[Hard] SQLi challenge

[ajkaro]

Target:

hXXp://www.scootmods.net/cart.php?action=add&id=23

Task:

• display version with your name
  

Proof:

Rules:

• use union select based SQLi
  
• post your picture as proof
  
• send me your command to PM
  

Solvers:

- denjacker

- EterNo

Edited April 15, 2013 by ajkaro

[denjacker]

[EterNo]

[Titel]

Ar fi o idee ca dupa inchiderea challengeului sa fie postata rezolvarea.Astfel am putea invata mai usor SQLi prin exemple.

[qwerty12]

Si eu sunt de acord cu Titel ,acum ramane la parerea celorlalti!

[ajkaro]

I will give you a link to my tutorial on HackForums how to solve such challenge (after challenge is over). For start try to learn from error response. That is the most important thing at every SQLi. From it you can see where the problem (WAF) is... And based on it you can adopt your command

[ajkaro]

As I promised:

here is the link to my tutorial on HackForums where different strategies (when commas are blocked) are explained. One of them will help you solve this challenge

http://www.hackforums.net/showthread.php?tid=3116000

Some countries are blocked and can't access Hackfourms so use a proxy. If I remember well Gecko told me Romania was blocked lately...