Anvilpoint CyberOps - Hacker for Hire ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › [SQLI] challenge #8 [SQLI]

New Reply 

[SQLI] challenge #8 [SQLI]
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Dec 11, 2016 02:44 AM (This post was last modified: Dec 11, 2016 05:28 AM by •^v^–[ bLacKn3x ]–^v^•.)
Hey guys,
my last challenge is half year ago. today i give you 2 challenges :)

Difficult: easy

Rules:

Union Based injecti0n onLY
Post Version and your name
Post Proof pic here and PM me solution.
Do not harm the websites!!




Target 1#:http://didaticativa.com/historia_companhia.php?id=216
-get version
-Get admin Name and Pass(don't post full hash, its forbidden)

Target 2#:http://www.zfo.de/index.php?mid=40
-print number of Tables
-print version,databases,
-print all tables
Proof:
[Image: hHbwUv1.png]
[Image: 0ETZKL8.png]

Solver added by 2 solved challenges !
Solver:
JaNuS18
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 11, 2016 05:22 AM
Thanks

[Image: 2cc3387ab6df64880182e190a06745bc.jpg]
[Image: 4db4ba0d0d599eacbf0027f726cf35e8.jpg]
Janus - SQLi challenges for advanced injectors
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Jan 20, 2017 01:25 PM
Target2 vuln is fixed.
Now, solve the first for adding to solver :)

Have Fun guys :)
MelonToy
MelonToy Offline
[n00b@HF:]
*
Registered
Posts:
5
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 21, 2017 04:29 AM (This post was last modified: Jan 21, 2017 04:31 AM by MelonToy.)
Thanks for the challenge :) new here , hope to see these coming

dump.bitcheese[dot]net/images/gozeviw/NUM1.png

PS: tried to send you my solution but I could not because i have few posts :(
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Jan 21, 2017 05:00 AM
Nice but,
Please Don't use another parameter or injection point .. i forget to write it on rules..
MelonToy
MelonToy Offline
[n00b@HF:]
*
Registered
Posts:
5
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 21, 2017 05:02 AM
(Jan 21, 2017 05:00 AM)•^v^–[ bLacKn3x ]–^v^• Wrote:  Nice but,
Please Don't use another parameter or injection point .. i forget to write it on rules..

well dw , the page is the same , i just used select for 2 , you used it for 3.
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Jan 21, 2017 05:46 AM
(Jan 21, 2017 05:02 AM)MelonToy Wrote:  well dw , the page is the same , i just used select for 2 , you used it for 3.


Lol no it's not the same -.-
What do yo mean with "i use select for 3 ?"

Simply take the right injection point/parameter and good....
MelonToy
MelonToy Offline
[n00b@HF:]
*
Registered
Posts:
5
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 21, 2017 05:58 AM (This post was last modified: Jan 21, 2017 06:17 AM by MelonToy.)
(Jan 21, 2017 05:46 AM)•^v^–[ bLacKn3x ]–^v^• Wrote:  Lol no it's not the same -.-
What do yo mean with "i use select for 3 ?"

Simply take the right injection point/parameter and good....

Here you go man , look for yourself, it's the same page and i'm using the same var to inject: id
the one you used required only to exit from an href tag but all is the same

pastebin[dot]com/BgZ3wW3x
SIM-2793336
SIM-2793336 Offline
[user@HF:]
*
Registered
Posts:
203
Threads:
7
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
Jan 21, 2017 07:56 AM
hi / tnx for your good chall
target 1 : check your Priv8 box
target 2 : down


good luck 🤝
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Jan 21, 2017 09:40 AM
Okay added to solver : MelonToy
KalamPolo2

Thank you :)
Disparity
Disparity Away
skid
***
HF Ub3r
Posts:
1,274
Threads:
125
Credibility:
000
Popularity:
19
βytes:
β 0
Game XP:
0
Jan 21, 2017 10:10 PM
[Image: 2d3ff50c4c42dfd33b96b1bc4ef846a2.png]

thanks
xmpp/email:
[email protected]
Blackbox Pentesting/Hacking Jobs
•^v^–[ bLacKn3x ]–^v^•
•^v^–[ bLacKn3x ]–^v^• Offline
#Operation~BAMF 1220
***
HF Ub3r
Posts:
1,048
Threads:
124
Credibility:
000
Popularity:
417
βytes:
β 4.8
Game XP:
0
Jan 22, 2017 03:28 AM
Added Solver : Disparity

Thanks for solving it Bro :))
krankenstein
krankenstein Offline
[bin@HF:]
*
Registered
Posts:
511
Threads:
41
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 25, 2017 03:39 PM
[Image: j6yBpvP.png]
second one is blocking me and sending me on the footer,patched/secured or not??or am i searching a fallen coin in ocean???
--->
Quote:http://www.zfo.de/footer/rechtliches/mediadaten/



Ich mag immer WAF-Umgehung
Disparity
Disparity Away
skid
***
HF Ub3r
Posts:
1,274
Threads:
125
Credibility:
000
Popularity:
19
βytes:
β 0
Game XP:
0
Jan 25, 2017 09:49 PM
(Jan 25, 2017 03:39 PM)krankenstein Wrote:  [Image: j6yBpvP.png]
second one is blocking me and sending me on the footer,patched/secured or not??or am i searching a fallen coin in ocean???
--->

Ich mag immer WAF-Umgehung

(Jan 20, 2017 01:25 PM)•^v^–[ bLacKn3x ]–^v^• Wrote:  Target2 vuln is fixed.
Now, solve the first for adding to solver :)

Have Fun guys :)

It was patched a while after the thread was posted.
xmpp/email:
[email protected]
Blackbox Pentesting/Hacking Jobs
c0re1331
c0re1331 Offline
[n00b@HF:]
*
Registered
Posts:
17
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 4, 2017 07:50 AM
hi
this site over firewall protect..!
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by BlackRoasOct 18, 2017 11:38 PM 7 435 Oct 18, 2017 11:38 PM
Last Post: pishicat
by •^v^–[ bLacKn3x ]–^v^•Oct 17, 2017 12:31 PM 15 834 Oct 17, 2017 12:31 PM
Last Post: •^v^–[ bLacKn3x ]–^v^•
by •^v^–[ bLacKn3x ]–^v^•Oct 17, 2017 04:09 AM 19 840 Oct 17, 2017 04:09 AM
Last Post: kmhacker