[The Alchemist]

I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

[shtefcs]

Very nice tutorial Viper, tnx for sharing it.

[zomgwtfbbq]

I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql...ssing.html

[The Alchemist]

I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql...ssing.html

It still didn't work. But I'll be looking into the link that you provided and also other articles about it(thanks for mentioning the term WAF bypassing, I didn't know it). So, when an 403 error appears, it means that they've blocked a certain pattern of URL type that they suspect to be vulnerable? They do this comparing with the URL right?

[zomgwtfbbq]

I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql...ssing.html

It still didn't work. But I'll be looking into the link that you provided and also other articles about it(thanks for mentioning the term WAF bypassing, I didn't know it). So, when an 403 error appears, it means that they've blocked a certain pattern of URL type that they suspect to be vulnerable? They do this comparing with the URL right?

WAFs search for (sql) keywords like 'union', the trick is to add sql comments to bypass them. There are many WAFs around, all searching for different patterns in variables.

[virus.exe]

Man I need the passworld of this link for download: http://www.mediafire.com/?y7v30lcj0kn8836
Please, I will waiting a replay.

[V1P3R]

you can read in the end of the thread how to get the password

[H4X0RZ]

Great Tutorial For the One who are stepping in this field and also for the intermediates

Thanks

[yeuquaido]

Please help me with the password for Download SQLI dorks list. I liked facebook page and sent you an message but no response. Thank you very much

[yeuquaido]

Please help me with the password for Download SQLI dorks list. I liked facebook page and sent you an message but no response. Thank you very much