Jump to content
ajkaro

SQLi challenge

Recommended Posts

Posted (edited)

Target:

hXXp://wXw.comforthomesolution.com/product.php?c=11

Task:

  • display version with your name
  • display all tables in primary database with records count for each table
  • all that should be result of one command

Proof:

4a3acf5926da00c9a1f3fe043f349ceb.jpg

Rules:

  • use union select based SQLi
  • post picture as proof
  • send me your command to PM
  • colors in output are not required

Solvers:

- danyweb09

Edited by ajkaro
Posted
Ai vreun indiciu? Tot incerc, insa partea cu ORDER BY care este deja in comanda ma da peste cap.

Mai sunt alte caractere de comentat in afara de --, /* si #.

DOUBLE QUERY BASED

  • Active Members
Posted (edited)

@theeternalwanderer gandeste-te la acel caracter in mysql care permite transformarea oricarui keyword chiar si cele rezervate intr-un nume de coloana.

Indiciu: select key from tabel => erroare de sintaxa cum rezolvi?

Edited by danyweb09

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...