[Hard] SQLi challenge

[ajkaro]

Target:

_ttps://www.cbmin.org/cbm/directory?category=131

Task:

• display version with your name
  
• display all table names with first letter c or d
  
• bellow the list put the count of such tables
  

Proof:

Rules:

• use union select based SQLi
  
• post picture as proof
  
• send me your command to PM
  

Solvers:

- Gecko

- EterNo

- Renegade

CHALLENGE CLOSED.

Edited September 25, 2013 by ajkaro

[EterNo]

Thanks, good challenge.

[ajkaro]

Challenge is re-open.

Site owner patched SQLi vulnerability, so old command for challenge doesn't work any more. But there are other ways ...

If anybody wants to try same challenge again: this time please give me version with your name. Use union select based SQLi. Send your command to PM.

Proof:

[Renegade]

[.darky]

[ajkaro]

That challenge is closed. Didn't you see remark about that?

They removed WAF so now it isn't challenging any more... Plain basic injection...

Edited September 29, 2013 by ajkaro