Anvilpoint CyberOps - Hacker for Hire ◆ Spoof Call and Spoof SMS set any caller ◆ Cheap KYC Verifications & Openups ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › Challenge Number 7 - Tricky Challenge -

New Reply 

Challenge Number 7 - Tricky Challenge -
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 11:28 AM (This post was last modified: Dec 12, 2016 03:34 PM by InjectorBoy.)
Hi EveryBody This Is The Challenge Number 7 - Tricky Challenge - Hope You Loved .

# Target #

PHP Code

<?php 
http://www.ipb-ild.edu.rs/institut.php?id=40 

# Tasks #


part one

make error ' only ' appear in site like me

part two

get all tables with your name in the same page


# Rules #

1- don't change the injection point
2- use union based only
3- pm me your solution

# Proof #

part one

[Image: wZpdDPf.png]

part two

[Image: vfCIFVl.png]
# Solvers #

1- Sir : JaNuS18
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 12, 2016 12:14 PM
Error on site, not on white page. I hope I understood that correctly

[Image: 37d03c9c4388c8cf1b857cdc9c226fcf.jpg]
Janus - SQLi challenges for advanced injectors
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 12:39 PM
(Dec 12, 2016 12:14 PM)JaNuS18 Wrote:  Error on site, not on white page. I hope I understood that correctly

[Image: 37d03c9c4388c8cf1b857cdc9c226fcf.jpg]

thx sir JaNuS18 update thread by your notic sir

can you pm me your solution sir I love to see it

Regards 🤝
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 12, 2016 12:42 PM (This post was last modified: Dec 12, 2016 12:43 PM by JaNuS18.)
(Dec 12, 2016 12:39 PM)InjectorBoy Wrote:  can you pm me your solution sir I love to see it

Sent. I thought I could drink a coffee first 😝
Janus - SQLi challenges for advanced injectors
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 12:56 PM
(Dec 12, 2016 12:42 PM)JaNuS18 Wrote:  Sent. I thought I could drink a coffee first 😝

🤣
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 12, 2016 01:27 PM (This post was last modified: Dec 12, 2016 01:43 PM by JaNuS18.)
Did you try union based on that site?

[Image: 06623b30dfc47ef6740f90af0622db46.jpg]
Janus - SQLi challenges for advanced injectors
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 02:21 PM
(Dec 12, 2016 01:27 PM)JaNuS18 Wrote:  Did you try union based on that site?

[Image: 06623b30dfc47ef6740f90af0622db46.jpg]

are you meaning sir I can bypassing the error :

The used SELECT statements have a different number of columns

and inject by normal way ?
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 12, 2016 02:33 PM
(Dec 12, 2016 02:21 PM)InjectorBoy Wrote:  are you meaning sir I can bypassing the error :

The used SELECT statements have a different number of columns

and inject by normal way ?

No, I used different link. Try it for exercise. 👍

P.S.
Most links on that site will give you that error.
Janus - SQLi challenges for advanced injectors
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 02:46 PM (This post was last modified: Dec 12, 2016 03:18 PM by InjectorBoy.)
(Dec 12, 2016 02:33 PM)JaNuS18 Wrote:  No, I used different link. Try it for exercise. 👍

P.S.
Most links on that site will give you that error.

in this injection point I get column number

but I can't able to appear column number in the site page I will try agian

pm you my query

(Dec 12, 2016 01:27 PM)JaNuS18 Wrote:  Did you try union based on that site?

[Image: 06623b30dfc47ef6740f90af0622db46.jpg]

I get it in the same injection point

PHP Code

<?php 
http://www.ipb-ild.edu.rs/institut.php?id=40 

[Image: vfCIFVl.png]

Regards Sir
JaNuS18
JaNuS18 Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,294
Threads:
50
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 12, 2016 03:27 PM (This post was last modified: Dec 12, 2016 03:30 PM by JaNuS18.)
(Dec 12, 2016 02:46 PM)InjectorBoy Wrote:  I get it in the same injection point

👍

Maybe you opened your challenge to soon. Still you can change tasks so also other can go in that direction

P.S.
My invitation to exercise was good for you 😉 Now finish injection point I gave you as another exercise
Janus - SQLi challenges for advanced injectors
InjectorBoy
InjectorBoy Offline
[closed@HF:]
Posts:
350
Threads:
61
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 12, 2016 03:36 PM
(Dec 12, 2016 03:27 PM)JaNuS18 Wrote:  👍

Maybe you opened your challenge to soon. Still you can change tasks so also other can go in that direction

P.S.
My invitation to exercise was good for you 😉 Now finish injection point I gave you as another exercise

update tasks sir

and thx for exercise sir
scorpoin
scorpoin Offline
[n00b@HF:]
*
Registered
Posts:
44
Threads:
11
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 25, 2016 01:14 PM (This post was last modified: Dec 25, 2016 01:20 PM by scorpoin.)
I manage to inject it via error based same url but failed to get injection via union , but I mange to get diferent num of colum error message using union. But couldnot get all tables and column. Im nt allowed to pm so I wont sharing my error based but yes I would love to learn this . if you share the solution.

Code
Duplicate entry 'kamenica_ipb1' for key 'group_key'

Regards
Scorpoin
redlightrouter
redlightrouter Offline
[bin@HF:]
*
Registered
Posts:
701
Threads:
138
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Dec 26, 2016 09:20 PM
Are there any write ups? Would love to read how people do it their way.
JeSuis
JeSuis Offline
[n00b@HF:]
*
Registered
Posts:
9
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 27, 2016 05:47 PM (This post was last modified: Dec 27, 2016 05:55 PM by JeSuis.)
i.imgur.com/X3Toabn.png

Sorry, i can t send my syntax because i don t have necessary posts on this forum for this...
Maybe we ll find another way for this and i ll be gad if u cand send me other solutions too

PS: i used id=40 as the injection point
Cheerz
scorpoin
scorpoin Offline
[n00b@HF:]
*
Registered
Posts:
44
Threads:
11
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 28, 2016 12:40 PM (This post was last modified: Dec 28, 2016 01:09 PM by scorpoin.)
Dear Inj3ct0rBoy We all would love to learn if you could reveal the secret to us . Looking forward to your kind response.

Regards
Scorpoin

solved if you say so I may reveal my syntax here , since there is no activity nor I can send PM .

there is 17 column ;) vuln column is # 2 .

Regards
Socproin
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by FuzzyhackerFeb 25, 2021 07:46 AM 3 133 Feb 25, 2021 07:46 AM
Last Post: account_
by ipkdannyAug 26, 2019 02:01 AM 0 170 Aug 26, 2019 02:01 AM
Last Post: ipkdanny
by godjustice555Jul 21, 2019 10:27 AM 8 389 Jul 21, 2019 10:27 AM
Last Post: boy rteis