 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| |
|
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9145
 People Online:
 Visitors: 504
 Members: 0
 Total: 504
|
|
|
|
|
|
PacketStorm News |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Hey waraxe |
|
 Posted: Thu Jul 09, 2009 11:32 am |
 |
|
| cr4ps |
| Advanced user |
 |
| |
| Joined: May 06, 2009 |
| Posts: 91 |
|
|
|
 |
|
 |
|
Hey waraxe, I need your help , a column specified "password_user" Im not abel to select it as it exists in table "utilisateurs" and I got the following message "Internet Explorer can not display the page Web " I select another column named "login_user" and I was able to display it but the "password_user" can't be selected . . .
| Code: | | 8 and ascii(substring((SELECT login_user from utilisateurs where id_user=1 limit 0,1),1,1))>100 |
| Code: | | 8 and ascii(substring((SELECT password_user from utilisateurs where id_user=1 limit 0,1),1,1))>100 |
Thanks in advanced . . . |
|
|
|
|
|
|
|
|
| Posted: Thu Jul 09, 2009 12:08 pm |
|
|
| waraxe |
| Site admin |
 |
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Turn off IE "Friendly Error Messages" so that you can see server real response. Even better, use Firefox with Live HTTP Headers Add-On or Wireshark and look for response code - 400, 500, 403, 200 ...
And try LENGTH() against that specific column to be sure, that it's not empty.
One more thing - possible collation problem, or pass column is blob type.
In this case try SUBSTR(HEX()) and retrieve info in hexadecimal representation. |
|
|
|
|
|
|
|
|
| Posted: Thu Jul 09, 2009 12:34 pm |
|
|
| cr4ps |
| Advanced user |
|
| |
| Joined: May 06, 2009 |
| Posts: 91 |
|
|
|
|
|
|
|
| waraxe wrote: | Turn off IE "Friendly Error Messages" so that you can see server real response. Even better, use Firefox with Live HTTP Headers Add-On or Wireshark and look for response code - 400, 500, 403, 200 ...
And try LENGTH() against that specific column to be sure, that it's not empty.
One more thing - possible collation problem, or pass column is blob type.
In this case try SUBSTR(HEX()) and retrieve info in hexadecimal representation. |
thank's waraxe, can you give me example SUBSTR(HEX()) plz  |
|
|
|
|
| Posted: Sat Jul 11, 2009 10:06 am |
|
|
| cr4ps |
| Advanced user |
|
| |
| Joined: May 06, 2009 |
| Posts: 91 |
|
|
|
|
|
|
|
its the same in both cases response 200
there were no other settlement ?  |
|
|
|
|
| Posted: Sat Jul 11, 2009 1:49 pm |
|
|
| waraxe |
| Site admin |
|
| |
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
You need to be more creative! Gather more information about specific column. Use information_schema.
information_schema.columns --> DATA_TYPE, CHARACTER_MAXIMUM_LENGTH
Then test for real data length and find out if it's >0.
And by the way, real world is not perfect ... I have seen lot's of unexplained anomalies in sql injection exploitation process ... |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
