 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
help ?? |
 |
 Posted: Thu Apr 24, 2008 11:14 pm |
 |
|
| kr0k0 |
| Advanced user |
 |
|
| Joined: Jan 26, 2008 |
| Posts: 128 |
|
|
|
 |
|
 |
|
Hi ; i need help for this problem 
| Code: | /news.php?id=1+and+1=1--
/news.php?id=1+and+1=2--
/news.php?id=1/**/and/**/1=2/*
/news.php?id=1+order+by+999999999
/news.php?id=1/**/and/**/1=1/*
/news.php?id=1' or '1'='2-- |
no error
but i get error for this ,
| Code: | | /news.php?id=9999999 |
| Code: | | Warning: mysql_result() [function.mysql-result]: Unable to jump to row 0 on MySQL result index 13 in /var/www/sites/net/www/subdomain_demo/lib/news.php on line 182 |
so , i'm trying with 'Union+all+select+1,1,1,1,1,....--
not working :s So ?? plz  waraxe , koko & etc ...
thanks for all ... |
|
|
|
|
| Posted: Thu Apr 24, 2008 11:18 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Seems to me that there is no sql injection at all  |
|
|
|
|
| Posted: Fri Apr 25, 2008 10:22 am |
|
|
| pexli |
| Valuable expert |
 |
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
| kr0k0 why you search ONLY sql inj on some server?Try to find other vuln on server's.LFI or some readfile bug,or weaknes in web appz(upload scripts ..etc). |
|
|
|
|
| Posted: Fri Apr 25, 2008 1:16 pm |
|
|
| kr0k0 |
| Advanced user |
|
|
| Joined: Jan 26, 2008 |
| Posts: 128 |
|
|
|
|
|
|
|
| koko wrote: | | kr0k0 why you search ONLY sql inj on some server?Try to find other vuln on server's.LFI or some readfile bug,or weaknes in web appz(upload scripts ..etc). |
Hi koko , thanks for answer ;
1 - because i like SQL injection , and i don't want to hack Server , i need just learning , mr.Koko |
|
|
|
|
| Posted: Fri Apr 25, 2008 2:19 pm |
|
|
| pexli |
| Valuable expert |
|
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
| kr0k0 wrote: | | koko wrote: | | kr0k0 why you search ONLY sql inj on some server?Try to find other vuln on server's.LFI or some readfile bug,or weaknes in web appz(upload scripts ..etc). |
Hi koko , thanks for answer ;
1 - because i like SQL injection , and i don't want to hack Server , i need just learning , mr.Koko |
I don't believe you.
Final result always is hack the server.
Sql inj in most cases is very difficult decision,but possibility to find sql inj on some server(site) is very high. |
|
|
|
|
|
|
|
|
| Posted: Fri Apr 25, 2008 5:51 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
kr0k0 - you have practical skills about sql injection, but lack theory knowledge. I suggest to install mysql, postgresql and mssql to your home pc and/or use vmware for virtualization. Then read some good sql server manuals and sql injection whitepapers and practice various attack patterns against localhost. Try to UNDERSTAND!! This is where scriptkiddie differs from real hacker - scriptkiddie will just throw in any possible attack strings he/she can find from tutorials and then hopefully something will break. Skilled attacker will think through EVERY move he/she will make 
So my suggestion - be smart, be creative, be skilled - learn, practice, develope, understand  |
|
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 1663
Members: 0
Total: 1663
