY one SELECT in complete code.

~ Tasks ~
- display numbered list of all databases with table name where maximum and minimum records were found (among all tables from that database) - see proof picture


~ Target ~
aHR0cDovL2JyYW50aHdhaXRlY290dGFnZXMuY28udWs=
(Base64 decode it using online decoder like https://www.base64decode.org/)


~ Proof ~
[img]http://img11.hostingpics.net/pics/688810challenge17.jpg[/img]


~ Rules ~
- use union select (GET)
- you can have max. 1 SELECT statement in your complete syntax (that one used in combination with UNION)
- you can use one local variable but only for numbering databases
- you may not use group_concat
- your injection should work without knowing anything about databases/tables/records on that site
- don't ask for hints or solution

Post your syntax to https://privnote.com (it is automatically destroyed after reading) and send me link to PM

Let's SQL knowledge be with you 👍


~ Solvers ~
-

Try also my other challenges for advanced injectors: 🎉
janus #1
janus #2
janus #3
janus #4
janus #5
janus #6
janus #7
janus #8
janus #9
janus #10
janus #11
janus #12
janus #13
janus #14
janus #15
janus #16

[Viktory]

Haha, I wonder where you got this site from =]

[JaNuS18]

Haha, I wonder where you got this site from =]

And we both (+ some others) know the answer 😝

It has what I needed for that task...

[Soham K]

whats the solution ? 🤨

[b1ack-c0d3]

can someone please take me through the solution...step by step
i'm still learning and this is where i learn from but some of the tasks are beyond me.
if it's possible can you guys always tutor us through the solutions to every/any task you post ?

thanks

[JaNuS18]

can someone please take me through the solution...step by step

It is a challenge, why would people advice you on open challenges 😧