[SQLi] challenge

[ajkaro]

It is holiday time Time for a SQLi challenge with few tasks

Target:

h~~p://w~w.mara[RST]bous.com.au/product.php?id=4

replace ~ and remove [RST]

Tasks:

• display version with your name
  
• display number of tables in primary database
  
• display list with names, records count and columns count of these tables
  
• mark tables with column password (characters pass in column name)
  
• display numbering of tables
  
• display result in formatted output (like a table with header and footer)
  
• bellow last table name display totals for records count and columns count for all displayed tables
  

Proof:

Rules:

• use union select based SQLi
  
• post picture as proof
  
• send me your command to PM
  
• your command should work without knowing anything about database on that site (no previous SQLi injections for checking tables, records, columns count are allowed/needed)
  
• hiding any (intermediate) results (like white color on white background) is not allowed
  
• don't share any part of the challenge solution until challenge is open
  
• colors in your output are not required
  

Preferred method is NOT to use HTML table command <table>...

Solvers:

- danyweb09 (with HTML <table> command)

Edited August 17, 2013 by ajkaro

[Bebe]

OFF: De ce scrii in engleza?

[dancezar]

OFF: De ce scrii in engleza?

Nu este roman de asta scrie in engleza

[Todo]

OFF: De ce scrii in engleza?

//Edit

@Bebe: You can always use Google Translate, is very helpful.

Edited August 11, 2013 by Todo

[ajkaro]

You can always use Google Translate, is very helpful.

That is what I do with posts in Romanian language

[Todo]

That is what I do with posts in Romanian language

That was for "Bebe", not for you dude! I was just surprised by the fact that some people ask really weird questions in here. If they doesn't understand the post they can always use Google Translate. And I already quoted that user, it was obvious that the message was for him and not for you. Same as I do now, I quote your message and reply to it.

Edited August 11, 2013 by Todo

[ajkaro]

That was for "Bebe", not for you dude! ...

What makes you think I was taking your post as addressed to me

I just wanted to support your suggestion about using Google translate. That is what I use when post is in Romanian language. So I backed you up...

[Todo]

What makes you think I was taking your post as addressed to me

I just wanted to support your suggestion about using Google translate. That is what I use when post is in Romanian language. So I backed you up...

Ok, obviously I misunderstood that.

[ajkaro]

For the first part of this challenge you can follow my tutorial on HF or Z+

http://www.hackforums.net/showthread.php?tid=3687706

http://zentrixplus.net/forum/index.php?/topic/1264-tutorial-sqli-the-used-select-statements-have-a-different-number-of-columns/

[dancezar]

I done all taks except the part without the HTML table tags(/*!edit here*/)

Nice challenge!

Edited August 17, 2013 by danyweb09

[ajkaro]

I done all taks except the part with the HTML table tags

...

But you did use HTML table command in your syntax...

Try to solve it without HTML table. That is preferred way.

P.S.

You solution is valid too. Added to solvers list. Congrats!

[dancezar]

But you did use HTML table command in your syntax...

Try to solve it without HTML table. That is preferred way.

P.S.

You solution is valid too. Added to solvers list. Congrats!

Sorry i write wrong.I wanted to write "without":)))